WCU / Cybersecurity
~/CSC 472/Class 07/KP 03
Class 07 · KP 03 / 18

ret2libc: Call system("/bin/sh") Without Shellcode

attacker stackpadding A*N→ pop rdi ; retgadgetarg1in RDI→ pop rsi ; retgadgetarg2in RSI→ system()target.text / libcexisting code
A ROP chain: each 'ret' launches the next gadget already present in the code.
  • Goal: make the program call system("/bin/sh").
  • We need three things:
  • the address of system in libc,
  • the address of the string "/bin/sh" (handily, it lives inside libc already),
  • a way to pass that string as the first argument.
  • How the argument is passed differs by architecture — this is the crux of 32-bit vs 64-bit ret2libc.