I have to exploit a very simple buffer overflow in a vulnerable C++ program for an assignment and I am not being able to find the environment variable SHELL.
I have never worked with BoF before, and after reading lots of similar questions, posts, etc. I have this information (correct me if it's wrong):
- The program stores the environment variables in a global variable called
I can find the address of this variable like this:
(gdb) info variable environ All variables matching regular expression "environ": Non-debugging symbols: 0xb7fd1b00 __environ 0xb7fd1b00 _environ 0xb7fd1b00 environ
I need to find the
/bin/bashstring in that variable to launch a shell (I have already got the system and exit addresses, I only need the route to the shell). And here is where I don't know what to do. I have been reading gdb tutorials, but still nothing.
x/s 0xb7fd1b00does not output anything useful.