# Exploiting Arbitrary Write To Execution

Methodology for converting an arbitrary-write (write-what-where) or...

- Repository: https://github.com/xalgorix/xalgorix (1285 stars)
- Category: Writing
- License: Apache-2.0
- Last updated: 2026-10-30
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add xalgorix/xalgorix --skill exploiting-arbitrary-write-to-execution -g -a claude-code -y`
Codex: `npx skills add xalgorix/xalgorix --skill exploiting-arbitrary-write-to-execution -g -a codex -y`
Cursor: `npx skills add xalgorix/xalgorix --skill exploiting-arbitrary-write-to-execution -g -a cursor -y`
Gemini CLI: `npx skills add xalgorix/xalgorix --skill exploiting-arbitrary-write-to-execution -g -a gemini-cli -y`

## Description

Methodology for converting an arbitrary-write (write-what-where) or write-anything-anywhere primitive into code execution during authorized engagements, covering target selection among GOT/PLT entries, .fini_array/.dtors, __malloc_hook/__free_hook, the atexit/__exit_funcs handler list, and __printf_arginfo_table, plus how mitigations (Full RELRO, pointer mangling) change which target is viable and how to confirm hijacked control flow.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Exploiting Arbitrary Write to Execution

## When to Use

- During authorized binary exploitation when a bug yields a **write-what-where** primitive: format-string `%n`, an OOB
  array write, a heap metadata corruption (e.g., tcache/fastbin poisoning to return an arbitrary chunk), or a UAF that
  lets you write a controlled value to a controlled address.
- When you control *where* and *what* you write but do **not** yet have direct control of `RIP`/`EIP`, and you need a
  code pointer to overwrite that the program will later call.
- When deciding between targets based on mitigations: Partial vs Full RELRO, presence of `__malloc_hook`/`__free_hook`
  (removed in glibc >= 2.34), and pointer mangling on `atexit` handlers.
- As the bridge step that turns "I can write 8 bytes somewhere" into "the program jumps to my gadget/one_gadget".

## Critical: Concepts/Steps Most Often Missed

The rest: https://github.com/xalgorix/xalgorix/blob/HEAD/internal/tools/skills/data/binary-exploitation/exploiting-arbitrary-write-to-execution/SKILL.md