Class 07 · KP 03 / 18
ret2libc: Call system("/bin/sh") Without Shellcode
A ROP chain: each 'ret' launches the next gadget already present in the code.- Goal: make the program call
system("/bin/sh"). - We need three things:
- the address of
system in libc, - the address of the string
"/bin/sh" (handily, it lives inside libc already), - a way to pass that string as the first argument.
- How the argument is passed differs by architecture — this is the crux of 32-bit vs 64-bit ret2libc.