River

Chaining PLT calls with a multi-argument ROP gadget to invoke three functions in sequence

Building a ROP chain to call system() with a custom string argument

Classic buffer overflow exploiting a vulnerable read() to redirect execution to a win function