NX Bit Bypass with ret2libc
Defeating the NX bit by returning into libc: chaining system() + exit() + /bin/sh instead of executing injected shellcode.
2022-03-14$ grep -r category=DEP / NX Bypass
2 writeups in this category.
Lab 3 — ret2libc + ASLR Bypass via Info Leak
Combining NX and ASLR bypass: leak puts@GOT to recover the libc base, recompute offsets at runtime, then ret2system for a shell.
2022-03-14