skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

exploiting-arbitrary-write-to-execution

Converts arbitrary-write primitives into code execution during authorized binary exploitation engagements.

954|172|Updated Mar 13, 2026
Search Tags:#binary-exploitation#CTF#exploit-development#pwn#glibc#arbitrary-write#got-overwrite
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill exploiting-arbitrary-write-to-execution
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: exploiting-arbitrary-write-to-execution
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/binary-exploitation/exploiting-arbitrary-write-to-execution
Command: npx skills add https://github.com/xalgord/xalgorix --skill exploiting-arbitrary-write-to-execution

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

During authorized penetration testing, a write-what-where primitive (format string %n, heap metadata corruption, OOB write, UAF) does not directly give control of execution. This Skill provides the methodology for selecting the right overwrite target and turning that write primitive into hijacked control flow.

Core Features & Use Cases

  • Target Selection by Mitigation: Chooses between GOT/PLT entries, .fini_array/.dtors, __malloc_hook/__free_hook, __exit_funcs, and __printf_arginfo_table based on checksec results (Partial vs Full RELRO) and glibc version.
  • Mitigation-Aware Guidance: Explains how Full RELRO kills the GOT path, how glibc >= 2.34 removed the malloc/free hooks, and how PTR_MANGLE protects atexit handlers requiring a pointer_guard leak.
  • Confirmation Workflow: Uses a sentinel overwrite plus a gdb breakpoint to prove the hijacked call actually reaches the attacker's address before finalizing the exploit.
  • Use Case: A CTF player or pentester has a format-string %n write on a Partial RELRO binary; the Skill walks them through overwriting strlen@got with system, triggering a call with "/bin/sh", and verifying the shell.

Quick Start

Ask the agent to convert my arbitrary write primitive in the target binary into code execution, selecting the overwrite target based on checksec output and glibc version.

Frequently Asked Questions about exploiting-arbitrary-write-to-execution

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I turn an arbitrary write into code execution?▼

Overwrite a code pointer the program will later call, such as a GOT entry, .fini_array destructor, __malloc_hook/__free_hook, or an __exit_funcs handler, then trigger the corresponding call path. Confirm the hijack by writing a sentinel address first and breaking on it in gdb.

What target should I overwrite with Full RELRO enabled?▼

Full RELRO maps the GOT read-only, so GOT overwrites fail. Use writable alternatives instead: __malloc_hook/__free_hook on glibc below 2.34, __exit_funcs, __printf_arginfo_table, a saved return address, or a function pointer in writable data.

Does __malloc_hook still work on modern glibc?▼

No, __malloc_hook and __free_hook were removed in glibc 2.34. On newer targets you must pivot to FSOP (_IO_FILE vtable), __exit_funcs, or __printf_arginfo_table instead of the legacy hooks.

Why does my atexit or __exit_funcs overwrite not execute?▼

__exit_funcs entries are protected with PTR_MANGLE, which rotates and XORs pointers with the pointer_guard value at fs:[0x30]. You must leak the guard and forge a correctly mangled pointer, or choose a different overwrite target.

Why does my one_gadget crash instead of spawning a shell?▼

one_gadget addresses only work when their constraints hold at call time, such as 16-byte stack alignment or [rsp+0x40] == NULL. Check the constraints printed by one_gadget and adjust the stack or registers before triggering the call.

Related Skills

Explore More Software Engineering Skills→
yaklangyaklang
1.6k

heap-exploitation

Exploit ptmalloc2 and glibc heap vulnerabilities for arbitrary write or code execution.

Official
Advanced
rocklambrosrocklambros
2

writing-pentest-finding

Generate client-deliverable penetration-test findings with CVSS v3.1 vectors and remediation.

Community
Advanced
bingookbingook

format-string-exploitation

Exploit format string vulnerabilities for stack reads and arbitrary writes.

Community
Advanced
Prohao42Prohao42
120

arbitrary-write-to-rce

Convert arbitrary writes to code execution across glibc versions.

Community
Advanced