j4flmao/agent-skills/exploit-development-concepts

Exploit Development Concepts

Purpose

Explain low-level memory-corruption theory (stack overflow, ROP, ASLR/DEP) at a conceptual level to teach defensive programming and compiler/linker mitigations. Reference material for defenders; it does not produce actionable exploit code.

Agent Protocol

Trigger

User phrases: "buffer overflow mechanics", "rop chain theory", "bypass ASLR concept", "format string vulnerability", "stack canary".

Input Context

• Architecture (x86/x64/ARM) and OS.
• Which mitigation the user is learning or hardening.

Output Artifact

Conceptual explanation plus the compiler/OS mitigation that defeats the class.

Response Format

Concept: {corruption class}
Mechanism: {registers/stack involved}
Mitigation: {-fstack-protector, PIE, RELRO, NX, ASLR}

[!WARNING]

DISCLAIMER: EDUCATIONAL & DEFENSIVE PURPOSES ONLY

This skill covers memory corruption theory to teach defensive programming and compiler-level mitigations. It does not generate actionable exploit scripts.

1. Skill Context

Focus: Memory corruption theory, x86/x64 architecture, and modern binary mitigations. Triggers: buffer overflow mechanics, rop chain theory, bypass aslr, format string vulnerability

2. Low-Level Memory Mechanics

The agent must possess deep knowledge of assembly, CPU registers, and OS memory management.

Stack-Based Buffer Overflow

• Mechanics: Writing more data to a stack-allocated buffer than it can hold, overwriting adjacent memory.
• Execution: The attacker overwrites the Instruction Pointer (EIP/RIP) or the saved Return Address on the stack to point to their injected shellcode.
• Mitigation: Stack Canaries (Cookies) which place a random value before the return address; the program crashes if the canary is modified.

Return Oriented Programming (ROP)

• Why it exists: Introduced to bypass Data Execution Prevention (DEP / NX bit), which marks the stack and heap as non-executable.
• Mechanics: Instead of executing injected shellcode, the attacker hijacks the return address to execute existing snippets of executable code ending in a ret instruction ("gadgets") already present in the binary or loaded libraries (like libc).
• Goal: Chain gadgets together to call functions like system("/bin/sh") or VirtualProtect() to make the stack executable.

ASLR (Address Space Layout Randomization)

• Mechanics: Randomizes the base addresses of the executable, heap, stack, and libraries upon every execution.
• Bypass Theory: Attackers use memory leaks (e.g., Format String vulnerabilities reading off the stack) to find a single pointer, calculate the randomization offset, and dynamically adjust their ROP chain addresses.

3. Output Format

• Diagram the memory layout (Stack/Heap structures) using ASCII art or Markdown tables.
• Explain the assembly instructions involved (call, ret, push, pop).
• Detail compiler-level mitigations (-fstack-protector, PIE, RELRO).