Recap: We Could Just Inject Shellcode... Until Now

• In Class 06 we placed shellcode on the stack and jumped to it.
• Modern systems enable NX / DEP (No-eXecute / Data Execution Prevention): pages are either writable or executable, never both (W X).
• The stack, heap, and BSS are writable ⇒ therefore not executable.
• Our injected bytes are still there — the CPU just refuses to run them (segfault on execute).

The attacker's pivot

If we cannot bring new code, we {reuse the executable code

that is already mapped}: the program's own functions, and all of libc.