From Primitive to Shell

Once you have an arbitrary write, you need a control-flow target:

• Older glibc (< 2.34): overwrite __free_hook or __malloc_hook with the address of system (or a one-gadget). The next free(p) / malloc then runs your code, with p pointing at "/bin/sh".
• GOT overwrite: redirect a library function's GOT entry to system; works when RELRO is partial or absent.
• Saved return address: tcache-poison an allocation onto the stack and overwrite a return address (start a ROP chain).
• Newer glibc (2.34+): malloc/free hooks were removed. Modern targets include _IO_FILE / vtable structures and __exit_funcs.