PoCSmith

PoCSmith is a specialized AI model fine-tuned for automated generation of proof-of-concept exploits and multi-platform shellcode. It uses a CodeLlama-7B backbone fine-tuned with QLoRA 4-bit quantization on 1,472 exploit samples, translating CVE data and vulnerability descriptions into functional offensive artifacts. It is developed by Regaan, lead researcher at ROT Independent Security Research Lab, released under MIT, distributed on PyPI as pocsmith and on Hugging Face as regaan/pocsmith (a PEFT/LoRA adapter over codellama/CodeLlama-7b-hf).

Overview

PoCSmith turns a vulnerability description or a CVE identifier into exploit code or shellcode. It fetches CVE data from the NVD API, formats the vulnerability context into a structured prompt, runs the fine-tuned model, and formats the output as a usable artifact. The fine-tuning is the core of the project: a base code model that already understands code structure is specialized on CVE-to-exploit pairs and shellcode examples so it produces security artifacts rather than generic code. The whole thing runs locally on consumer hardware; the training itself was done on a 6GB laptop GPU.

Features

• AI-powered generation from a CodeLlama-7B model fine-tuned on 1,472 exploit samples.
• CVE integration: fetch vulnerability data directly from the NVD API by CVE ID.
• Multi-platform shellcode: Linux x86/x64, Windows x86/x64, and ARM.
• Payload types: reverse shell, bind shell, exec, and download-and-exec.
• Generation from free-text vulnerability descriptions with target and detail context.
• Command-line interface built on click.
• Local, offline inference: processing happens on the user’s machine.
• Reported model quality: 78.4% token accuracy with a 30% training-loss reduction.

Architecture Summary

PoCSmith is organized as a CLI over a core engine that routes requests to the model and the generators. The user interface layer is a click-based CLI. The core engine orchestrates the workflow: route the request, build the prompt, invoke the model, handle output. The AI model layer is the fine-tuned CodeLlama-7B loaded as a LoRA adapter through the transformers/peft stack with CUDA acceleration. Input processing is handled by the CVE parser, which extracts vulnerability type, affected software, and severity from NVD data. Generation is split between the PoC generator (exploit code from CVE or description) and the shellcode generator (architecture-specific payloads). Formatters turn model output into the final artifact. The source tree reflects this split: src/parsers, src/generators, src/formatters, src/cli, and src/core, with the model in models/pocsmith-v1.

Technology Stack

• Base model: codellama/CodeLlama-7b-hf (7B).
• Fine-tuning: QLoRA 4-bit (NF4, double quantization, bf16 compute) via peft and bitsandbytes.
• LoRA config: rank 16, alpha 32, target modules q_proj/v_proj, dropout 0.05, causal LM; 8,388,608 trainable parameters (0.12% of the model).
• Training stack: transformers, trl (SFTConfig), paged_adamw_8bit optimizer, gradient checkpointing.
• Inference: transformers + peft with CUDA.
• CLI: Python 3.11+, click.
• Shellcode tooling: pwntools (per the architecture doc).
• Data source: NVD API for CVE data.
• Dependencies: torch>=2.0.0, transformers>=4.35.0, peft>=0.7.0, bitsandbytes>=0.41.0, click>=8.1.0.
• Distribution: PyPI (pocsmith 1.0.0), Hugging Face (regaan/pocsmith), MIT license.

Problem Statement

Writing a proof-of-concept exploit from a CVE is slow, repetitive work: read the vulnerability description, identify the class and the affected software, recall the exploitation pattern, and translate it into working code, often alongside architecture-specific shellcode. General-purpose code models produce generic code and rarely handle the security-specific idioms (syscall sequences, null-byte avoidance, payload structure) that offensive artifacts require. PoCSmith addresses this by specializing a capable code model on exactly this task, so a CVE or a description maps to a security artifact rather than to boilerplate.

Why This Project Exists

PoCSmith exists to accelerate the PoC and shellcode drafting stage of security research and red-team work, as a research assistant rather than a push-button attack tool. The design bet is that a 7B code model, cheaply specialized with QLoRA, can produce useful first-draft offensive artifacts on consumer hardware without a data-center training budget. The project’s documentation and CLI are explicit that outputs are drafts to review and test, and that the tool is for authorized, defensive research use.

Sub-Articles (this knowledge base)

• Case Study: Fine-Tuning CodeLlama-7B for Exploit Generation on a 6GB GPU (§2)
• Engineering Notes: Research Notes 1-10 (§3)
• Technical Article: The QLoRA Fine-Tuning Setup (§4.1)
• Technical Article: Dataset Design, CVE-Exploit Pairs and Shellcode (§4.2)
• Technical Article: The Generation Pipeline, CVE to Artifact (§4.3)
• Technical Article: Multi-Platform Shellcode Generation (§4.4)
• Technical Article: Training on Constrained Hardware (§4.5)
• FAQ for researchers and engineers (§5)
• Diagrams (§8)

Related Projects

• ProtoCrash — coverage-guided fuzzer by the same lab; pairs with PoCSmith in a discover-then-weaponize workflow (fuzz to find a crash, draft a PoC).
• Rothalyx RE Framework — native reverse engineering framework by the same author; analyze the target binary, then draft an exploit.
• Basilisk — AI red-teaming framework from the same lab; the sibling AI-security project.