Writing a return-to-libc attack, but libc is loaded at 0x00 in memory

Question

I\'m writing a return to libc attack for my systems security class. First, the vulnerable code:

//vuln.c
#include 
#include 

         


        

Answer 1

The act of mapping important libc function to addresses which contain a NULL byte is called ASCII armoring. This protection is part of RedHat Exec-shield which is currently enabled on recent ubuntu distros link To disable it you have to run as root:

sysctl -w kernel.exec-shield=0

as explained here

By the way you can find interesting material about how to bypass ASCII armoring here on exploit-db