exploit-development

Files (1)

• SKILL.md

SKILL.md (first lines)

# Exploit Development Skill

## Identity
You are executing the **exploit-development** skill — full-cycle binary exploitation
from vulnerability detection to working proof-of-concept.

## Prerequisites
This skill requires `pwntools` (pip install mythos[exploit]) and optionally
Docker/podman for sandboxed testing.

## Loop: DETECT → ANALYZE → GENERATE → TEST → REFINE

### Phase 1: DETECT
Identify the vulnerability class and collect evidence:
- Use `check_mitigations` to profile the binary's defenses (NX, ASLR, Canary, PIE, RELRO).
- Use `analyze_binary` to extract symbols, imports, strings, and gadget count.
- Identify the vulnerability type: buffer overflow, format string, integer overflow,
  use-after-free, or logic bug.

### Phase 2: ANALYZE
Determine exploit strategy based on mitigations:

| Mitigations Active | Strategy |
|-------------------|----------|
| NX only | `ret2libc` — leak libc base, call `system("/bin/sh")` |
| NX + ASLR | `rop_chain` — leak address first, then ROP to `execve` |
| NX + ASLR + Canary | Leak canary via format string or info leak, then ROP |
| NX + ASLR + Canary + PIE | Leak PIE base + canary + libc, full chain |
| No mitigations | Direct `shellcode` injection (jmp esp / jmp reg) |

### Phase 3: GENERATE
Build the exploit:
- **ROP chain**: `generate_rop_chain(target, objective="execve_sh")`
- **Shellcode**: `generate_shellcode(arch="amd64", shell_type="execve_sh" or "reverse_tcp")`
- **Complete payload**: `inject_payload` — combines padding + return address + shellcode/ROP
- Handle bad bytes (null bytes, newlines, etc.) via encoding or gadget selection.

### Phase 4: TEST
Execute the payload in the sandbox:
- `sandbox_test(binary, payload_hex, expected_behavior="crash|shell|file_read")`
- Analyze crash: if SIGSEGV at wrong address → adjust offset
- If canary triggered (SIGABRT + "stack smashing") → need canary leak
- If no crash → increase offset or check if EIP/RIP was overwritten

### Phase 5: REFINE
Based on test results:
- **Wrong crash address**: Adjust `offset` parameter by ±4/8 bytes. Use cyclic pattern
  (`pwntools cyclic`) to find exact offset.
- **Bad bytes in payload**: Re-run `generate_rop_chain` with `bad_bytes` parameter.
- **ASLR defeating**: Add information leak step before ROP chain.
- **Shellcode not executing**: Check NX — if enabled, switch to ROP-based approach.
- **Container missing**: Fall back to `use_container=false` (process-level rlimits).

## Key tools

| Tool | Purpose |
|------|---------|
| `check_mitigations` | Profile binary defenses |
| `analyze_binary` | Extract symbols, imports, gadgets |
| `generate_rop_chain` | Build ROP chain |
| `generate_shellcode` | Generate shellcode |
| `inject_payload` | Assemble full exploit string |
| `run_exploit` | Execute payload in sandbox |
| `sandbox_test` | Test and classify result |

## Safety rules
- NEVER test exploits against production systems.
- ALWAYS use the sandbox (`use_container=true`).
- Destructive tools (`run_exploit`, `sandbox_test`) require user approval.
- Sub-agents are BLOCKED from calling these tools (SUBAGENT_DESTRUCTIVE_BLOCKLIST).

From freire19/Mythos, MIT.

More from freire19/Mythos