Skip to main content

24. The Core Flow of ELF PLT/GOT Hijacking

In reversing and CTFs, a GOT overwrite remains a powerful bypass point. Once the dynamic-linking flow is clear, you can cleanly redirect the call path.

Core Concepts​

  • The PLT is a call stub; the GOT caches actual function addresses
  • With partial RELRO, the GOT may be writable
  • Overwriting the GOT is sometimes more reliable than overwriting a function pointer

Practical Checklist​

  1. Inspect RELRO with readelf -l
  2. Identify the target GOT entry with objdump -R
  3. Trace its runtime address with pwndbg got
  4. Overwrite the function with system, win, or a one-gadget

Finally, modern binaries often combine full RELRO + PIE + CET. In that case, it is more practical to target control flow before the call, such as ROP or ret2plt, rather than changing the hook target itself.