Arbitrary write to RCE playbook. Use when you have an arbitrary write primitive (from heap exploitation, format string, or OOB write) and need to convert it into code execution by targeting GOT, hooks, _IO_FILE vtable, exit_funcs, TLS_dtor_list, modprobe_path, .fini_array, or C++ vtables.

SKILL: Arbitrary Write to Code Execution — Expert Attack Playbook AI LOAD INSTRUCTION : Expert techniques for converting an arbitrary write primitive into code execution. Covers every major overwrite target organized by glibc version compatibility: GOT, malloc hook, free hook, IO FILE vtable, exit funcs, TLS dtor list, dl fini, modprobe path, .fini array, C++ vtable, and setcontext gadget. This is the "last mile" skill. Base models often target hooks that no longer exist (post glibc 2.34) or miss pointer mangling requirements. 0. RELATED ROUTING [heap exploitation](../heap exploitation/SKILL.md) — obtaining the arbitrary write via heap attacks [format string exploitation](../format string exploitation/SKILL.md) — obtaining the arbitrary write via %n [stack overflow and rop](../stack overflow and rop/SKILL.md) — stack based write primitives [binary protection bypass](../binary protection bypass/SKILL.md) — which targets are available given protection configuration [heap exploitation IO FILE EXPLOITATION.md](../heap exploitation/IO FILE EXPLOITATION.md) — deep IO FILE structure exploitation 1. TARGET SELECTION BY GLIBC VERSION Target glibc < 2.24 2.24–2.33 ≥ 2.34 Required Knowledge GOT overwrite OK (Partial RELRO) OK (Partial RELRO) OK (Partial RELRO) Binary base malloc hook OK OK Removed libc base free hook OK OK Removed libc base realloc hook OK OK Removed libc base IO FILE vtable (direct) OK Vtable range check Vtable range check libc base + heap IO FILE via IO str jumps N/A OK (2.24–2.27) Patched libc base + heap IO FILE via IO wfile jumps N/A OK (≥ 2.28) OK libc base + heap exit funcs OK OK OK libc base + pointer guard TLS dtor list N/A N/A OK TLS addr + pointer guard dl fini / link map OK OK OK ld.so base modprobe path (kernel) OK OK OK Kernel base .fini array OK OK OK Binary base (if writable) C++ vtable OK OK OK Object address + heap setcontext gadget OK OK (changed in 2.29) OK libc base Stack return address Always Always Always Stack address 2. GOT OVERWRITE Replace a function pointer in the Global Offset Table. Requirements Partial RELRO ( .got.plt writable) — Full RELRO blocks this entirely Common Targets Overwrite From Overwrite To Trigger printf@GOT system Next printf(user input) with input = /bin/sh free@GOT system Next free(ptr) where ptr points to "/bin/sh" strlen@GOT system Next strlen(user input) atoi@GOT system Next atoi(user input) with input = "sh" puts@GOT system Next puts(user input) exit@GOT main or gadget Create loop for multi shot exploit stack chk fail@GOT ret gadget Neutralize canary check 3. malloc hook / free hook (glibc < 2.34) malloc hook free hook Realloc Trick for one gadget Constraints 4. IO FILE VTABLE See [IO FILE EXPLOITATION.md](../heap exploitation/IO FILE EXPLOITATION.md) for full details. Quick Summary by Version glibc Method Vtable Target < 2.24 Direct vtable overwrite Point vtable to fake table with system at overflow offset 2.24–2.27 IO str jumps Within valid range; IO str finish calls s. free buffer ≥ 2.28 IO wfile jumps Wide char path: wide data wide vtable not range checked ≥ 2.35 House of Cat IO wfile seekoff → IO switch to wget mode → fake wide vtable call FSOP Trigger 5. exit funcs / atexit Exploitation Without Pointer Guard Knowledge If you can overwrite both the function pointer AND the pointer guard (in TLS at fs:[0x30] ): 1. Set pointer guard to 0 2. Set function pointer to ROL(target, 0x11) 3. Demangling: ROR(stored, 0x11) ^ 0 = ROR(ROL(target, 0x11), 0x11) = target 6. TLS dtor list (glibc ≥ 2.34) Thread local destructor list — the primary post 2.34 target. Location Exploitation 7. dl fini / LINK MAP CORRUPTION Attack Vector During exit() , dl fini iterates the link map list and calls DT FINI ARRAY entries. Exploitation 1. Corrupt a link map entry's l addr (relocation base) to shift the FINI ARRAY pointer 2. Or corrupt l info[DT FINI ARRAY] to point to fake array 3. Fake array contains target function pointer (system, one gadget) 4. Trigger: exit() → dl fini → calls fake destructor Advantage : No pointer mangling (function pointers in FINI ARRAY are not mangled). 8. modprobe path (KERNEL) Overwrite the kernel's modprobe path to execute arbitrary commands as root. See [kernel exploitation](../kernel exploitation/SKILL.md) for kernel write primitives. 9. .fini array Overwrite destructor function pointers called during normal program exit. Limitation : .fini array may be read only in Full RELRO binaries. 10. C++ VTABLE OVERWRITE 11. setcontext GADGET setcontext in libc loads registers from a ucontext t structure — useful as a pivot gadget. glibc < 2.29 glibc ≥ 2.29 12. DECISION TREE

arbitrary-write-to-rce