0x7000 · Exploitation Techniques
one-gadget: One Address to a Shell
Sometimes you control just one pointer. A one-gadget is a single libc address that calls execve("/bin/sh") — if its register and stack constraints hold. Find one, check the constraints, and use it.