2

If I have a libc file which is used on another server where the vulnerable binary is running, then how can I find the address of system in it?

I have both the vulnerable binary and the libc file with me.

Usually, on local system, I would use gdb to find system() address. But when I execute binary from on my system, it will be using libc from my system.

So, how can I make sure that the address I find using gdb is of the libc from another server and not on my local system?

Should I place the libc file (from another server) in the same directory as the binary so that it is loaded by default when it's executed instead of the libc of local system?

Thanks.

1

try leaking 2 libc addresses and matching their difference with a libc database on the internet. This will give you the libc version used. After that you can find the offset of system in this libc with pwntools by: libc=ELF("/path/to/libc")
libc_system=libc.symbols["system"]

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.