Every return to libc buffer overflow attack I've seen uses the system
function to execute commands. I have an executable with DEP enabled (I can't execute on the stack) and the system
function isn't linked in (at least, I don't think it is. Running the executable with gdb
and typing p system
results in a No symbol "system" in current context.
message.
Is it possible to still execute a buffer overflow attack to execute arbitrary commands with this type of executable? Are there any tutorials or research papers on this topic?
UPDATE: I was able to exploit the binary by using this tool: https://github.com/JonathanSalwan/ROPgadget