Shellcode parameter passing

Question

I am trying to use an environment variable to store my shellcode and then point my RET to it, so that I may get to execute my shellcode. Here is my vulnerable program 'abc.c'

#include string.h
#include stdio.h

void foo(const char* str){
 char buf[100];
 printf("\n%p\n",buf);
 strcpy(buf,str);
}
int main(int argc, const char* argv[]){

 foo(argv[1]);
}

I've been doing the following steps so far

$gcc -z execstack -fno-stack-protector -o abc abc.c 

Using getenv() inside another program I determined what the address of my shellcode was. Let us say it is some 0xbfffc209

Using $./abc $(python -c 'print "AAAA"*30') crashes my program mercilessly, but if I use an address in place of the four A's my program cleanly exits.

Using A's

Now using an address in Intel format

As can be seen nothing has been overwritten. The output of ltrace with

$ltrace ./abc $(python -c 'print "\x09\xc2\xff\xbf"*30') and also

$ltrace ./abc $(perl -e 'print "\x09\xc2\xff\xbf"*30') is

I'm totally baffled with an inexplicable behavior of this sort, and would be glad if someone can help me figure why this is happening so.

Thanks in advance

PS

1. I use an Ubuntu 14.04 32 bit VM

2. I get the same results thrown at me no matter what address I use

Answer 1

Not every character in your payload can be sent through the argv of your binary. There are some "bad characters" which you can't have in your shellcode. An example is "\x00" as you're using strcpy to copy strings and "\x00" is the delimiter for your strings. So first figure out what are the bad characters for your platform and then make a payload that is free of those bytes.

PS: I could have commented this but I only had 49 reputation.