Is a return to libc attack possible without the system function?

Question

Every return to libc buffer overflow attack I've seen uses the system function to execute commands. I have an executable with DEP enabled (I can't execute on the stack) and the system function isn't linked in (at least, I don't think it is. Running the executable with gdb and typing p system results in a No symbol "system" in current context. message.

Is it possible to still execute a buffer overflow attack to execute arbitrary commands with this type of executable? Are there any tutorials or research papers on this topic?

UPDATE: I was able to exploit the binary by using this tool: https://github.com/JonathanSalwan/ROPgadget

Answer 1

This the main known limitation of the 'ret-into-libc' attack, you can only use the functions that are used by the attacked program. Moreover, in 'ret-into-got' attacks you are limited only to functions that have been already used before you perform the attack (the function location must have been resolved in the GOT).

But, you may use similar functions if they are present. Functions such as execve or any function of the same family may be used (yet, the arguments are a bit more complex to be set).

Just to conclude, this is also because of this limitation that the 'return-oriented-programming' was a big breakthrough since it has been shown to be Turing complete (i.e. able to emulate any kind of function if you have enough gadgets in the .text section). See the famous paper "The Geometry of Innocent Flesh on the Bone: Return-into-libc without Function Calls (on the x86)" by Hovav Shacham.