Agent skill · security · yaklang
arbitrary-write-to-rce
Arbitrary write to RCE playbook. Use when you have an arbitrary write primitive (from heap exploitation, format string, or OOB write) and need to convert it into code execution by targeting GOT, hooks, _IO_FILE vtable, exit_funcs, TLS_dtor_list, modprobe_path, .fini_array, or C++ vtables.
Why this skill is useful
Adds detailed expert techniques and executable scripts for converting arbitrary write primitives into code execution, covering various glibc versions and targets.
What it needs
About 8k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: Arbitrary Write to Code Execution — Expert Attack Playbook AI LOAD INSTRUCTION: Expert techniques for converting an arbitrary write primitive into code execution. Covers every major overwrite target organized by glibc version compatibility: GOT, mallochook, freehook, IOFILE vtable, exitfuncs, TLSdtorlist, dlfini, modprobepath, .finiarray, C++ vtable, and setcontext gadget. This is the "last mile" skill. Base models often target hooks that no longer exist (post-glibc 2.34) or miss pointer mangling requirements. 0. RELATED ROUTING heap-exploitation — obtaining the arbitrary write via heap attacks format-string-exploitation — obtaining the arbitrary write via %n stack-overflow-and-rop — stack-based write primitives binary-protection-bypass — which targets are available given protection configuration heap-exploitation IOFILEEXPLOITATION.md — deep IOFILE structure exploitation --- 1. TARGET SELECTION BY GLIBC VERSION Target glibc < 2.24 2.24–2.33 ≥ 2.34 Required Knowledge --- --- --- --- --- GOT overwrite OK (Partial RELRO) OK (Partial RELRO) OK (Partial RELRO) Binary base mallochook OK OK Removed libc base freehook OK OK Removed libc base reallochook OK OK Removed libc base IOFILE vtable (direct) OK Vtable range check Vtable range check libc base + heap IOFILE via IOstrjumps N/A OK (2.24–2.27) Patched libc base + heap IOFILE via IOwfilejumps N/A OK (≥ 2.28) OK libc base + heap exitfuncs OK OK OK libc base + pointer guard TLSdtorlist N/A N/A OK TLS addr + pointer guard dlfini / linkmap OK OK OK ld.so base modprobepath (kernel) OK OK OK Kernel base .finiarray OK OK OK Binary base (if writable) C++ vtable OK OK OK Object address + heap setcontext gadget OK OK (changed in 2.29) OK libc base Stack return address Always Always Always Stack address --- 2. GOT OVERWRITE Replace a function pointer in the Global Offset Table. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/arbitrary-write-to-rce