I'm following a tutorial to write a simple buffer overflow. I have (basic) knowledge of assembly, and the stack. I've written a stack based buffer overflow before and understood it. The program I'm exploiting this time has NX enabled which means it's not possible to execute code from the stack or an environment variable. The author of this tutorial then suggests to declare an environment variable:

export $BINSH="/bin/sh"

and the payload fed to the buffer overflow will be the address of the 'system' in the program, followed by the address of the 'exit' in the program and finally the address of our environment variable:

payload is : &system - &exit - &BINSH

I've managed to get the exploit working but I don't understand the theory behind the payload. Unfortunately it's not explained in the tutorial (which can be found here).

Why do I overwrite EIP with the address to 'system' (and what does this address correspond to)?

How does putting the address to my environment variable containing /bin/sh as the third word in the payload make it execute?

PS: Linux, 32bit. intel


This is a class of attack known as return-to-libc which is a method of bypassing DEP.This works by calling existing functions in a shared library that you know is executable. In this case, the exploit calls the system() function.

Functions are passed parameters on the stack. By controlling the stack, you can control what functions are passed into the system() call. In this case, you tell system() to call whatever is in the environmental variable which you set to /bin/sh. Essentially, you are calling system(/bin/sh) which spawns a shell. Boom, exploited.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.