I'm studying the Return-to-libc Attack and I understand the concept. But one thing still does not make sense. In order to make the attack I need the memory address of system() and "/bin/sh", which is different on every system. And all the examples I have seen about the topic is about creating a dummy C code and debug it with gdb to find out these addresses on their host system.
Well how I can get these memory addresses on the target system if I have no shell access yet? All I have is maybe an EIP address that I found out by fuzzing and a non-executable stack which I cant run anything on it?