Bundled with Unleash skills pack. Upstream: local:C:\Users\Admin.claude\skills
Exploit development workflow
Activation
Use when the task involves vulnerability research, exploit writing, PoC
development, shellcode authoring, ROP/JOP chain construction, heap
manipulation, or privilege escalation.
Workflow phases
1. Vulnerability analysis
- Identify vuln class: UAF, double-free, overflow (stack/heap), type
confusion, integer overflow, race condition, uninitialized memory, logic
bug.
- Determine trigger path: syscall, IOCTL, network packet, file parse, IPC.
- Map the vulnerable object: size, pool tag, allocation/free sites,
lifetime, references.
- Identify constraints: ASLR, CFG, CET, SMEP/SMAP, KASLR, PatchGuard,
HVCI, VBS.
2. Primitive construction
Convert the vulnerability into a usable primitive:
| Primitive |
Technique |
| Arbitrary read |
NtQuerySystemInformation, token leak, OOB read on pool object |
| Arbitrary write |
Pool overflow into adjacent object, WriteWhatWhere via corrupted pointer |
| Use-after-free |
Spray same-size pool objects (NtCreateIoCompletion, NtCreateEvent, IoCreateDevice) |
| Type confusion |
Overlap freed object with different type of same pool size |
| Reference count |
Leak/overflow refcount to trigger premature free |
3. Exploitation strategy
Kernel pool exploitation (Windows):
- Groom pool: allocate many objects of target size to create predictable
layout.
- Trigger vulnerability (free / overflow / corrupt).
- Reclaim freed slot with controlled object.
- Leverage corrupted field for arbitrary R/W or code execution.
- Escalate: steal SYSTEM token, disable security callbacks, or call
PsInitialSystemProcess token copy.
User-mode exploitation:
- Control RIP via overflow / UAF / vtable corruption.
- Bypass ASLR via info leak.
- Build ROP chain for
VirtualProtect → shellcode or direct action.
- Bypass CFG via
ntdll!RtlpTpTimerCallback or similar indirect-call
targets.
- Bypass CET if present (shadow stack compatible ROP or return-to-csu).
Linux kernel:
msgsnd/msgget or setxattr for heap spray.pipe_buffer / msg_msg / sk_buff for controlled reclaim.modprobe_path overwrite or core_pattern for code exec.cred struct overwrite for direct UID 0.
4. Shellcode
- Position-independent, no null bytes (unless protocol allows).
- Resolve APIs via PEB → LDR → InMemoryOrderModuleList walk.
- Hash-based export resolution (ROR13, DJB2, or custom).
- For kernel shellcode: no PEB access, resolve via
MSR LSTAR →
ntoskrnl base → export table.
5. ROP chain construction
# Typical Windows x64 kernel ROP for token steal:
pop rcx; ret ; rcx = current EPROCESS
mov rax, [rcx+offset] ; rax = ActiveProcessLinks
... ; walk to SYSTEM EPROCESS
mov rax, [rax+token_off] ; rax = SYSTEM token
mov [rcx+token_off], rax ; overwrite current token
pop rcx; ret ; rcx = return address
ret
Gadget sources: ntoskrnl.exe, hal.dll, loaded drivers.
Tooling
| Task |
Tool |
| Disassembly / decompilation |
IDA Pro, Ghidra, Binary Ninja |
| Kernel debugging |
WinDbg (kd), QEMU + GDB |
| Dynamic tracing |
Intel Pin, DynamoRIO, Frida |
| Fuzzing |
AFL++, libFuzzer, kAFL, syzkaller |
| Heap analysis |
heap-view (WinDbg), !pool, !poolval |
| ROP gadget search |
ROPgadget, rp++, mona |
| Shellcode assembly |
NASM, Keystone, custom assembler |
Verification checklist
1---2name: exploit-dev-23description: Exploit development workflow covering vulnerability research, PoC construction, shellcode writing, ROP chains, heap grooming, and privilege escalation. Invoke with /exploit-dev or when the task involves exploit writing or vulnerability analysis.4license: MIT5---67> Bundled with Unleash skills pack. Upstream: local:C:\Users\Admin\.claude\skills89# Exploit development workflow1011## Activation1213Use when the task involves vulnerability research, exploit writing, PoC14development, shellcode authoring, ROP/JOP chain construction, heap15manipulation, or privilege escalation.1617## Workflow phases1819### 1. Vulnerability analysis2021- Identify vuln class: UAF, double-free, overflow (stack/heap), type22 confusion, integer overflow, race condition, uninitialized memory, logic23 bug.24- Determine trigger path: syscall, IOCTL, network packet, file parse, IPC.25- Map the vulnerable object: size, pool tag, allocation/free sites,26 lifetime, references.27- Identify constraints: ASLR, CFG, CET, SMEP/SMAP, KASLR, PatchGuard,28 HVCI, VBS.2930### 2. Primitive construction3132Convert the vulnerability into a usable primitive:3334| Primitive | Technique |35|---|---|36| Arbitrary read | `NtQuerySystemInformation`, token leak, OOB read on pool object |37| Arbitrary write | Pool overflow into adjacent object, `WriteWhatWhere` via corrupted pointer |38| Use-after-free | Spray same-size pool objects (`NtCreateIoCompletion`, `NtCreateEvent`, `IoCreateDevice`) |39| Type confusion | Overlap freed object with different type of same pool size |40| Reference count | Leak/overflow refcount to trigger premature free |4142### 3. Exploitation strategy4344**Kernel pool exploitation (Windows):**451. Groom pool: allocate many objects of target size to create predictable46 layout.472. Trigger vulnerability (free / overflow / corrupt).483. Reclaim freed slot with controlled object.494. Leverage corrupted field for arbitrary R/W or code execution.505. Escalate: steal SYSTEM token, disable security callbacks, or call51 `PsInitialSystemProcess` token copy.5253**User-mode exploitation:**541. Control RIP via overflow / UAF / vtable corruption.552. Bypass ASLR via info leak.563. Build ROP chain for `VirtualProtect` → shellcode or direct action.574. Bypass CFG via `ntdll!RtlpTpTimerCallback` or similar indirect-call58 targets.595. Bypass CET if present (shadow stack compatible ROP or return-to-csu).6061**Linux kernel:**621. `msgsnd`/`msgget` or `setxattr` for heap spray.632. `pipe_buffer` / `msg_msg` / `sk_buff` for controlled reclaim.643. `modprobe_path` overwrite or `core_pattern` for code exec.654. `cred` struct overwrite for direct UID 0.6667### 4. Shellcode6869- Position-independent, no null bytes (unless protocol allows).70- Resolve APIs via PEB → LDR → InMemoryOrderModuleList walk.71- Hash-based export resolution (ROR13, DJB2, or custom).72- For kernel shellcode: no PEB access, resolve via `MSR LSTAR` →73 `ntoskrnl` base → export table.7475### 5. ROP chain construction7677```78# Typical Windows x64 kernel ROP for token steal:79pop rcx; ret ; rcx = current EPROCESS80mov rax, [rcx+offset] ; rax = ActiveProcessLinks81... ; walk to SYSTEM EPROCESS82mov rax, [rax+token_off] ; rax = SYSTEM token83mov [rcx+token_off], rax ; overwrite current token84pop rcx; ret ; rcx = return address85ret86```8788Gadget sources: `ntoskrnl.exe`, `hal.dll`, loaded drivers.8990## Tooling9192| Task | Tool |93|---|---|94| Disassembly / decompilation | IDA Pro, Ghidra, Binary Ninja |95| Kernel debugging | WinDbg (kd), QEMU + GDB |96| Dynamic tracing | Intel Pin, DynamoRIO, Frida |97| Fuzzing | AFL++, libFuzzer, kAFL, syzkaller |98| Heap analysis | heap-view (WinDbg), `!pool`, `!poolval` |99| ROP gadget search | ROPgadget, rp++, mona |100| Shellcode assembly | NASM, Keystone, custom assembler |101102## Verification checklist103104- [ ] Vulnerability root cause identified and documented105- [ ] Trigger is reliable (>90% success rate)106- [ ] Pool layout / heap state is deterministic after grooming107- [ ] All mitigations addressed (ASLR, CFG, SMEP, HVCI, PatchGuard)108- [ ] Shellcode is position-independent and encoding-safe109- [ ] Exploit restores system stability post-execution110- [ ] Tested on target OS build(s)
netvar1337