nm -D /lib/x86_64-linux-gnu/libc.so.6 | grep ' system' | awk '{print $1}' nm -D /lib/x86_64-linux-gnu/libc.so.6 | grep ' exit' | awk '{print $1}' sh_loc=$(objdump -s -j .rodata /lib/x86_64-linux-gnu/libc.so.6 | grep "/bin/sh" | awk '{print $1}') objdump -s -j .rodata /lib/x86_64-linux-gnu/libc.so.6 | grep "/bin/sh" | awk '{print $1}' sh_loc_final=$(echo "0x$sh_loc") echo "$sh_loc_final"