Claude Marketplaces
SkillsMCP serversMarketplacesPluginsDigestAdvertise
Submit

LLMond Highlights

This week in Claude is LLMond Highlights now. A weekly email, free.

Skills by category
Frontend DevelopmentBackend & APIsTesting & QASecurityDevOps & CI/CDGit & Pull RequestsDocumentationCode Review & QualityAI & Agent BuildingSkill Development
MCP servers by category
Sales & MarketingWeb & Browser AutomationDatabasesAI & LLM ToolsCloud & InfrastructureCommunication & MessagingDeveloper ToolsDesign & CreativeDocuments & KnowledgeSearch & Web Crawling
Marketplaces by category
AI Agents & OrchestrationLLM IntegrationDevelopment ToolsFrontend & UIBackend & APIsDatabasesTesting & Code QualityDevOps & CloudSecurity & ComplianceGit & Version Control
Claude Marketplaces

An independent directory of skills, plugins and MCP servers for Claude Code. Not affiliated with Anthropic.

Browse

  • Skills
  • MCP servers
  • Marketplaces
  • Plugins
  • Weekly digest
  • Skill index
  • MCP index
  • Marketplace index
  • Plugin index

Site

  • About
  • Submit
  • Advertise
  • Feedback
  • Privacy
  • llms.txt
  • Plugins reference

Maker

  • Snug
  • Agent Caffeine
  • knobs
  • Wax
  • Vectoys
  • mertduzgun.com
by Mert Düzgün
Skills/Frontend Development
yaklang avatar

Arbitrary Write To Rce

yaklang/hack-skills

You've got an arbitrary write primitive from a heap bug, format string, or overflow, and now you need to turn it into code execution. This walks you through every major target: GOT entries if you have partial RELRO, malloc/free hooks if you're pre-glibc 2.34, IO_FILE vtable manipulation, exit_funcs with pointer mangling, and TLS_dtor_list for modern glibc. The version matrix is the most useful part here because base models love to suggest __free_hook on glibc 2.35 where it doesn't exist anymore. It covers the pointer guard demangling math and has trigger conditions for each target. This is genuinely the last mile skill, the "I can write anywhere, now what" reference.

skills.sh installs
3.8K
GitHub stars
2.6K
last updated
Aug 21, 2026
View on GitHubSave

Install

$ npx -y skills add yaklang/hack-skills --skill arbitrary-write-to-rce --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: Arbitrary Write to Code Execution — Expert Attack Playbook

AI LOAD INSTRUCTION: Expert techniques for converting an arbitrary write primitive into code execution. Covers every major overwrite target organized by glibc version compatibility: GOT, __malloc_hook, __free_hook, _IO_FILE vtable, __exit_funcs, TLS_dtor_list, _dl_fini, modprobe_path, .fini_array, C++ vtable, and setcontext gadget. This is the "last mile" skill. Base models often target hooks that no longer exist (post-glibc 2.34) or miss pointer mangling requirements.

0. RELATED ROUTING

  • heap-exploitation — obtaining the arbitrary write via heap attacks
  • format-string-exploitation — obtaining the arbitrary write via %n
  • stack-overflow-and-rop — stack-based write primitives
  • binary-protection-bypass — which targets are available given protection configuration
  • heap-exploitation IO_FILE_EXPLOITATION.md — deep _IO_FILE structure exploitation

1. TARGET SELECTION BY GLIBC VERSION

SKILL.md on GitHub

Sponsors

Promote your product hereReach 125k+ visitors monthlyPromote your product hereReach 125k+ visitors monthlyAgent CaffeineSponsoredClose your lid, come back to finished workSnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthlyWaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthlyknobsSponsoredSee your site on any phone, any day, in any language

Details

Repository
github.com/yaklang/hack-skills
Categories
Frontend Development, Code Review & Quality
First seen
Jun 3, 2026

More from yaklang/hack-skills

All 102
  • Active Directory Certificate Services3.8K
  • Hash Attack Techniques3.8K
  • Prototype Pollution3.8K
  • Dns Rebinding Attacks3.8K
  • Network Protocol Attacks3.8K
  • Ai Ml Security3.8K
  • Memory Forensics Volatility3.8K
  • Dangling Markup Injection3.8K
  • Windows Av Evasion3.8K
  • Defi Attack Patterns3.8K
  • Windows Privilege Escalation3.8K
  • Email Header Injection3.8K
  • Xslt Injection3.8K
  • Type Juggling3.8K
  • Linux Lateral Movement3.8K
  • Container Escape Techniques3.8K
  • Classical Cipher Analysis3.7K
  • Linux Security Bypass3.7K
  • Tunneling And Pivoting3.7K
  • Prototype Pollution Advanced3.7K
  • Steganography Techniques3.7K
  • Smart Contract Vulnerabilities3.7K
  • Stack Overflow And Rop3.7K
  • Rsa Attack Techniques3.7K

Recommended

More Frontend Development
1dpearson2699 avataralarmkitdpearson2699/swift-ios-skillsImplement AlarmKit alarms and countdown timers for iOS and iPadOS with Lock Screen, Dynamic Island, StandBy, and paired Apple Watch system UI. Covers AlarmManag3.8Kskills.sh installs
2yaklang avatardangling-markup-injectionyaklang/hack-skillsDangling markup injection playbook. Use when HTML injection is possible but JavaScript execution is blocked (CSP, sanitizer strips event handlers, WAF blocks sc3.8Kskills.sh installs
3dpearson2699 avatartipkitdpearson2699/swift-ios-skillsImplement and review Apple TipKit feature-discovery UI for iOS 17+ apps. Use when adding or auditing in-app tips, contextual help, coach marks, Tip, TipView, po3.8Kskills.sh installs
4dotnet avataruse-js-interopdotnet/skillsAdd, review, or fix JavaScript interop in Blazor components. USE FOR: calling JavaScript from Blazor, calling .NET from JavaScript, collocated .razor.js modules3.7Kskills.sh installs
5dotnet avatarconvert-blazor-server-to-webappdotnet/skillsGuides conversion of a pre-.NET 8 Blazor Server app into a .NET 8+ Blazor Web App. USE FOR: migrating apps that use AddServerSideBlazor and MapBlazorHub to the 3.7Kskills.sh installs
6browser-use avataropen-sourcebrowser-use/browser-useDocumentation reference for writing Python code using the browser-use open-source library. Use this skill whenever the user needs help with Agent, Browser, or T3.7Kskills.sh installs