Skip to content
Get packs

Pwn Exploit Chain

Turns a known binary vulnerability into a working, remotely stable exploit (stack, heap, kernel).

Source Download skill
Repository
zhaoxuya520/reverse-skill
Stars
43,969
Licence
MIT
Files
4 files

What it does

This is a playbook that teaches an AI agent how to go from a program with a known memory-corruption bug to a working exploit that gives shell access. It walks through checking protections (NX, canary, PIE, ASLR), choosing a strategy (ret2libc, one_gadget, heap tcache tricks, kernel ROP), and making the exploit reliable against a remote target rather than only a local test. It also lists tools to install (pwntools, GEF/pwndbg, ROPgadget, libc-database, qemu) and reference notes for stack, heap and kernel exploitation.

Great for

  • CTF players who got a local exploit working but it fails remotely
  • Security researchers who already found a memory-corruption bug and need a reliable exploit for an authorised target
  • Students learning binary exploitation with a structured workflow

Skip it if

  • Finding vulnerabilities from scratch: the skill states it assumes the bug is already known, so fuzzing or auditing is out of scope
  • Targets you are not authorised to test: the exploit techniques can attack real systems, and the skill itself frames use as CTF or authorised SRC/red-team work

Try asking

  • “I have a 64-bit ELF with NX and canary and a stack overflow; help me build a pwntools exploit that leaks libc and gets a shell”
  • “My local exploit works but fails on the remote server; help me make it stable against a different libc”
  • “Walk me through a kernel ioctl heap overflow in a qemu challenge and how to reach root via ROP or modprobe_path”
Step-by-step guide: how to use Pwn Exploit ChainInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 4 original files, the MIT licence and an attribution note.

    pwn-chain.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip pwn-chain.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip pwn-chain.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Only point the exploit at targets you own or are explicitly authorised to test, such as CTF servers or agreed scope
  • Confirm the libc version via leak and libc-database lookup rather than assuming a default, and run the remote exploit repeatedly to measure success rate
  • Review the bootstrap commands before letting the agent run them, since the skill installs packages and clones repositories from GitHub

What's inside

  • references/heap-pwn.md
  • references/kernel-pwn.md
  • references/stack-pwn.md
  • SKILL.md

Redistributed unmodified from zhaoxuya520/reverse-skill under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.