ExploitFarm Python Library and CLI

ExploitFarm is an advanced tool designed to manage exploits and flag submissions in Attack-Defense CTF competitions. It combines a Python library with a command-line interface (CLI), providing flexibility and efficiency for managing CTF tasks. This documentation provides a comprehensive overview of its features, installation, and usage.

Key Features

Multi-Threaded Execution: Utilize a pool of worker threads for efficient exploit execution.
Exploit Management: Initialize, push, pull, and version control exploit source code.
Attack Groups: Collaborate and manage group-based attacks.
Integrated Status Monitoring: View real-time server and current execution statuses.

Installation

Install ExploitFarm via pip:

pip3 install -U xfarm && xfarm --install-completion

For Windows, use:

python -m xfarm

Prerequisites:

Python 3.8+
Compatible with Linux, macOS, and Windows.
Ensure you have pip installed.

Getting Started

ExploitFarm provides both programmatic and CLI access to its features.

Programmatic API

The Python library allows developers to integrate ExploitFarm functionality into their scripts:

import random
from exploitfarm import *

host = get_host()  # Retrieves the server host (from environment variables or configuration)
print(f"Connected to {host}")

flags = [random_str(32) + "=" for _ in range(10)]
print(f"Submitting flags: {flags}")
submit_flags(flags)

Store Class

The Store class provides a key-value storage system for exploits, allowing you to save and retrieve centralized data during execution. The key value store is by default isolated per exploit id. If you need data shared between exploits you should use a custom context_id that allows to access the same data from different exploits. The context_id can be set also in the constructor of the Store class, and will be used as default context_id for all the calls with that store instance.

from exploitfarm import Store

# Initialize with an optional default context
store = Store(default_context_id="my_global_context_id")

# Set a value (context_id can be overridden per call)
store.set("example_key", {"example": "data"})
store.set("other_key", "value", context_id="explicit_ctx")

# Get a value (if not exists returns None)
data = store.get("example_key")
print(data)

# Delete a key
store.delete("example_key")

# List all keys in the current context
keys = store.keys()
print(keys)

# List all available contexts
contexts = store.contexts()
print(contexts)

# Delete an entire context
store.delete_context(context_id="explicit_ctx")

Methods:

get(key: str, default=None, context_id: str | None = None, timeout: int = HTTP_TIMEOUT) -> any: Retrieve and deserialize a value by key.
get_bytes(key: str, default=None, context_id: str | None = None, timeout: int = HTTP_TIMEOUT) -> bytes: Retrieve a raw byte value.
set(key: str, value: any, context_id: str | None = None, timeout: int = HTTP_TIMEOUT): Serialize and store a value by key.
set_bytes(key: str, value: bytes, context_id: str | None = None, timeout: int = HTTP_TIMEOUT): Store a raw byte value.
delete(key: str, context_id: str | None = None, timeout: int = HTTP_TIMEOUT): Delete a key.
keys(timeout: int = HTTP_TIMEOUT, context_id: str | None = None) -> list[str]: List all stored keys in a context.
contexts(timeout: int = HTTP_TIMEOUT) -> list[str]: List all available contexts.
delete_context(context_id: str | None = None, timeout: int = HTTP_TIMEOUT): Delete an entire context and its keys.

Environment Variables Required:

XFARM_REMOTE_URL: Base URL for the exploit storage API.
XFARM_EXPLOIT_ID: Unique identifier for the exploit.
XFARM_LOGIN_TOKEN: Authentication token for secure access.

Command-Line Interface (CLI)

The CLI is the primary way to interact with ExploitFarm for exploit and attack management.

CLI Syntax

xfarm [COMMAND] [OPTIONS]

Use --help to view available commands and options:

xfarm --help

Detailed CLI Documentation

Global Options

These options are applicable to all commands:

-h, --help: Display help information for a command.
-I, --no-interactive: Disable interactive configuration mode (default: interactive).
-v, --version: Show the version of the ExploitFarm client.

Primary Commands

Start Exploit

Run an exploit from the specified path:

xfarm start [OPTIONS] PATH

Options:

PATH: The directory containing the exploit (default: current directory).
--pool-size, -p: Fixed size for the thread pool (default: 10 * CPU cores).
--submit-pool-timeout: Timeout (in seconds) for the submission pool (default: 3).
--test, -t: Test the exploit without submission.
--test-timeout: Timeout for exploit testing (default: 30 seconds).
--no-auto-push, -n: Prevent automatic source push.
--push-message, -m: Custom message for the source push.

Example:

xfarm start ./my_exploit --pool-size 20 --test

Exploit Execution Environment

To protect your exploit source code and maintain a clean workspace, exploits are never executed directly in their project directory. Instead, xfarm starts the execution by copying your exploit files into a temporary __xfarm_run__ folder and runs the exploit from there. This guarantees:

Clean Execution: Your original directory isn't polluted by runtime artifacts, logs, or temporary files generated by the exploit.
Isolation: Changes made by the exploit script (e.g., dropping files, compiling binaries) remain isolated.

A Git-like ignores system is available: You can use a .ignore (only in the root of the exploit folder) to specify files/directories that shouldn't be copied into the __xfarm_run__ directory and when using xfarm push.

Configuration Commands

Edit Configuration

Edit client settings:

xfarm config edit [OPTIONS]

Options:

--address: Server address.
--port: Server port.
--nickname: Client nickname.
--https: Use HTTPS (default: False).

Example (no interactive mode):

xfarm -I config edit --address example.com --port 443 --https --nickname

Reset Configuration

Reset all client settings to their default values:

xfarm config reset

Authenticate with the server:

xfarm config login [OPTIONS]

Options:

--password: Provide the password directly.
--stdin: Read the password from stdin.

Logout

Logout from the server:

xfarm config logout

Exploit Management Commands

Initialize Exploit

Set up a new exploit project:

xfarm init [OPTIONS]

Options:

--name: Exploit name.
--service: Associated service UUID.
--language: Programming language.

Push Exploit

Upload the exploit source code to the server:

xfarm push [OPTIONS]

Options:

--message, -m: Commit message.
--force, -f: Force push even with an old commit has the same source.

Retrieve Exploit Information

Get details about the exploit source:

xfarm log [OPTIONS]

Options:

--raw, -r: Display raw JSON response.

Update Exploit

Update to the latest commit:

xfarm pull [OPTIONS]

Options:

--force, -f: Force update.

Download Exploit

Download the exploit source:

xfarm clone [OPTIONS] [exploit_id] [commit_uuid]

Arguments:

exploit_id: The exploit ID to download.
commit_uuid: The commit UUID to take the source from (default: latest).

Options:

--folder, -f: Specify target folder.

Edit Exploit Configuration

Edit the exploit configuration (e.g. language, service):

xfarm edit [OPTIONS]

Options:

--name: The name of the exploit.
--service: The service UUID of the exploit.
--language: The programming language of the exploit.

Checkout Exploit Commit

Download the specified exploit commit and switch to it:

xfarm checkout [OPTIONS] {commit_uuid}

Options:

--force, -f: Force the move even if the current commit is not pushed.

Flush Flag Queue

Flush the local flag queue to the backend (used if manual submissions were queued locally due to network failure):

xfarm flush [OPTIONS] [path]

Options:

path: Optional path to a specific directory or .flag_queue.json file.

Attack Group Commands

Create Attack Group

Create a new group for collaborative attacks (and also join in it if in interactive mode):

xfarm group create [OPTIONS]

Options:

--name: Group name.
--submit-pool-timeout: The timeout for the submit pool to wait for new attack results and send flags (default: 3).

Join Attack Group

Join an existing attack group:

xfarm group join [OPTIONS]

Options:

--group: Group ID.
--queue: Queue number for the group.
--submit-pool-timeout: Timeout for submission pooling.
--demonized or -d: Join the group in a demonized process.
--kill: Kill a running worker of the indicated group.
--log-file: Path to the log file

List Attack Group

List all available attack groups:

xfarm group list

Shows a table with all existing groups, their IDs, and if there is a worker running for that group.

Template Commands

Manage exploit templates for quickly starting new exploits:

List Templates

xfarm template list

Add Template

Add a new template from an existing folder:

xfarm template add [path]

Edit Template

Edit an existing template interactively:

xfarm template edit

Submitter Commands

Test Submitter

Test your submitter python script against the backend's flag extraction:

xfarm submitter-test [OPTIONS] {path} {output}

Arguments:

path: Submitter python script.
output: Text containing flags according to server REGEX.

Options:

--kwargs: Submitter key-words args (json) (default: {}).

Environment Variables

Environment variables can simplify configuration:

XFARM_HOST: Server address.
XFARM_PORT: Server port.
XFARM_INTERACTIVE: Enable or disable interactive mode.
XFARM_REMOTE_URL: API Base URL for remote exploit storage.
XFARM_EXPLOIT_ID: Unique identifier for the exploit.
XFARM_LOGIN_TOKEN: Authentication token for secure access.

Best Practices

Use --test to verify exploits before running them in production.
Regularly push changes to the server for version control (they are auto-pushed on attack start anyway).
Collaborate using attack groups for efficient resource utilization if the attack is heavy to execute.

Metadata

Release files for exploitfarm 2.2.3

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for exploitfarm 2.2.3
File	Size	Uploaded
exploitfarm-2.2.3.tar.gz	86.5 kB	Sep 29, 2026	Details

Built distribution (wheel)

Table of built distributions (wheels) for exploitfarm 2.2.3
File	Interpreter	ABI	Platform	Reset
exploitfarm-2.2.3-py3-none-any.whl 99.8 kB Sep 29, 2026	Python 3	none	any	Details

Total release size: 186.3 kB

Release files / exploitfarm-2.2.3.tar.gz

Download URL	exploitfarm-2.2.3.tar.gz
Size	86.5 kB
Tags	Source
SHA-256 checksum How to use checksums	`5dd3c93fbae9e02eb9af1006051042b68b55cd34d6857775127d5fef7364c061`
BLAKE2b-256 checksum How to use checksums	`d83817c38d1a9ecbc18775a25017572e1451099881fd318b72f81249108c6354`
Upload date	Sep 29, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`twine/6.2.0 CPython/3.9.25`

Release files / exploitfarm-2.2.3-py3-none-any.whl

Download URL	exploitfarm-2.2.3-py3-none-any.whl
Size	99.8 kB
Tags	Python 3
SHA-256 checksum How to use checksums	`cc1f97702fdcb7160287afe38e7cceaaafa798767abdcdc726b9cf1bbe3901e3`
BLAKE2b-256 checksum How to use checksums	`01df2fd160349c7cca0efaa1270d34716f24ae0639791877e779bd75538a5b8f`
Upload date	Sep 29, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`twine/6.2.0 CPython/3.9.25`