Skip to content

Repository files navigation

Exploit-Dev-Toolkit

A modular exploit development toolkit for penetration testing and CTF challenges. Contains four independent tools for protocol fuzzing, payload generation, ROP construction, and shellcode encoding.

Installation

git clone https://github.com/ridhinva/Exploit-Dev-Toolkit.git
cd Exploit-Dev-Toolkit
chmod +x *.py

No external dependencies required — all tools use Python 3 standard library only.

Tools

1. fuzzer.py — Protocol Fuzzer

TCP protocol fuzzer that generates mutations from a base payload and sends them to a target service. Detects potential crashes via socket timeout.

Usage

python fuzzer.py tcp <host> <port> [--count N]

Paste or type the base payload, then Ctrl+D. The fuzzer applies random mutations and sends them.

python fuzzer.py edge <type>

Generate edge-case payloads without sending. Types: strings, numbers, special, all.

Examples

# Fuzz an HTTP server on port 8080
echo -e "GET / HTTP/1.1\r\nHost: localhost\r\n\r\n" | python fuzzer.py tcp 127.0.0.1 8080 --count 100

# Generate edge-case strings
python fuzzer.py edge strings

# Generate all edge cases
python fuzzer.py edge all

How It Works

The fuzzer reads a base payload and applies one of five random mutation strategies each iteration:

Strategy Description
bitflip Flips random bits in the payload bytes
byte_add Inserts random bytes at a random position
byte_remove Removes random bytes from the payload
block_insert Inserts a large random block of bytes
repeat Repeats the entire payload N times

Each mutated payload is sent over TCP with a 3-second timeout. If the server closes the connection or stops responding, it's flagged as a potential crash. The edge case generator produces boundary values: long strings, null bytes, format specifiers, numeric boundaries (INT_MIN/MAX, infinities, NaN), and control characters.


2. payload_generator.py — Payload Generator

Generates reverse shell one-liners in multiple languages, encodes arbitrary payloads, and creates PHP webshells.

Usage

# Generate reverse shell
python payload_generator.py <ip> <port> [--lang <lang>]

# Encode a payload
python payload_generator.py --encode <payload> [method]

# Generate PHP webshell
python payload_generator.py --webshell [variant]

Examples

# Generate a bash reverse shell for 10.0.0.1:4444
python payload_generator.py 10.0.0.1 4444 --lang bash

# Generate a Python3 reverse shell
python payload_generator.py 10.0.0.1 4444 --lang python3

# PowerShell reverse shell for Windows targets
python payload_generator.py 10.0.0.1 4444 --lang powershell

# Encode a payload in hex
python payload_generator.py --encode "cat /etc/passwd" hex

# Generate an obfuscated PHP webshell
python payload_generator.py --webshell obfuscated

# Hidden variant (hex2bin-based)
python payload_generator.py --webshell hidden

Supported --lang values: bash, python3, php, perl, nc, powershell.

Encoding methods: base64 (default), hex, url.

Webshell variants: basic (plain system()), obfuscated (string concatenation), hidden (hex2bin decode).

How It Works

Reverse shells are pre-defined templates with {ip} and {port} placeholders. The chosen template is formatted, printed as a one-liner, and also encoded in base64, hex, and URL form for flexibility.

Encoding wraps a payload string through base64.b64encode(), .hex(), or urllib.parse.quote().

PHP webshells use progressively more obfuscated approaches: from raw system($_GET["cmd"]) through string-concatenated function names to hex2bin-based function resolution.


3. rop_builder.py — ROP Builder Reference

Documentation-first reference tool for Return-Oriented Programming exploitation techniques.

Usage

python rop_builder.py                     # Print all references
python rop_builder.py --rop               # ROP only
python rop_builder.py --ret2libc          # ret2libc only
python rop_builder.py --srop              # SROP only
python rop_builder.py --check <binary>    # Scan binary for common gadgets

Examples

# Print full ROP reference
python rop_builder.py

# Check a binary for common gadgets (pop rdi; ret, syscall; ret, etc.)
python rop_builder.py --check /bin/ls

How It Works

rop_builder.py is primarily a documentation tool. It prints detailed reference guides covering:

  • ROP (Return-Oriented Programming): Chaining gadgets (instruction sequences ending in ret) to execute arbitrary code without shellcode. Covers common x64 gadgets (pop rdi; ret, syscall; ret), chain construction, and tool recommendations (ROPgadget, ropper, pwntools).

  • ret2libc: Redirecting execution to libc functions (system, execve) while bypassing NX. Covers ASLR bypass strategies, the classic x86 approach vs. modern x64 calling convention, and libc version identification.

  • SROP (Sigreturn-Oriented Programming): Using the sigreturn syscall to set ALL CPU registers from a fake signal frame on the stack — requiring only a single syscall; ret gadget.

The --check flag performs a naive byte-sequence scan for common gadget signatures in any binary file.


4. shellcode_encoder.py — Shellcode Encoder Reference

Documentation-first reference tool for shellcode encoding techniques, with practical generation utilities.

Usage

python shellcode_encoder.py                     # Print all references
python shellcode_encoder.py --xor               # XOR encoding reference
python shellcode_encoder.py --alphanumeric      # Alphanumeric reference
python shellcode_encoder.py --nop               # NOP sled reference
python shellcode_encoder.py --xor-encode <hex>  # XOR-encode shellcode
python shellcode_encoder.py --nop-gen <count>   # Generate NOP sled

Examples

# XOR-encode shellcode with default key (0x55)
python shellcode_encoder.py --xor-encode 4831c0b0024889c7

# XOR-encode with custom key
python shellcode_encoder.py --xor-encode 4831c0b0024889c7 --key 0x42

# Generate a 64-byte mixed NOP sled
python shellcode_encoder.py --nop-gen 64 --variant mixed

# Generate a multi-byte NOP sled
python shellcode_encoder.py --nop-gen 64 --variant multi

How It Works

shellcode_encoder.py is primarily a documentation tool. It prints detailed reference guides covering:

  • XOR Encoding: XOR-ing each shellcode byte with a single key (or multi-byte rolling key) to evade signature detection. Includes a working encoder (--xor-encode) that outputs hex-encoded shellcode with the specified key.

  • Alphanumeric Shellcode: Restricting shellcode to printable ASCII (0x20–0x7E) to bypass input filters. Covers available x86 instructions in the printable range (PUSH/POP variants, arithmetic with printable immediates) and self-modifying code techniques.

  • NOP Sleds: Sequences of no-operation instructions placed before shellcode to increase exploit reliability. Three variants can be generated:

    Variant Description
    basic Standard 0x90 NOP bytes
    mixed Random mix of single-byte NOP-like instructions
    multi Modern multi-byte NOP instructions (2–5 bytes)

License

MIT

About

Toolkit: Modular exploit development — protocol fuzzer, payload generator, ROP builder, shellcode encoder in Python

Topics

Resources

Contributing

Security policy

Stars

0 stars

Watchers

0 watching

Forks

Releases

Packages

Contributors

Languages