Question
Hello, I'm glad to read you write up, give men a lot of inspiration. After read you 9th level write up, I find a problem.
- You get the mapped SHELLCODE address of the getenv process as the level9 process.
Prove
The first program(first.c)
#include <stdio.h>
#include <stdlib.h>
int main(int argc, char** argv){
printf("hello, world\n");
printf("%s => %p\n", argv[1], getenv(argv[1]));
return 0;
}
The second program(second)
#include <stdlib.h>
#include <stdio.h>
int main(int argc, char *argv[]) {
printf("%s => %p\n", argv[1], getenv(argv[1]));
return 0;
}
Compile
gcc first.c -o first -m32
gcc second.c -o second -m32
Run
First
> ./first SHELLCODE
hello, world
SHELLCODE => 0xbffffd8d
Second
> ./second SHELLCODE
SHELLCODE => 0xbffffd8b
Summary
Different processes map the environment variable different memory addresses
The 9th Correct Write Up