ret2libc

9. ret2libc

ret2libc = “return to libc”: instead of jumping to your own shellcode, you reuse functions in the C standard library (libc), like system, printf, execve, etc. Basic steps in a typical ret2libc exploit: 1. Find or leak a libc address at runtime (e.g., via puts a GOT entry). 2. Use that to determine the base address of libc in memory. 3. Compute addresses of system and "/bin/sh" inside that libc. 4. Build a ROP chain:

"A" * offset
+ pop_rdi_ret
+ address_of_string_bin_sh
+ address_of_system

The lecture just introduces ret2libc + ROP as an exploit chain you can use to get remote code execution by sending a single malicious payload.