To defeat ASLR (randomization of Libc), we need a leak.

Since NX is enabled, we cannot inject shellcode. We must use ROP (Return Oriented Programming) or a hook overwrite. The most reliable method for this binary is .