No Leak, No Problem – Bypassing Aslr with a Rop Chain to Gain Rce

I would not consider this actually bypassing ASLR, because ASLR is already turned off for a critically important block of code. Practically any large-enough binary has gadgets that can be useful for ROP exploitation, even if chaining them together is somewhat painful. For ASLR to be a reasonably effective mitigation, every memory region needs to be randomized.

It’s fun working on targets with a less established research history. And I love a soup to nuts writeup, Thanks.

Expanding it, perhaps to the benefit of others like me.

Also not familiar at all with the checksec program, but from my look at the documentation, you expect to see PIE enabled not DSO (which implies dynamic shared object).