A collection of exploit development templates and WinDbg automation scripts for binary exploitation workflows.
Starter templates for building exploits.
Minimal Python exploit skeleton with argparse. Accepts a target host and optional proxy argument.
python base_exploit.py <host> [--proxy http://localhost:8080]
python \\127.0.0.1\share\base_exploit.py http://target:8000
Minimal Java exploit skeleton that accepts command-line arguments.
javac BaseExploit.java && java BaseExploit <arg>
javac \\127.0.0.1\share\BaseExploit.java && java BaseExploit target
Configurable buffer overflow payload builder. Supports setting offset, padding, EIP, and shellcode values via flags. Can write payloads to a file or send them over a TCP socket. Includes a -bad flag to generate a full bad character test payload.
python base_poc.py -offset 2306 -pad1 0 -eip 4 -pad2 8 -shell 16 -file exploit.txt
python base_poc.py -offset 2306 -bad -file badchars.txt
python \\127.0.0.1\share\base_poc.py -offset 2306 -eip 4 -file exploit.txt
A completed PoC example demonstrating a working exploit with hardcoded shellcode, NOP sled, and socket-based delivery. Use as a reference for what a finished exploit looks like.
python \\127.0.0.1\share\base_poc1.py
Simple TCP fuzzer that sends incrementally larger buffers to a target. Edit host, port, and increments in the script before running.
python remote_fuzz.py
python \\127.0.0.1\share\remote_fuzz.py
Remote buffer overflow PoC template with inline comments for the typical exploit dev workflow: calculate offset with msf-pattern_create/msf-pattern_offset, find bad characters, generate shellcode with msfvenom. Includes a bad character generation loop.
python \\127.0.0.1\share\remote_poc.py
PyKD-based scripts for use inside WinDbg. All require the PyKD extension.
.load pykd.pyd
!py C:\path\to\<script>.py <args>
Identifies bad characters by comparing memory contents against an expected byte sequence. Two modes:
- Address mode (
-a): Reads memory at a given address and highlights bytes that don't match the expected sequence. - Generate mode (
-g): Outputs a byte string (as Python source) excluding known bad characters.
!py find_bad_chars.py -a <address> -b 00 0a 0d
!py find_bad_chars.py -g -b 00 0a 0d
!py \\127.0.0.1\share\find_bad_chars.py -a 0x0185ff54 -b 00 0a 0d
Scans executable memory pages of a module for code caves — contiguous runs of a fill byte (default 0x00). Reports address, size, and page protection for each cave found.
!py find_codecave.py <module> [min_size] [fill_byte]
!py find_codecave.py notepad 32
!py find_codecave.py kernel32 16 0xCC
!py \\127.0.0.1\share\find_codecave.py notepad 16
Finds usable zeroed regions in a module's .data section by parsing PE headers. Filters results by bad characters in the address. Reports space suitability (shellcode, scratch, lpOldProtect candidate).
!py find_data_space.py <module> [min_size] [badchar1 badchar2 ...]
!py find_data_space.py essfunc 400 0x00 0x0a 0x0d
!py \\127.0.0.1\share\find_data_space.py essfunc 400
Searches a module for stack pivot and execution redirect gadgets (JMP/CALL reg, PUSH reg/RET, XCHG, ADD/SUB ESP, LEAVE/RET, etc.). Output is tiered into direct gadgets (single instruction, try first) and alternative gadgets (multi-step fallback). Filters by bad characters in gadget addresses.
!py find_pivots.py <module> [badchar1 badchar2 ...]
!py find_pivots.py essfunc 0x00 0x0a 0x0d
!py \\127.0.0.1\share\find_pivots.py essfunc 0x00
Searches one or more modules for pop r32; pop r32; ret gadget sequences (used for SEH-based exploits). Reports all register combinations with bad character filtering. Use -s to also show gadgets with bad character addresses.
!py find_ppr.py -m <module1> [module2 ...] -b 00 0a 0d
!py find_ppr.py -m libspp diskpls -b 00 0a 0d -s
!py \\127.0.0.1\share\find_ppr.py -m libspp -b 00 0a 0d
Native WinDbg script equivalent of find_ppr.py. Searches for pop r32; pop r32; ret sequences between two address arguments.
$$>a< find_ppr.wds <start_addr> <end_addr>
$$>a< \\127.0.0.1\share\find_ppr.wds 00400000 00465000
Post-crash stack analysis tool. Displays register state, stack limits, an annotated stack dump (marking ESP, EBP, pattern bytes, NOP sleds), SEH chain, and calculates available buffer space for shellcode.
!py stack_analysis.py [dump_size] [pattern_byte]
!py stack_analysis.py 0x200 0x41
!py \\127.0.0.1\share\stack_analysis.py 0x200
Compares expected shellcode bytes against what is actually in memory at a given address. Identifies mismatches caused by bad characters, wrong offsets, or other corruption. Supports verbose mode for a full hex dump comparison.
!py verify_shellcode.py <address> <shellcode> [verbose]
!py verify_shellcode.py 0x00500000 "\x90\x90\x90\xcc"
!py verify_shellcode.py 0x00500000 "\x90\x90\xcc" verbose
!py \\127.0.0.1\share\verify_shellcode.py 0x00500000 "\x90\x90\xcc"
- Python 3
- PyKD extension for WinDbg (WinDbg scripts only)
This toolkit is licensed under the GNU Affero General Public License
v3.0 or later (AGPL-3.0-or-later). See LICENSE for the
full text.
Because this project is AGPL, anyone who runs a modified version as a network-accessible service must make the corresponding source code of that modified version available to the users of that service.
This is offensive-security tooling intended solely for authorized
penetration testing, CTFs, training labs, security research, and
education on systems you own or have explicit written permission to
test. See NOTICE for the full acceptable-use statement.
Do not use this toolkit — or any output it produces — to access, disrupt, or compromise any system, network, account, or data without the prior, explicit, written authorization of its lawful owner, or to violate any applicable law. Unauthorized computer access is a criminal offense in most jurisdictions. Please do not run this software unless your activity is authorized and lawful; the authors accept no liability for misuse.