For a class in software security I've got to make a simple return to libc attack. I managed to make a perl script that completes the attack given the correct pointers to system(), exit() and the /bin/sh string. I found these pointers using gdb "p system" etc. Now I want to make the exploit a bit more "dynamic" by writing a c program that finds the adres of system() and exit() at run time. How do I do this? I tried "&system" but that doesn't seem to be giving me the correct adress at all.
Edit: The system does NOT have ASLR enabled.