skills.rest
lNwNl
lNwNlCOMMUNITY
Explore all skills by this author →
GitHub

arbitrary-write-to-rce

Convert arbitrary write primitives into code execution across glibc versions.

2|Updated May 15, 2026
Search Tags:#glibc#arbitrary write#rce exploitation#pointer mangling#io_file vtable#tls dtors#gadget pivot
One-click install
npx skills add https://github.com/lNwNl/Methodos --skill arbitrary-write-to-rce
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: arbitrary-write-to-rce
Source: https://github.com/lNwNl/Methodos/tree/main/docker/opencode/skills/arbitrary-write-to-rce
Command: npx skills add https://github.com/lNwNl/Methodos --skill arbitrary-write-to-rce

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill helps convert an arbitrary write memory primitive into working code execution against modern Linux/glibc targets, even when common hook-based techniques are removed.

Core Features & Use Cases

  • Target selection by glibc version: Chooses appropriate execution targets across GOT overwrites, legacy hooks, and post-2.34 destructor paths.
  • Multiple RCE overwrite routes: Covers GOT, __exit_funcs, TLS_dtor_list, _dl_fini/link_map corruption, .fini_array, _IO_FILE vtable (FSOP), C++ vtables, and setcontext pivot chains.
  • Practical constraints guidance: Includes required knowledge for each target (e.g., libc/ld.so bases, pointer guard handling, heap address needs) and how to proceed when hooks are unavailable.

Quick Start

Ask the AI to map your arbitrary write primitive, known leaks (libc/ld.so/pointer guard), and binary/protection state to the best execution target and provide an exploitation plan.

Frequently Asked Questions about arbitrary-write-to-rce

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I turn an arbitrary write vulnerability into reliable RCE on modern glibc?▼

To turn an arbitrary write into reliable RCE, select the correct overwrite target and trigger path based on glibc compatibility, memory protections, and known leaks, mapping the primitive to execution routes like GOT overwrites, TLS dtors, or _IO_FILE vtable corruption.

What is the best way to achieve RCE when glibc legacy hooks are unavailable?▼

When glibc legacy hooks are unavailable in post-2.34 versions, target alternative execution routes such as __exit_funcs, TLS_dtor_list, link_map/_dl_fini corruption, .fini_array, or _IO_FILE vtable FSOP to achieve reliable code execution.

How does pointer mangling affect arbitrary write to RCE exploitation?▼

Pointer mangling obfuscates stored function pointers using a TLS-based pointer guard, requiring you to leak or calculate the guard value to successfully corrupt targets like _IO_FILE vtables, C++ vtables, and TLS_dtor_list for RCE.

Can I use heap or format-string write primitives with setcontext pivots for execution?▼

Yes, heap, format-string, OOB, and stack-based arbitrary write scenarios can all utilize setcontext pivot chains to transfer execution control and complete the final RCE step across different glibc versions and RELRO states.

Why does my GOT overwrite fail to achieve code execution with Full RELRO enabled?▼

GOT overwrites fail under Full RELRO because the Global Offset Table is mapped read-only after startup, requiring a pivot to alternative targets like destructor lists, _IO_FILE vtables, or link_map corruption to achieve RCE.

Related Skills

Explore More Software Engineering Skills→
utsavthakurutsavthakur

heap-exploitation

Guide glibc heap exploitation techniques including tcache, fastbin, and unsortedbin attacks.

Community
Advanced
riparinoriparino
1

offensive-basic-exploitation

Teaches Linux x86_64 exploitation via ROP chains and shellcode injection.

Community
Advanced
langbyyilangbyyi
96

ctf-pwn

Solve CTF binary exploitation challenges with pwntools, ROPgadget, and GDB-pwndbg.

Community
Advanced
yaklangyaklang
1.6k

heap-exploitation

Exploit ptmalloc2 and glibc heap vulnerabilities for arbitrary write or code execution.

Official
Advanced