Is privilege escalation possible if Attacker can force Victim to write to symlink set by Attacker?

I am sure others have analyzed this scenario before, but I cannot find a source.
Assume:

Attacker has an account on the system
Victim has an account on the system
Victim runs MyProg
There is a bug in MyProg: It creates a temporary file, b… Continue reading Is privilege escalation possible if Attacker can force Victim to write to symlink set by Attacker?

When gets reads a string, it does not read \x00, which is the NULL character. So how to separate two different addresses to complete ROP?

First I used ROPgadget to find two assembly instructions:
xor rax; ret and pop rcx; ret,
They are at 0x401270 and 0x40133b.
Then I tried to put them at the top of the stack, but because the gets instruction does not read the \x00 character… Continue reading When gets reads a string, it does not read \x00, which is the NULL character. So how to separate two different addresses to complete ROP?