Stack overflow into ret2dlresolve — force the dynamic linker to resolve system at runtime and run system("sh").