I have the following scienarion:
a vulnerable program running in a server and can be accessed using netcat
I have a copy of that program locally and I can exploit it locally using ROP:
./vuln garbage + &system() + &exit() + &"/bin/sh"
now I want to exploit it remotely so technically I would be executing this command:
echo -e "garbage + &system() + &exit() + &/bin/sh" | nc host port
My problem is: I do not know what is &system() on the remote machine. Is there any way to get it without brute force ie: trying all memory address from 0x00000000 -> 0xFFFFFFFF
ps: &exit() is negligible but good-to-have