arbitrary-write-to-rce

1# SKILL: Arbitrary Write to Code Execution — Expert Attack Playbook
2 
3> **AI LOAD INSTRUCTION**: Expert techniques for converting an arbitrary write primitive into code execution. Covers every major overwrite target organized by glibc version compatibility: GOT, __malloc_hook, __free_hook, _IO_FILE vtable, __exit_funcs, TLS_dtor_list, _dl_fini, modprobe_path, .fini_array, C++ vtable, and setcontext gadget. This is the "last mile" skill. Base models often target hooks that no longer exist (post-glibc 2.34) or miss pointer mangling requirements.
4 
5## 0. RELATED ROUTING
6 
7- [heap-exploitation](../heap-exploitation/SKILL.md) — obtaining the arbitrary write via heap attacks
8- [format-string-exploitation](../format-string-exploitation/SKILL.md) — obtaining the arbitrary write via %n
9- [stack-overflow-and-rop](../stack-overflow-and-rop/SKILL.md) — stack-based write primitives
10- [binary-protection-bypass](../binary-protection-bypass/SKILL.md) — which targets are available given protection configuration
11- [heap-exploitation IO_FILE_EXPLOITATION.md](../heap-exploitation/IO_FILE_EXPLOITATION.md) — deep _IO_FILE structure exploitation
12 
13---
14 
15## 1. TARGET SELECTION BY GLIBC VERSION
16 
17| Target | glibc < 2.24 | 2.24–2.33 | ≥ 2.34 | Required Knowledge |
18|---|---|---|---|---|
19| GOT overwrite | OK (Partial RELRO) | OK (Partial RELRO) | OK (Partial RELRO) | Binary base |
20| `__malloc_hook` | OK | OK | **Removed** | libc base |
21| `__free_hook` | OK | OK | **Removed** | libc base |
22…