arbitrary-write-to-rce

A binary-exploitation playbook for the 'last mile' of an exploit: converting an arbitrary write primitive, obtained from heap exploitation, a format string bug, or an out-of-bounds write, into code execution. It catalogs the major overwrite targets and, critically, organizes them by glibc version compatibility so an operator can pick a target that still exists in the runtime being attacked. Targets include GOT entries, the legacy malloc/free/realloc hooks (removed in glibc 2.34), the _IO_FILE vtable, __exit_funcs, TLS_dtor_list, _dl_fini/link_map, the kernel's modprobe_path, .fini_array, C++ vtables, and setcontext gadgets.

Each target is described with its requirements and trigger. GOT overwrites need Partial RELRO and list common function-pointer swaps (for example replacing free, printf, or strlen with system). The hook sections show one_gadget and system overwrites plus the realloc trick for satisfying one_gadget register and stack constraints. Later sections cover FILE-structure exploitation across glibc versions (direct vtable, _IO_str_jumps, _IO_wfile_jumps, House of Cat) and the pointer-mangling requirements for __exit_funcs and TLS_dtor_list, including how the stored pointer is rotated and XORed with the pointer guard and how to work around it when the guard can also be overwritten.

Reach for this material after you already have a write-what-where primitive and need to decide where to aim it given the target's protections and glibc version. It highlights mistakes base models commonly make, such as targeting hooks that no longer exist after glibc 2.34 or forgetting pointer-mangling requirements, and pairs the version table with concrete pwntools-style snippets. The routing section connects it to related skills for obtaining the write in the first place (heap exploitation, format-string exploitation, stack overflow and ROP) and for reasoning about which targets are available under a given binary-protection configuration. The content is intended for authorized exploitation practice such as CTFs and security research.