Summary

• Modern mitigations (NX + ASLR) mean one bug is rarely enough — exploits chain an info leak with a control-flow primitive.
• The GOT is the pivot: readable to leak a libc address, writable (partial RELRO) to overwrite a call target.
• libc_base = leaked_addr - offset; from the base every libc symbol (system, /bin/sh, one-gadget) is known.
• Two-stage pattern: leak, return to main, re-attack with computed addresses — against remote, match the target's libc.
• Defenses: full RELRO, PIE, CFI, and above all eliminating info leaks. Break any link, break the chain.