automated-exploit-generation

name	Automated Exploit Generation
description	Automatic exploit generation from vulnerability analysis
tags	["exploit","rop","shellcode","vulnerability","overflow","uaf","hacking"]
allowed_tools	["scan_exploitable_vulnerabilities","generate_exploit_code","find_rop_gadgets","decompile_function","get_disasm","list_imports"]

Task: Automated Exploit Generation. Detect vulnerabilities and generate working exploits.

Exploitation Pipeline

1. Vulnerability Discovery

   • Pattern-based vulnerability scanning
   • Taint analysis for data flows
   • Control flow analysis for exploitation primitives

2. Exploit Development

   • Generate exploit templates
   • Build ROP chains
   • Bypass mitigations (DEP, ASLR, etc.)

3. Testing & Refinement

   • Validate exploit logic
   • Test in safe environment
   • Refine for reliability

Vulnerability Classes

Stack Buffer Overflow

Detection:

• Fixed-size buffers with unsafe operations
• memcpy, strcpy, sprintf without bounds checking
• User-controlled input size

Analysis:

1. Find overflow point
2. Calculate offset to return address
3. Identify gadget sources (binary, libc)
4. Build ROP chain for:
   - Disable DEP (VirtualProtect/mprotect)
   - Load shellcode
   - Jump to shellcode

Heap Overflow / UAF

Detection:

• Heap allocations with user-controlled size
• free/delete followed by use
• Object lifetime issues

Analysis:

1. Identify heap allocation pattern
2. Find overflow target objects
3. Spray controlled objects
4. Trigger use of corrupted object

Integer Overflow

Detection:

• Size calculations: size = count * sizeof
• Allocation vs copy size mismatch
• Wraparound conditions

Format String

Detection:

• printf(user_input)
• sprintf(buffer, user_input)
• Missing format specifier

ROP Chain Building

Gadgets Needed

x86_64: pop rdi; ret, pop rsi; ret, pop rdx; ret, jmp rsp x86: pop eax; ret, pop ecx; ret, jmp esp ARM64: ldp x29, x30, [sp], #16, br x30

ROP Chain Templates

DEP Bypass (VirtualProtect):

rop  = pop_rdi; ret
rop += address
rop += pop_rsi; ret
rop += size
rop += pop_rdx; ret
rop += 0x40
rop += virtual_protect
rop += jump_to_shellcode

Mitigation Bypass

• DEP/NX: ROP, ret2plt, ret2libc
• ASLR: Info leak, partial overwrite
• Stack Canary: Info leak, bruteforce
• CFG: Compatible gadgets

Shellcode Generation

• execve /bin/sh (Linux)
• Reverse TCP shell
• Bind TCP shell
• Staged vs stageless

Tools: msfvenom, pwntools, shellcraft