>Yes. If there's a working buffer overflow anywhere in code [...] These days it's not _that_ straightforward with thing like ASLR, NX and heap hardening. You n

>Yes. If there's a working buffer overflow anywhere in code [...] These days it's not _that_ straightforward with thing like ASLR, NX and heap hardening. You need some sort of information leak for ASLR, then somehow start controlling R/EIP (which may prove difficult if there isn't interesting things on the heap nearby), write a ROP chain, and then pivot into something more useful (if you can't/don't want to ROP your way to a shell).