0x7000 · Exploitation Techniques
ret2dlresolve: Resolving a Symbol Without a Leak
No libc leak, no problem: forge the relocation the dynamic linker reads and make it resolve and call system for you. A pwntools walkthrough — and why Full RELRO ends it.