Overwriting a GOT Entry

• If you have a write primitive (buffer overflow into a data pointer, format-string %n, arbitrary write bug), the GOT is a prime target because it is writable under partial RELRO.
• Idea: overwrite the GOT entry of a function the program is about to call with the address of code you want to run:
• GOT[printf] = &system — then the next printf("/bin/sh") actually calls system("/bin/sh").
• GOT[some_func] = one_gadget — a single libc address that calls execve("/bin/sh", ...) when constraints hold.
• This turns a benign, attacker-influenced call into arbitrary code execution — no shellcode, no stack execution needed.