#rop

---

`Echo` is a small remote pwn challenge:

The bug is not the final `gets()` by itself. The real primitive is:

ret2win with a stack-alignment twist — hop through a single ret gadget before calling win() so system() sees a 16-byte-aligned stack.

32-bit ret2dlresolve — Partial RELRO, NX on, no libc leak, only read@plt. Force the linker to resolve system("/bin/sh").

Two-stage SROP without libc. pop rax; ret + syscall are enough. First frame does read + stack pivot, second frame executes execve("/bin/sh").

Stack overflow into ret2dlresolve — force the dynamic linker to resolve system at runtime and run system("sh").