Skip to content
BinaryExploitation

Guides tagged: #ret2libc

← Back to all guides
0x7000 · Exploitation Techniques

one-gadget: One Address to a Shell

Sometimes you control just one pointer. A one-gadget is a single libc address that calls execve("/bin/sh") — if its register and stack constraints hold. Find one, check the constraints, and use it.

0x7000 · Exploitation Techniques

Returning into libc: the ret2libc Technique

NX is on and the binary is tiny, but libc is mapped and full of useful code. Leak its base past ASLR, then return straight into system("/bin/sh") — a full two-stage pwntools walkthrough.