GOT-Oriented Programming

The other day I was working on a pwn challenge and I noticed something interesting: its version of libc had partial RELRO enabled. To redirect control flow I tried overwriting one of libc&rsquo;s GOT entries with a one_gadget, but I didn&rsquo;t have enough register control to pop a shell. That got me thinking: what if we could use libc&rsquo;s GOT as a sort of jump table? This is a technique…