Tie-In to Lab 4

• Lab 4 target: NX enabled, so no stack shellcode.
• You will:
• find an overflow and locate the saved return address (offset),
• locate a pop rdi ; ret gadget and the "/bin/sh" string,
• build a ret2libc / ROP chain (mind the movaps alignment!),
• pop a shell inside the isolated lab VM.
• Tools: ROPgadget/ropper, pwntools ROP(), one_gadget, gdb + pwndbg.
• Class 08 adds the missing piece for ASLR targets: the information leak.