NX Bit Bypass with ret2libc
Defeating the NX bit by returning into libc: chaining system() + exit() + /bin/sh instead of executing injected shellcode.
2022-03-14$ filter --tag advanced
3 posts tagged #advanced.
Lab 3 — ret2libc + ASLR Bypass via Info Leak
Combining NX and ASLR bypass: leak puts@GOT to recover the libc base, recompute offsets at runtime, then ret2system for a shell.
2022-03-14
Stack Canary Bypass via Format String Leak
Leaking the stack canary through a format-string information disclosure, then overwriting the return address while keeping the canary intact.
2022-03-14