Develop binary exploits from known vulnerabilities

This skill turns an already-identified binary vulnerability into a working exploit, for CTF challenges or authorized real-world security assessments. It assumes the vulnerability point is already known (from fuzzing, auditing, or static analysis) and covers the workflow from confirming protections through remote stabilization: checking security mitigations (NX, canary, PIE, RELRO, Fortify) with checksec, classifying the vulnerability (stack overflow, format string, heap UAF/double-free/overflow, integer, race, or kernel), selecting an exploitation strategy (direct shellcode, ret2libc/one_gadget, or heap-technique routing by glibc version), preparing libc offsets and ROP gadgets via libc-database/ROPgadget/one_gadget, writing a pwntools exploit template and validating it against a local process, then hardening it for remote execution - confirming the libc version via leak and libc-database lookup rather than assumption, fixing stack-alignment crashes with an extra ret gadget, and re-running until success reliability is at least 95%. Two worked scenarios are documented in the source: a 64-bit stack-overflow exploit against an NX+PIE+canary binary with a supplied libc, and a Linux kernel ioctl heap-overflow exploit against SMEP/SMAP/KASLR/KPTI protections that reaches root via prepare_kernel_cred/commit_creds or by overwriting modprobe_path. Deeper technique references live in companion files: stack-pwn.md, heap-pwn.md, and kernel-pwn.md.

The skill ships a bootstrap script that installs the core toolchain automatically:

for t in pwntools ropgadget ropper; do
  pip show $t >/dev/null 2>&1 || pip install $t
done

command -v one_gadget >/dev/null || gem install one_gadget

[ -d ~/tools/libc-database ] || git clone https://github.com/niklasb/libc-database ~/tools/libc-database
[ -d ~/tools/libc-database/db ] || (cd ~/tools/libc-database && ./get ubuntu debian)

[ -d ~/tools/pwndbg ] || (git clone https://github.com/pwndbg/pwndbg ~/tools/pwndbg && cd ~/tools/pwndbg && ./setup.sh)

falling back to a manual-install prompt (pip/gem mirrors, apt sources) after the same tool fails to install twice.

A mandatory confirmation gate governs any command that probes, exploits, changes, persists on, or extracts data from a target: the skill must get the exact target identified, confirmation of written authorization and scope, and an explicit walkthrough of the command's expected effect before running anything beyond read-only, defensive guidance.

Use it once a binary vulnerability is already understood and needs a reliable exploit - porting a CTF exploit that works locally but fails against the remote target, building an RCE from an identified memory-corruption bug in an authorized red-team or bug-bounty engagement, or escalating a Linux kernel driver's ioctl bug to root. It is explicitly not for finding vulnerabilities in the first place (that is fuzzing or auditing) or for understanding what an unfamiliar binary does (that is reverse-engineering, IDA, or radare2 territory, feeding into this skill afterward) - and it hands off downstream to a separate attack-chain skill once a shell is obtained. Above all, it is gated to authorized use only: without explicit written permission from the system owner, a stated target, and confirmed scope in the current conversation, the skill stays read-only and defensive, preferably working in a sandbox or disposable VM.

Input is a target binary (and, for kernel work, vmlinux/bzImage/initramfs and a vulnerable kernel module) with an already-identified vulnerability point, plus - for remote targets - a supplied or leaked libc. Output is a validated pwntools exploit script confirmed locally and then run at least 20 times against the remote target to verify a success rate of 95% or higher, along with the libc offsets, ROP gadget chain, and stabilization fixes (stack alignment, buffered-read timing) needed to reproduce it.

Built around pwntools as the exploit-writing framework, with GEF or pwndbg as the gdb debugging front end, ROPgadget or Ropper for gadget search, one_gadget for libc magic-gadget lookup, libc-database for version fingerprinting, qemu-system-x86_64 for kernel-challenge debugging, and binwalk/cpio/patchelf for initramfs extraction and libc swapping. Companion skills reverse-engineering, ida-reverse, and radare2 feed into it upstream; attack-chain consumes its output downstream. Adapted from the MIT-licensed zhaoxuya520/reverse-skill.

CTF players stabilizing an exploit that works locally but not against the remote server, and authorized red-team or bug-bounty researchers turning a confirmed memory-corruption finding into a working proof-of-concept - always under explicit written authorization and scope confirmation.