pwndbg_onegadget
Search for single-gadget RCE paths in libc that call execve('/bin/sh') to gain a shell by overwriting a function pointer.
Instructions
Find one-gadget (magic gadget) RCE gadgets in libc.
pwndbg command: onegadget Source: pwndbg/commands/onegadget.py Category: Linux/libc/ELF Arch: x86-64, i386, aarch64
Searches for single-gadget code paths in libc that directly call execve("/bin/sh", ...). These are the holy grail for exploitation since overwriting a single function pointer gives a shell.
Args: session_id: The UUID of the session. verbose: If True, show constraint details.
See: https://pwndbg.re/2025.05.30/reference/pwndbg/commands/onegadget/
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| session_id | Yes | ||
| verbose | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |