Python is a useful tool for exploit development because it can be used to discover, explore, and exploit a wide range of vulnerabilities.  Python scripts are quick and easy to write, making it possible to iterate quickly when designing and testing exploit code.

Identifying exploitable vulnerabilities

The first step in exploiting vulnerabilities using Python is identifying a vulnerability to exploit.  A number of resources exist for learning about vulnerabilities including:

OWASP: The Open Web Application Security Project (OWASP) provides a number of resources for educating about web application vulnerabilities.  While most famous for their Top Ten List of web application vulnerabilities, they also have lists for other types of vulnerabilities (web APIs, etc.) and other resources for learning about vulnerability exploitation and remediation. CWE: The Common Weaknesses Enumeration (CWE) is a resource designed to categorize and educate about the different types of vulnerabilities that appear within software.  Each CWE has detailed information and examples of the vulnerability, and a variety of different views are available to look at the most impactful vulnerabilities, language-specific vulnerabilities, etc. CVE: The Common Vulnerabilities and Exposures (CVE) project details each publicly-revealed vulnerability in software.  It provides information about the vulnerable application, how the vulnerability works, and links to relevant CWEs.

Some of these resources are designed for general vulnerability awareness, while others can be used actively as part of exploit development.  While performing reconnaissance on a target, banner grabbing and other techniques can be used to determine the version information of an application. This information can then be compared to the CVE listing to determine if any known vulnerabilities exist for that particular application.  If so, the CVE entry (and linked CWE pages) may provide useful information or sample code for exploiting the vulnerability.

Buffer overflows: An easily exploited vulnerability

After identifying a potential vulnerability, the next step is to determine its exploitability.  Different vulnerabilities may be easier or harder to exploit, especially using Python. A buffer overflow vulnerability is an example of a vulnerability that can be easily exploited using Python.  This error in memory allocation and management can be exploited by forcing the application to attempt to store more data in an allocated buffer than actually fits, typically through providing a very large user input. Python code can be applied to exploitation of a buffer overflow vulnerability in a couple of different ways.  One advantage of Python for buffer overflow exploitation is its support for string multiplication.  The Python code A*100, creates a string of one hundred A characters, which can overflow a buffer of length 99 or less. Python is also useful for exploiting buffer overflow vulnerabilities over the network.  The scapy library supports the creation of custom packets, and libraries for the HTTP, DNS, SMB, and other protocols allow crafting of requests designed specifically to exploit buffer overflows and other vulnerabilities.

Conclusion

Software vulnerabilities are common, and understanding the most common types of vulnerabilities is invaluable for exploit development.  With this understanding, penetration testers can leverage the capabilities of Python to rapidly and automatically identify and exploit vulnerabilities as part of their engagements.

Sources

OWASP Foundation, https://owasp.org/ CVE, https://cve.mitre.org/ Common Weakness Enumeration, https://cwe.mitre.org/ Buffer Overflow OWASP, https://owasp.org/www-community/vulnerabilities/Buffer_Overflow CWE 119, https://cwe.mitre.org/data/definitions/119.html How to Use Python to Multiply Strings, https://www.pythoncentral.io/use-python-multiply-strings/