I have the following scienarion:

a vulnerable program running in a server and can be accessed using netcat

I have a copy of that program locally and I can exploit it locally using ROP:

./vuln garbage + &system() + &exit() + &"/bin/sh"

now I want to exploit it remotely so technically I would be executing this command:

echo -e "garbage + &system() + &exit() + &/bin/sh" | nc host port

My problem is: I do not know what is &system() on the remote machine. Is there any way to get it without brute force ie: trying all memory address from 0x00000000 -> 0xFFFFFFFF

ps: &exit() is negligible but good-to-have


According to this reddit post. The following ways can be followed to obtain system() address on a remote machine for later return 2 libc exploitation.

  1. No ASLR: Find out their version of libc/msvcrt. It should (Windows makes no guarantees, Linux shared libraries don't either) be loaded at the same address every time. Find address of system, use it.
  2. Partial-ASLR (no PIE): The original binary will be loaded in the same place every time (again no guarantees on Windows). Find entry of libc/msvcrt function in the GOT/IAT, use that address.

  3. Full-ASLR: You need an information leak.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.