Exploiting Arbitrary Write To Execution
Methodology for converting an arbitrary-write (write-what-where) or...
Install
npx skills add xalgorix/xalgorix --skill exploiting-arbitrary-write-to-execution -g -a claude-code -y- Repository
- xalgorix/xalgorix1.3k
- Category
- Writing
- Updated
- 5d ago
- License
- Apache-2.0
- Context cost
- Mediumabout 2,491 tokens
- Runs scripts
- No, instructions only
What it does
Methodology for converting an arbitrary-write (write-what-where) or write-anything-anywhere primitive into code execution during authorized engagements, covering target selection among GOT/PLT entries, .fini_array/.dtors, __malloc_hook/__free_hook, the atexit/__exit_funcs handler list, and __printf_arginfo_table, plus how mitigations (Full RELRO, pointer mangling) change which target is viable and how to confirm hijacked control flow.
Exploiting Arbitrary Write to Execution
When to Use
- During authorized binary exploitation when a bug yields a write-what-where primitive: format-string
%n, an OOB array write, a heap metadata corruption (e.g., tcache/fastbin poisoning to return an arbitrary chunk), or a UAF that lets you write a controlled value to a controlled address. - When you control where and what you write but do not yet have direct control of
RIP/EIP, and you need a code pointer to overwrite that the program will later call. - When deciding between targets based on mitigations: Partial vs Full RELRO, presence of
__malloc_hook/__free_hook(removed in glibc >= 2.34), and pointer mangling onatexithandlers. - As the bridge step that turns "I can write 8 bytes somewhere" into "the program jumps to my gadget/one_gadget".
