Return2

Return2¶

ret2data¶

Inject data into the data section of the mapped executable then jump to it.

ret2strcpy¶

Copy from stack to any -wx address space

ret2gets¶

inject input data directly into any -wx address space

ret2syscall¶

https://ret2basic.gitbook.io/ctfnote/pwn/linux-exploitation/rop/ret2syscall
https://book.hacktricks.xyz/binary-exploitation/rop-return-oriented-programing/rop-syscall-execv

ret2plt¶

Use plt to change pointer to jump to