You've got an arbitrary write primitive from a heap bug, format string, or overflow, and now you need to turn it into code execution. This walks you through every major target: GOT entries if you have partial RELRO, malloc/free hooks if you're pre-glibc 2.34, IO_FILE vtable manipulation, exit_funcs with pointer mangling, and TLS_dtor_list for modern glibc. The version matrix is the most useful part here because base models love to suggest __free_hook on glibc 2.35 where it doesn't exist anymore. It covers the pointer guard demangling math and has trigger conditions for each target. This is genuinely the last mile skill, the "I can write anywhere, now what" reference.
npx skills add https://github.com/yaklang/hack-skills --skill arbitrary-write-to-rce