exploit-development

Use when turning a memory-corruption bug into a working PoC — stack/ROP, glibc heap & FSOP, format strings, browser/JIT type confusion & UAF, Linux/Windows kernel LPE against ASLR/DEP/CFG/CET/V8-Sandbox

Ir para a instalação

Repositório: hypnguyen1209/offensive-claude
Última atividade na origem: 30 de junho de 2026 às 06:44
Idioma detectado do SKILL.md: inglês
Estrelas: 343
Forks: 59

Opções de instalação

Por padrão, está selecionado o prompt que primeiro revisa a origem. Você pode mudar para um comando direto ou baixar uma cópia local.

Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.

Um comando direto ignora o prompt de revisão. Verifique a origem antes de executá-lo.

npx skills add https://github.com/hypnguyen1209/offensive-claude --skill exploit-development

O comando permanece em uma só linha. Role horizontalmente para revisá-lo antes de copiar.

Prefere uma cópia local? Baixe os arquivos disponíveis atualmente no SkillsMP.

Revise os arquivos de origem

Leia o SKILL.md e os arquivos complementares exibidos pelo SkillsMP antes de decidir se vai instalar.

Explorador de arquivos

16 arquivos

SKILL.md

Instruções da origem · Visualização somente leitura

Voltar à pesquisa Voltar à instalação

reverse-engineering

Use when reverse-engineering a binary or firmware — static triage + decompilation (Ghidra/IDA/Binary Ninja), dynamic instrumentation (GDB/Frida 17/angr), anti-reversing & packer bypass, OLLVM/VM deobfuscation, UEFI/BIOS RE & Secure Boot research, patch-diffing for n-days

2026-07-30

privesc-windows

Use when escalating privileges on a Windows host — SeImpersonate Potato chains (GodPotato/PrintNotifyPotato), service & DLL hijacking, UAC bypass (fodhelper/ICMLuaUtil), kernel EoP + BYOVD (CVE-2025-29824), token-rights abuse, LSASS/SAM/DPAPI credential harvesting

2026-06-30

threat-model-discipline

Use when starting an engagement, before exploitation, or whenever the attack surface changes — build/validate the threat model and detect drift (new unreviewed surface) before advancing

2026-06-30

Ver todas deste repositório

Exploit Development

End-to-end weaponization: turn a confirmed bug class into a reliable, version-pinned PoC, then a primitive chain (leak -> R/W -> control flow), against current mitigations. Every cluster pairs the offensive path with detection telemetry and OPSEC.

When to Activate

A confirmed vulnerability needs a working, reliable PoC (>=90% success target).

Userland binary exploitation: stack overflow, heap (UAF/overflow/double-free), format string.

Defeating modern mitigations: ASLR/PIE, NX/DEP, stack canaries, Full RELRO, CFG, Intel CET shadow stack, V8 Sandbox/pointer compression.

Browser/JIT engine exploitation (V8 type confusion, addrof/fakeobj, WASM jump-table pivot).

Local privilege escalation via Linux/Windows kernel memory corruption.

Converting a crash into a stable read/write/execute primitive chain.

Technique Map

Technique

ATT&CK

CWE

Reference

Script

Stack overflow -> ret2libc/ROP

T1203

CWE-121

references/stack-rop-mitigations.md

scripts/offset_finder.py

ret2csu / SROP / stack pivot

T1203

CWE-121

references/stack-rop-mitigations.md

scripts/rop_autochain.py

ret2dlresolve (leakless)

T1203

CWE-121

references/stack-rop-mitigations.md

scripts/rop_autochain.py

CET/CFG-aware control-flow hijack

T1203

CWE-1419

references/stack-rop-mitigations.md

scripts/rop_autochain.py

tcache/fastbin poisoning + safe-linking

T1203

CWE-416

references/heap-glibc-fsop.md

scripts/safe_linking.py

House of Botcake / Einherjar / Apple2

T1203

CWE-415

references/heap-glibc-fsop.md

scripts/heap_fsop.py

FSOP (stdout leak, House of Apple 2)

T1203

CWE-787

references/heap-glibc-fsop.md

scripts/heap_fsop.py

Format string leak + arbitrary write

T1203

CWE-134

references/format-string-leaks.md

scripts/fmtstr_leak.py

V8 type confusion -> addrof/fakeobj

Exploit Development

When to Activate

A confirmed vulnerability needs a working, reliable PoC (>=90% success target).

Userland binary exploitation: stack overflow, heap (UAF/overflow/double-free), format string.

Defeating modern mitigations: ASLR/PIE, NX/DEP, stack canaries, Full RELRO, CFG, Intel CET shadow stack, V8 Sandbox/pointer compression.

Browser/JIT engine exploitation (V8 type confusion, addrof/fakeobj, WASM jump-table pivot).

Local privilege escalation via Linux/Windows kernel memory corruption.

Converting a crash into a stable read/write/execute primitive chain.

Technique Map

Technique

ATT&CK

CWE

Reference

Script

Stack overflow -> ret2libc/ROP

T1203

CWE-121

references/stack-rop-mitigations.md

scripts/offset_finder.py

ret2csu / SROP / stack pivot

T1203

CWE-121

references/stack-rop-mitigations.md

scripts/rop_autochain.py

ret2dlresolve (leakless)

T1203

CWE-121

references/stack-rop-mitigations.md

scripts/rop_autochain.py

CET/CFG-aware control-flow hijack

T1203

CWE-1419

references/stack-rop-mitigations.md

scripts/rop_autochain.py

tcache/fastbin poisoning + safe-linking

T1203

CWE-416

references/heap-glibc-fsop.md

scripts/safe_linking.py

House of Botcake / Einherjar / Apple2

T1203

CWE-415

references/heap-glibc-fsop.md

scripts/heap_fsop.py

FSOP (stdout leak, House of Apple 2)

T1203

CWE-787

references/heap-glibc-fsop.md

scripts/heap_fsop.py

Format string leak + arbitrary write

T1203

CWE-134

references/format-string-leaks.md

scripts/fmtstr_leak.py

V8 type confusion -> addrof/fakeobj

name	exploit-development
description	Use when turning a memory-corruption bug into a working PoC — stack/ROP, glibc heap & FSOP, format strings, browser/JIT type confusion & UAF, Linux/Windows kernel LPE against ASLR/DEP/CFG/CET/V8-Sandbox
metadata	{"type":"offensive","phase":"exploitation","tools":"pwntools, gdb-gef, pwndbg, radare2, ropper, ROPgadget, one_gadget, angr, d8, WinDbg, IDA","mitre":["T1203","T1068","T1211","T1212","T1055"]}
kill_chain	{"phase":["weaponize","exploit"],"step":[2,4],"attck_tactics":["TA0042","TA0002","TA0004"],"attck_techniques":["T1203","T1068","T1211","T1212","T1055.012"]}
depends_on	["recon-osint","vulnerability-analysis"]
feeds_into	["edr-evasion","shellcode-dev","initial-access","privesc-linux","privesc-windows"]
inputs	["vulnerability_list","attack_surface_map","crash_corpus","target_versions"]
outputs	["exploit_poc","payload","primitive_chain","finding_record"]
references	["references/stack-rop-mitigations.md","references/heap-glibc-fsop.md","references/format-string-leaks.md","references/browser-jit-uaf.md","references/kernel-exploitation.md","references/exploit-feasibility.md"]
scripts	["scripts/rop_autochain.py","scripts/offset_finder.py","scripts/heap_fsop.py","scripts/safe_linking.py","scripts/fmtstr_leak.py","scripts/v8_primitives.js","scripts/kernel_lpe_skeleton.c","scripts/exploit_context.py","scripts/feasibility_profile.py"]

name	exploit-development
description	Use when turning a memory-corruption bug into a working PoC — stack/ROP, glibc heap & FSOP, format strings, browser/JIT type confusion & UAF, Linux/Windows kernel LPE against ASLR/DEP/CFG/CET/V8-Sandbox
metadata	{"type":"offensive","phase":"exploitation","tools":"pwntools, gdb-gef, pwndbg, radare2, ropper, ROPgadget, one_gadget, angr, d8, WinDbg, IDA","mitre":["T1203","T1068","T1211","T1212","T1055"]}
kill_chain	{"phase":["weaponize","exploit"],"step":[2,4],"attck_tactics":["TA0042","TA0002","TA0004"],"attck_techniques":["T1203","T1068","T1211","T1212","T1055.012"]}
depends_on	["recon-osint","vulnerability-analysis"]
feeds_into	["edr-evasion","shellcode-dev","initial-access","privesc-linux","privesc-windows"]
inputs	["vulnerability_list","attack_surface_map","crash_corpus","target_versions"]
outputs	["exploit_poc","payload","primitive_chain","finding_record"]
references	["references/stack-rop-mitigations.md","references/heap-glibc-fsop.md","references/format-string-leaks.md","references/browser-jit-uaf.md","references/kernel-exploitation.md","references/exploit-feasibility.md"]
scripts	["scripts/rop_autochain.py","scripts/offset_finder.py","scripts/heap_fsop.py","scripts/safe_linking.py","scripts/fmtstr_leak.py","scripts/v8_primitives.js","scripts/kernel_lpe_skeleton.c","scripts/exploit_context.py","scripts/feasibility_profile.py"]

Technique	Telemetry/IOC	Detection (Sigma/EDR)	OPSEC note
ROP/ret2libc	Stack exec faults, abnormal `execve("/bin/sh")` child of network daemon	EDR: child shell from listener; auditd `execve` of `/bin/sh` w/ empty argv	Use in-memory ORW (open/read/write flag) instead of shell to avoid `execve` IOC
Heap/FSOP	glibc `* stack smashing *`/`malloc(): ...` aborts in logs; SIGABRT crash loops	Sigma: repeated SIGABRT/SIGSEGV from same PID; coredump bursts	Disable coredumps (`prctl(PR_SET_DUMPABLE,0)`); tune spray to avoid abort()s
Format string	`%n`/`%p` strings in request/argv logs; segfault on bad write	WAF/Sigma on `%n`,`%[0-9]+\$n` in inputs	Pre-stage write target; minimize `%` count, avoid huge field widths
V8 type confusion	Renderer crash dumps, `chrome_crashpad`, GPU/renderer restarts	Crashpad telemetry; EDR on renderer spawning unexpected processes	Keep corruption inside cage; clean up sprayed arrays; avoid renderer crash on failure
Kernel LPE	`dmesg` oops/RIP, KASAN splats, `apparmor`/`audit` LPE child = root	Sigma: process gaining uid=0 w/o setuid path; EDR kernel-callback	Fileless (no SUID drop); restore corrupted state; clear `dmesg` only if authorized

exploit-development

Opções de instalação

Revise os arquivos de origem