Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have to exploit a very simple buffer overflow in a vulnerable C++ program for an assignment and I am not being able to find the environment variable SHELL.

I have never worked with BoF before, and after reading lots of similar questions, posts, etc. I have this information (correct me if it's wrong):

  • The program stores the environment variables in a global variable called environ
  • I can find the address of this variable like this:

    (gdb) info variable environ
    All variables matching regular expression "environ":
    
    Non-debugging symbols:
    0xb7fd1b00  __environ
    0xb7fd1b00  _environ
    0xb7fd1b00  environ
    
  • I need to find the /bin/bash string in that variable to launch a shell (I have already got the system and exit addresses, I only need the route to the shell). And here is where I don't know what to do. I have been reading gdb tutorials, but still nothing. x/s 0xb7fd1b00 does not output anything useful.

share|improve this question
add comment

1 Answer

up vote 6 down vote accepted

environ is a pointer to pointer, as it has the type char **environ.

You have to try something like:

(gdb) x/s *((char **)environ)
0xbffff688:      "SSH_AGENT_PID=2107"
(gdb) x/s *((char **)environ+1)
0xbffff69b:      "SHELL=/bin/bash"
share|improve this answer
    
That's it!! Thanks a lot :) I had managed to get the address just with x/s environ and TONS of "enter"s, but it wasn't very nice :P –  Palantir Mar 28 '12 at 21:29
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.