exploit-development

Use when turning a memory-corruption bug into a working PoC — stack/ROP, glibc heap & FSOP, format strings, browser/JIT type confusion & UAF, Linux/Windows kernel LPE against ASLR/DEP/CFG/CET/V8-Sandbox

Jump to install

Repository: hypnguyen1209/offensive-claude
Last source activity: June 30, 2026 at 06:44
Detected SKILL.md language: English
Stars: 343
Forks: 59

Install options

The review-first prompt is selected by default. You can switch to a direct command or download a local copy.

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

A direct command skips the review prompt. Inspect the source before running it.

npx skills add https://github.com/hypnguyen1209/offensive-claude --skill exploit-development

The command stays on one line. Scroll horizontally to inspect it before copying.

Prefer a local copy? Download the files currently available to SkillsMP.

Review the source files

Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.

File Explorer

16 files

SKILL.md

Source instructions · Read-only preview

Back to search Back to installation

reverse-engineering

Use when reverse-engineering a binary or firmware — static triage + decompilation (Ghidra/IDA/Binary Ninja), dynamic instrumentation (GDB/Frida 17/angr), anti-reversing & packer bypass, OLLVM/VM deobfuscation, UEFI/BIOS RE & Secure Boot research, patch-diffing for n-days

2026-07-30

privesc-windows

Use when escalating privileges on a Windows host — SeImpersonate Potato chains (GodPotato/PrintNotifyPotato), service & DLL hijacking, UAC bypass (fodhelper/ICMLuaUtil), kernel EoP + BYOVD (CVE-2025-29824), token-rights abuse, LSASS/SAM/DPAPI credential harvesting

2026-06-30

threat-model-discipline

Use when starting an engagement, before exploitation, or whenever the attack surface changes — build/validate the threat model and detect drift (new unreviewed surface) before advancing

2026-06-30

View all from this repository

Exploit Development

End-to-end weaponization: turn a confirmed bug class into a reliable, version-pinned PoC, then a primitive chain (leak -> R/W -> control flow), against current mitigations. Every cluster pairs the offensive path with detection telemetry and OPSEC.

When to Activate

A confirmed vulnerability needs a working, reliable PoC (>=90% success target).

Userland binary exploitation: stack overflow, heap (UAF/overflow/double-free), format string.

Defeating modern mitigations: ASLR/PIE, NX/DEP, stack canaries, Full RELRO, CFG, Intel CET shadow stack, V8 Sandbox/pointer compression.

Browser/JIT engine exploitation (V8 type confusion, addrof/fakeobj, WASM jump-table pivot).

Local privilege escalation via Linux/Windows kernel memory corruption.

Converting a crash into a stable read/write/execute primitive chain.

Technique Map

Technique

ATT&CK

CWE

Reference

Script

Stack overflow -> ret2libc/ROP

T1203

CWE-121

references/stack-rop-mitigations.md

scripts/offset_finder.py

ret2csu / SROP / stack pivot

T1203

CWE-121

references/stack-rop-mitigations.md

scripts/rop_autochain.py

ret2dlresolve (leakless)

T1203

CWE-121

references/stack-rop-mitigations.md

scripts/rop_autochain.py

CET/CFG-aware control-flow hijack

T1203

CWE-1419

references/stack-rop-mitigations.md

scripts/rop_autochain.py

tcache/fastbin poisoning + safe-linking

T1203

CWE-416

references/heap-glibc-fsop.md

scripts/safe_linking.py

House of Botcake / Einherjar / Apple2

T1203

CWE-415

references/heap-glibc-fsop.md

scripts/heap_fsop.py

FSOP (stdout leak, House of Apple 2)

T1203

CWE-787

references/heap-glibc-fsop.md

scripts/heap_fsop.py

Format string leak + arbitrary write

T1203

CWE-134

references/format-string-leaks.md

scripts/fmtstr_leak.py

V8 type confusion -> addrof/fakeobj

Exploit Development

When to Activate

A confirmed vulnerability needs a working, reliable PoC (>=90% success target).

Userland binary exploitation: stack overflow, heap (UAF/overflow/double-free), format string.

Defeating modern mitigations: ASLR/PIE, NX/DEP, stack canaries, Full RELRO, CFG, Intel CET shadow stack, V8 Sandbox/pointer compression.

Browser/JIT engine exploitation (V8 type confusion, addrof/fakeobj, WASM jump-table pivot).

Local privilege escalation via Linux/Windows kernel memory corruption.

Converting a crash into a stable read/write/execute primitive chain.

Technique Map

Technique

ATT&CK

CWE

Reference

Script

Stack overflow -> ret2libc/ROP

T1203

CWE-121

references/stack-rop-mitigations.md

scripts/offset_finder.py

ret2csu / SROP / stack pivot

T1203

CWE-121

references/stack-rop-mitigations.md

scripts/rop_autochain.py

ret2dlresolve (leakless)

T1203

CWE-121

references/stack-rop-mitigations.md

scripts/rop_autochain.py

CET/CFG-aware control-flow hijack

T1203

CWE-1419

references/stack-rop-mitigations.md

scripts/rop_autochain.py

tcache/fastbin poisoning + safe-linking

T1203

CWE-416

references/heap-glibc-fsop.md

scripts/safe_linking.py

House of Botcake / Einherjar / Apple2

T1203

CWE-415

references/heap-glibc-fsop.md

scripts/heap_fsop.py

FSOP (stdout leak, House of Apple 2)

T1203

CWE-787

references/heap-glibc-fsop.md

scripts/heap_fsop.py

Format string leak + arbitrary write

T1203

CWE-134

references/format-string-leaks.md

scripts/fmtstr_leak.py

V8 type confusion -> addrof/fakeobj

name	exploit-development
description	Use when turning a memory-corruption bug into a working PoC — stack/ROP, glibc heap & FSOP, format strings, browser/JIT type confusion & UAF, Linux/Windows kernel LPE against ASLR/DEP/CFG/CET/V8-Sandbox
metadata	{"type":"offensive","phase":"exploitation","tools":"pwntools, gdb-gef, pwndbg, radare2, ropper, ROPgadget, one_gadget, angr, d8, WinDbg, IDA","mitre":["T1203","T1068","T1211","T1212","T1055"]}
kill_chain	{"phase":["weaponize","exploit"],"step":[2,4],"attck_tactics":["TA0042","TA0002","TA0004"],"attck_techniques":["T1203","T1068","T1211","T1212","T1055.012"]}
depends_on	["recon-osint","vulnerability-analysis"]
feeds_into	["edr-evasion","shellcode-dev","initial-access","privesc-linux","privesc-windows"]
inputs	["vulnerability_list","attack_surface_map","crash_corpus","target_versions"]
outputs	["exploit_poc","payload","primitive_chain","finding_record"]
references	["references/stack-rop-mitigations.md","references/heap-glibc-fsop.md","references/format-string-leaks.md","references/browser-jit-uaf.md","references/kernel-exploitation.md","references/exploit-feasibility.md"]
scripts	["scripts/rop_autochain.py","scripts/offset_finder.py","scripts/heap_fsop.py","scripts/safe_linking.py","scripts/fmtstr_leak.py","scripts/v8_primitives.js","scripts/kernel_lpe_skeleton.c","scripts/exploit_context.py","scripts/feasibility_profile.py"]

name	exploit-development
description	Use when turning a memory-corruption bug into a working PoC — stack/ROP, glibc heap & FSOP, format strings, browser/JIT type confusion & UAF, Linux/Windows kernel LPE against ASLR/DEP/CFG/CET/V8-Sandbox
metadata	{"type":"offensive","phase":"exploitation","tools":"pwntools, gdb-gef, pwndbg, radare2, ropper, ROPgadget, one_gadget, angr, d8, WinDbg, IDA","mitre":["T1203","T1068","T1211","T1212","T1055"]}
kill_chain	{"phase":["weaponize","exploit"],"step":[2,4],"attck_tactics":["TA0042","TA0002","TA0004"],"attck_techniques":["T1203","T1068","T1211","T1212","T1055.012"]}
depends_on	["recon-osint","vulnerability-analysis"]
feeds_into	["edr-evasion","shellcode-dev","initial-access","privesc-linux","privesc-windows"]
inputs	["vulnerability_list","attack_surface_map","crash_corpus","target_versions"]
outputs	["exploit_poc","payload","primitive_chain","finding_record"]
references	["references/stack-rop-mitigations.md","references/heap-glibc-fsop.md","references/format-string-leaks.md","references/browser-jit-uaf.md","references/kernel-exploitation.md","references/exploit-feasibility.md"]
scripts	["scripts/rop_autochain.py","scripts/offset_finder.py","scripts/heap_fsop.py","scripts/safe_linking.py","scripts/fmtstr_leak.py","scripts/v8_primitives.js","scripts/kernel_lpe_skeleton.c","scripts/exploit_context.py","scripts/feasibility_profile.py"]

Technique	Telemetry/IOC	Detection (Sigma/EDR)	OPSEC note
ROP/ret2libc	Stack exec faults, abnormal `execve("/bin/sh")` child of network daemon	EDR: child shell from listener; auditd `execve` of `/bin/sh` w/ empty argv	Use in-memory ORW (open/read/write flag) instead of shell to avoid `execve` IOC
Heap/FSOP	glibc `* stack smashing *`/`malloc(): ...` aborts in logs; SIGABRT crash loops	Sigma: repeated SIGABRT/SIGSEGV from same PID; coredump bursts	Disable coredumps (`prctl(PR_SET_DUMPABLE,0)`); tune spray to avoid abort()s
Format string	`%n`/`%p` strings in request/argv logs; segfault on bad write	WAF/Sigma on `%n`,`%[0-9]+\$n` in inputs	Pre-stage write target; minimize `%` count, avoid huge field widths
V8 type confusion	Renderer crash dumps, `chrome_crashpad`, GPU/renderer restarts	Crashpad telemetry; EDR on renderer spawning unexpected processes	Keep corruption inside cage; clean up sprayed arrays; avoid renderer crash on failure
Kernel LPE	`dmesg` oops/RIP, KASAN splats, `apparmor`/`audit` LPE child = root	Sigma: process gaining uid=0 w/o setuid path; EDR kernel-callback	Fileless (no SUID drop); restore corrupted state; clear `dmesg` only if authorized

exploit-development

Install options

Review the source files