Getting hands-on with the return-to-PLT attack

I say this about a lot of topics, but the Procedure Linkage Table (PLT) and the Global Offset Table (GOT) are subjects that deserve their own book. However, we’ll try to run through a crash course to understand how we’re going to get around memory space randomization. Our executable is not a position-independent executable thanks to our -no-pie compilation configuration, so the actual location of global structures in the program wasn’t known at compile time. The GOT is literally a table of addresses used by the executable during runtime to convert PIE addresses into absolute ones. At runtime, our executable needs its shared libraries; these are loaded and linked using the dynamic linker during the bootstrapping process. That is when the GOT is updated.

Since the addresses are dynamically linked at runtime, the compiler doesn’t really know whether the addresses in our non-position-independent code will...