[SOCAT] $ socat TCP4-LISTEN:14952,fork EXEC:./ropme [PWNTOOLS] [PEDA] [QIRA] $ qira ./a.out $ qira -s ./a.out $ socat tcp-l:4000,reuseaddr,fork exec:"qira ./a.out" [ROPgadget] [GCC] $ gcc -z execstack -fno-stack-protector -o ./ropme ./ropme.c # Cancel DEP and Stack Protector [Core Dump Setting] $ ulimit -c unlimited [DEP Check] $ readelf -l ./ropme [ASLR Check] $ echo 0 > /proc/sys/kernel/randomize_va_space $ echo 2 > /proc/sys/kernel/randomize_va_space $ cat /proc/[pid]/maps $ ldd ./ropme [Check Content] $ objdump -s ./ropme $ objdump -s -j .rodata ./ropme $ string ./ropme [PLT Function] $ objdump -d -j .plt ./ropme [GOT Table] $ objdump -R ./ropme [BSS Section Get] $ objdump -H ./ropme $ readelf -S ./ropme [GDB Usages] # Debug Core Dump $ gdb -c <core_file> ./ropme (gdb) bt (gdb) bt full $ gdb ./ropme (gdb) break main (gdb) run < payload (gdb) print system # print variable "system"...