iExploit

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Sign In Apply for Membership

Top Posters

Who's Online (0)

Powered by Vanilla. Made with Bootstrap.
Looking to introduce yourself? Look no further, and click here! We also have IRC! [irc.evilzone.org #iexploit]
Environment variables
  • x3n0n
    Posts: 110
    Everyone knows environment variables (PATH, USER, LOGNAME, etc...)
    Well you can overwrite these variables (export <VAR>="<new content>") and that can be quite handy with buffer overflows.
    But what I find hard is after I run a program (say I did a buffer overflow) and I want to find the environment variable USER and it's content in the stack.

    I had some piece of code that supposed to get me the address (in hex):
    char *address = (char *)getenv(\"USER\");
    printf(\"Address&#58; %x\n\", &address);


    but when I look at the returned address, its all 'random' shit I don't need.

    So does anybody know how I can find the address of the env variable?

    Thx up front ;)
  • x3n0n
    Posts: 110
    nvm, figured it out ;)
  • Sh3llc0d3
    Posts: 1,910
    Guessing this was for STS :p
  • CrashOverron
    Posts: 13
    if you figured it out why dont you post the answer in case someone else has a similar problem?
  • Null Set
    Posts: 112
    Seems like it's from STS actually. :P
  • x3n0n
    Posts: 110
    Yeah, it's STS :p But I was passing on the environment variables the wrong way. Once you pass them on correctly (with execve()) they are quite easy to find ;)
  • Null Set
    Posts: 112
    said:


    if you figured it out why dont you post the answer in case someone else has a similar problem?



    People would be able to just look at this for the answer and no longer think for themselves. :P
  • x3n0n
    Posts: 110
    said:


    said:


    if you figured it out why dont you post the answer in case someone else has a similar problem?



    People would be able to just look at this for the answer and no longer think for themselves. :P


    I <3 my brainZzz :p
Add a Comment