one_gadget and the glibc heap "houses"

Often, after getting a write, you do not want to build a full ROP: you want one address that, jumped to with the right state, runs execve("/bin/sh").

one_gadget

In libc there are sequences that call execve("/bin/sh", ...) if certain registers/memory hold known values. The one_gadget tool finds them and lists their constraints:

one_gadget /lib/x86_64-linux-gnu/libc.so.6

Overwriting __free_hook/__malloc_hook (in glibc < 2.34) or a function in __exit_funcs with a one_gadget yields a shell without a chain.

The houses

House of Force, of Spirit, of Orange, of Botcake: families of techniques that corrupt heap metadata (top chunk, freelist, unsorted bin) to get a write where needed. They change with each glibc version.

Defence

Recent glibc removed the hooks and added metadata checks. Hardened allocators, ASLR, and absence of memory bugs remain the real defence.