> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/binary-exp/04.-stack-overflow/04.-ret2libc.md).

# 04. ret2libc

## 🔥 What is `libc` (from scratch)

`libc` = the standard C library on Linux.

It contains functions like:

* `printf`
* `system`
* `puts`
* `gets`
* `exit`

When your program runs, it doesn’t have its own implementations of these—it **links to libc** (shared library loaded in memory).

## 🧠 What is ret2libc

**ret2libc = Return-to-libc attack**

Instead of:

```
jumping to win()
```

you do:

```
jump to libc function → system("/bin/sh")
```

***

## ❓ Why do we need ret2libc?

Because in real binaries:

* ❌ No `win()` function
* ❌ NX (No Execute) → no shellcode
* ❌ Protections enabled

So you reuse existing code inside libc.

***

## 🎯 Goal of ret2libc

Execute:

```c
system("/bin/sh");
```

Which gives shell.

***

## ⚙️ What you need (3 things)

1. Address of `system`
2. Address of string `"/bin/sh"`
3. (optional) address of `exit`

***

## 🧠 Stack layout (important)

Payload looks like:

```
[ padding ]
[ system() address ]
[ return address (junk / exit) ]
[ address of "/bin/sh" ]
```

***

## 📦 Example flow (concept)

Let’s say:

```
system = 0x7ffff7e12345
/bin/sh = 0x7ffff7f67890
```

Payload:

```python
b"A"*offset + p64(system) + p64(0) + p64(binsh)
```

***

## ❗ Big problem (this is the real challenge)

👉 libc is loaded at **random address** (ASLR)

So:

```
system = UNKNOWN
/bin/sh = UNKNOWN
```

***

## 🔥 So how do we solve it?

We **leak an address first**.

***

## 🧪 Step-by-step ret2libc attack

### Step 1 — Leak libc address

Use a function like `puts`:

```
puts(puts@GOT)
```

This prints the real address of `puts` in memory.

***

### Step 2 — Calculate libc base

```
libc_base = leaked_puts - offset_of_puts_in_libc
```

***

### Step 3 — Calculate targets

```
system = libc_base + offset_system
binsh  = libc_base + offset_binsh
```

***

### Step 4 — Final payload

```
system("/bin/sh")
```

***

## 💡 Small conceptual example

Imagine:

```
puts leak = 0x7ffff7a5e5e0
puts offset = 0x80e50
```

Then:

```
libc_base = 0x7ffff7a5e5e0 - 0x80e50
```

Now:

```
system = libc_base + 0x4f550
/bin/sh = libc_base + 0x1b3e1a
```

***

## 🔁 Full attack flow

```
1. BOF → control RIP
2. Call puts(puts@GOT) → leak address
3. Return to main
4. Calculate libc base
5. Build second payload
6. Call system("/bin/sh")
```

***

## 🔧 Tools used

* GDB → debugging
* pwntools → scripting
* `checksec` → protections
* `ldd` → libc version

***

## 🧠 Key difference vs ret2win

| ret2win        | ret2libc        |
| -------------- | --------------- |
| jump to win()  | call system()   |
| address known  | address unknown |
| easy           | real-world      |
| no leak needed | leak required   |

***

## 🔥 Mental model (lock this in)

```
ret2win → use function inside binary
ret2libc → use function inside libc
```

***

## ⚠️ Common beginner mistakes

* Forgetting little endian
* Not leaking libc first
* Wrong libc version
* Missing return address alignment
* Not returning to main after leak

***

## 🚀 Where this leads next

After ret2libc:

* ROP chains
* one\_gadget
* PIE bypass
* full pwn challenges


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/binary-exp/04.-stack-overflow/04.-ret2libc.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.