
You've got an arbitrary write primitive from a heap bug, format string, or overflow, and now you need to turn it into code execution. This walks you through every major target: GOT entries if you have partial RELRO, malloc/free hooks if you're pre-glibc 2.34, IO_FILE vtable manipulation, exit_funcs with pointer mangling, and TLS_dtor_list for modern glibc. The version matrix is the most useful part here because base models love to suggest __free_hook on glibc 2.35 where it doesn't exist anymore. It covers the pointer guard demangling math and has trigger conditions for each target. This is genuinely the last mile skill, the "I can write anywhere, now what" reference.
$ npx -y skills add yaklang/hack-skills --skill arbitrary-write-to-rce --agent claude-codeInstalls into .claude/skills of the current project.
AI LOAD INSTRUCTION: Expert techniques for converting an arbitrary write primitive into code execution. Covers every major overwrite target organized by glibc version compatibility: GOT, __malloc_hook, __free_hook, _IO_FILE vtable, __exit_funcs, TLS_dtor_list, _dl_fini, modprobe_path, .fini_array, C++ vtable, and setcontext gadget. This is the "last mile" skill. Base models often target hooks that no longer exist (post-glibc 2.34) or miss pointer mangling requirements.
Sponsors