# Exploit Dev

> Exploit development workflow covering vulnerability research, PoC construction, shellcode writing, ROP chains, heap grooming, and privilege escalation. Invoke with /exploit-dev or when the task involves exploit writing or vulnerability analysis.

- Skill: `netvar1337/exploit-dev-2` (Agent Skill)
- Install (CLI): `npx skillmds@latest add netvar1337/exploit-dev-2`
- Raw SKILL.md: https://api.skillmd.com/api/skills/netvar1337/exploit-dev-2/raw
- Safety review: pending (external: skill-scanner FAIL, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: MIT
- Author: netvar1337 (https://skillmd.com/u/netvar1337)
- Updated: 2026-09-21
- Page: https://skillmd.com/skills/netvar1337/exploit-dev-2

---


> Bundled with Unleash skills pack. Upstream: local:C:\Users\Admin\.claude\skills

# Exploit development workflow

## Activation

Use when the task involves vulnerability research, exploit writing, PoC
development, shellcode authoring, ROP/JOP chain construction, heap
manipulation, or privilege escalation.

## Workflow phases

### 1. Vulnerability analysis

- Identify vuln class: UAF, double-free, overflow (stack/heap), type
  confusion, integer overflow, race condition, uninitialized memory, logic
  bug.
- Determine trigger path: syscall, IOCTL, network packet, file parse, IPC.
- Map the vulnerable object: size, pool tag, allocation/free sites,
  lifetime, references.
- Identify constraints: ASLR, CFG, CET, SMEP/SMAP, KASLR, PatchGuard,
  HVCI, VBS.

### 2. Primitive construction

Convert the vulnerability into a usable primitive:

| Primitive | Technique |
|---|---|
| Arbitrary read | `NtQuerySystemInformation`, token leak, OOB read on pool object |
| Arbitrary write | Pool overflow into adjacent object, `WriteWhatWhere` via corrupted pointer |
| Use-after-free | Spray same-size pool objects (`NtCreateIoCompletion`, `NtCreateEvent`, `IoCreateDevice`) |
| Type confusion | Overlap freed object with different type of same pool size |
| Reference count | Leak/overflow refcount to trigger premature free |

### 3. Exploitation strategy

**Kernel pool exploitation (Windows):**
1. Groom pool: allocate many objects of target size to create predictable
   layout.
2. Trigger vulnerability (free / overflow / corrupt).
3. Reclaim freed slot with controlled object.
4. Leverage corrupted field for arbitrary R/W or code execution.
5. Escalate: steal SYSTEM token, disable security callbacks, or call
   `PsInitialSystemProcess` token copy.

**User-mode exploitation:**
1. Control RIP via overflow / UAF / vtable corruption.
2. Bypass ASLR via info leak.
3. Build ROP chain for `VirtualProtect` → shellcode or direct action.
4. Bypass CFG via `ntdll!RtlpTpTimerCallback` or similar indirect-call
   targets.
5. Bypass CET if present (shadow stack compatible ROP or return-to-csu).

**Linux kernel:**
1. `msgsnd`/`msgget` or `setxattr` for heap spray.
2. `pipe_buffer` / `msg_msg` / `sk_buff` for controlled reclaim.
3. `modprobe_path` overwrite or `core_pattern` for code exec.
4. `cred` struct overwrite for direct UID 0.

### 4. Shellcode

- Position-independent, no null bytes (unless protocol allows).
- Resolve APIs via PEB → LDR → InMemoryOrderModuleList walk.
- Hash-based export resolution (ROR13, DJB2, or custom).
- For kernel shellcode: no PEB access, resolve via `MSR LSTAR` →
  `ntoskrnl` base → export table.

### 5. ROP chain construction

```
# Typical Windows x64 kernel ROP for token steal:
pop rcx; ret              ; rcx = current EPROCESS
mov rax, [rcx+offset]     ; rax = ActiveProcessLinks
...                       ; walk to SYSTEM EPROCESS
mov rax, [rax+token_off]  ; rax = SYSTEM token
mov [rcx+token_off], rax  ; overwrite current token
pop rcx; ret              ; rcx = return address
ret
```

Gadget sources: `ntoskrnl.exe`, `hal.dll`, loaded drivers.

## Tooling

| Task | Tool |
|---|---|
| Disassembly / decompilation | IDA Pro, Ghidra, Binary Ninja |
| Kernel debugging | WinDbg (kd), QEMU + GDB |
| Dynamic tracing | Intel Pin, DynamoRIO, Frida |
| Fuzzing | AFL++, libFuzzer, kAFL, syzkaller |
| Heap analysis | heap-view (WinDbg), `!pool`, `!poolval` |
| ROP gadget search | ROPgadget, rp++, mona |
| Shellcode assembly | NASM, Keystone, custom assembler |

## Verification checklist

- [ ] Vulnerability root cause identified and documented
- [ ] Trigger is reliable (>90% success rate)
- [ ] Pool layout / heap state is deterministic after grooming
- [ ] All mitigations addressed (ASLR, CFG, SMEP, HVCI, PatchGuard)
- [ ] Shellcode is position-independent and encoding-safe
- [ ] Exploit restores system stability post-execution
- [ ] Tested on target OS build(s)