one_gadget RCE.

An exploitation shortcut in CTFs and real exploits that calls a single libc address to spawn a shell, provided register and stack constraints are met. It belongs to the Attacks & Threats category of cybersecurity.

An exploitation shortcut in CTFs and real exploits that calls a single libc address to spawn a shell, provided register and stack constraints are met.

A one_gadget is a single instruction sequence inside glibc that ultimately calls execve("/bin/sh", NULL, NULL) when reached with specific register and stack preconditions. The popular tool one_gadget by david942j scans libc to enumerate these addresses and their constraints, such as rax == 0 or rsp+0x40 == NULL. Exploiters who can hijack a single function pointer or return address (for example via GOT overwrite, FILE-stream attacks, or unsorted-bin attacks) can therefore obtain a shell without building a full ROP chain. Constraints must be carefully satisfied, often using ancillary gadgets or stack-pivots. Mitigations include constant-blinding, CFI, system_call-only sandboxes, and stripped or modified libcs that remove the canonical gadgets.

Defences for one_gadget RCE typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: one_gadget.