I'm following a tutorial to write a simple buffer overflow. I have (basic) knowledge of assembly, and the stack. I've written a stack based buffer overflow before and understood it. The program I'm exploiting this time has NX enabled which means it's not possible to execute code from the stack or an environment variable. The author of this tutorial then suggests to declare an environment variable:
and the payload fed to the buffer overflow will be the address of the 'system' in the program, followed by the address of the 'exit' in the program and finally the address of our environment variable:
payload is : &system - &exit - &BINSH
I've managed to get the exploit working but I don't understand the theory behind the payload. Unfortunately it's not explained in the tutorial (which can be found here).
Why do I overwrite EIP with the address to 'system' (and what does this address correspond to)?
How does putting the address to my environment variable containing /bin/sh as the third word in the payload make it execute?
PS: Linux, 32bit. intel