glibc

Leaking libc through an oversized mmap chunk, then a format-string bug redirects a writable libc GOT entry to system to get a shell.

A double free, a leaked system(), and a detour through fastbins to reach __free_hook.

A gets overflow with no canary leaks puts to fingerprint libc, then ROPs through the eat and zzz helpers to reach a one-gadget shell.

A format-string bug leaks the stack canary and libc, then a buffer overflow in the edit handler drives a ROP chain to a one-gadget shell.

A 32-bit buffer overflow and a leaked system address drive a ret2libc call that runs /bin/sh via a string found in the provided libc.

A PIE binary that leaks main to beat ASLR, then leaks libc via printf's GOT entry before ROP-ing into a one-gadget shell.