framework

Browser Exploit Orchestration Framework

Python-based exploit orchestration framework providing a structured, repeatable pipeline for browser exploitation research: reconnaissance through exploitation, implant staging, and payload delivery, with validation gates at every transition. Enforces strict separation between exploit, implant, and payload so each tier is independently replaceable when detected or burned.

Containment: Requires EXPLOIT_LAB_ACTIVE=1. All network operations target loopback lab services only. ContainmentGuard is enforced at each pipeline stage.

Architecture

                    +------------------+
                    |    Framework     |  <-- Python orchestrator
                    |   CLI / Console  |
                    +--------+---------+
                             |
              +--------------+--------------+
              |              |              |
        +-----v----+  +-----v----+  +------v-----+
        |  Module   |  |  Chain   |  |  Session   |
        |  Loader   |  |  Builder |  |  Manager   |
        +-----+----+  +-----+----+  +------+-----+
              |              |              |
              v              v              v
        YAML configs   Stage ordering   Implant I/O

Module Types

Recon (recon/)

Non-destructive probes that fingerprint the target browser without triggering exploitation.

• browser_touch -- Fingerprint browser engine, version, architecture, OS
• jit_probe -- Detect JIT compiler state and tier-up thresholds

Exploits (exploit/)

Vulnerability triggers that establish a primitive (arbitrary read/write, type confusion, etc.). Each exploit targets a specific CVE and version range.

• cve-2026-4698 -- Firefox FoldTests JIT miscompilation
• cve-2024-9680 -- Firefox Animation timeline UAF
• cve-2026-4689-sandbox-escape -- Firefox sandbox escape (chains from JIT)

Implants (implant/)

Post-exploitation stagers that establish a communication channel.

• browser-stager -- In-process JavaScript stager with C2 callback

Payloads (payload/)

Mission-specific modules delivered through an established implant session.

• survey -- Collect browser/system information
• exfil -- Data exfiltration via side channels

Chaining

Modules declare what they require and what they provide. The chain builder uses these declarations to automatically select and order a full pipeline from recon through payload delivery.

# Example: CVE-2026-4698 provides arb_rw_primitive,
#          sandbox escape requires arb_rw_primitive
chain:
  requires: [recon/browser_touch]
  provides: [arb_rw_primitive]
  chains_to: [exploit/cve-2026-4689-sandbox-escape]

Fallback chains are supported: if the primary exploit fails validation (wrong version, debug build detected, etc.), the builder can substitute an alternative exploit that provides the same primitive.

Go/No-Go Gates

Every stage transition passes through a validation gate. If any check fails, the chain halts and reports the failure. Pre-checks run before a module executes. Post-checks run after. Both must pass for the chain to advance.

[recon] --check--> [validate] --check--> [exploit] --check--> [implant] --check--> [payload]
   |                   |                    |                     |                    |
   v                   v                    v                     v                    v
 PASS/FAIL          PASS/FAIL           PASS/FAIL             PASS/FAIL            PASS/FAIL

Usage

# List all modules
python framework.py list

# Show module details
python framework.py info exploit/cve-2026-4698

# Probe a target (non-destructive)
python framework.py touch --target http://target:8080

# Build recommended chain for a target
python framework.py chain --target http://target:8080

# Execute chain (dry run)
python framework.py run chain-firefox-full --dry-run

# Execute chain (simulated)
python framework.py run chain-firefox-full --target http://target:8080

# Execute chain with live exploit delivery
python framework.py --exploit-server http://127.0.0.1:9090 run chain-firefox-full --target http://target:8080

# List active sessions
python framework.py sessions

# Interact with a session
python framework.py interact 0

Exploit Server

The exploit server (exploit_server.py) serves actual CVE HTML/JS files from the cves/ directory and provides a callback endpoint for post-exploitation confirmation. It integrates with the C2 server for automatic session registration on exploit success.

# Start the exploit server (loopback only)
python exploit_server.py --port 9090 --c2 http://127.0.0.1:8443

# Browse available CVEs
curl http://127.0.0.1:9090/

# Serve a specific exploit
# Target browser loads: http://127.0.0.1:9090/cve/chrome/2026/CVE-2026-2441/exploit.html

When --exploit-server is passed to the framework, touch queries the exploit server for validator callbacks, and exploit stages serve real CVE files and wait for callbacks instead of simulating execution.

Directory Layout

tools/framework/
  framework.py           # Main orchestrator CLI
  exploit_server.py      # HTTP server for CVE exploit delivery (loopback only)
  lib/
    module_loader.py      # YAML config parser and validator
    chain_builder.py      # Automatic chain selection and ordering
  configs/
    cve-*.yaml            # Individual module configs
    chain-*.yaml          # Pre-built chain definitions

References

Architecture modeled on the Equation Group's FuzzBunch exploit framework (disclosed April 2017), adapted from network service exploitation to browser exploitation.

• Kaspersky GReAT, "Equation Group: Questions and Answers" (2015)
• Countercept, DoublePulsar analysis (2017)
• MITRE ATT&CK: Exploitation for Client Execution (T1203)