4

I am reading a book called "Hacking: The art of exploitation" and I came across this paragraph:

With execl(), the existing environment is used, but if you use execle(), the entire environment can be specified. If the environment array is just the shellcode as the first string (with a NULL pointer to terminate the list), the only environment variable will be the shellcode. This makes its address easy to calculate. In Linux, the address will be 0xbffffffa, minus the length of the shellcode in the environment, minus the length of the name of the executed program. Since this address will be exact, there is no need for a NOP sled.

  1. What do they mean by specifying the environment?

  2. What classifies different environments?

  3. Why is the address of the environment variable calculated that way (or more specifically why is the base address 0xbffffffa)?

  4. If I used the execl() function instead of the execle() could I not have used the shellcode environment variable?

matanc1
  • 6,525
  • 6
  • 37
  • 57

2 Answers2

3

What do they mean by specifying the environment?

The last argument passed to execle() is an array of char pointers, which contain C strings describing the environment variables the executed program will see. Here is an example.

What classifies different environments?

I don't quite get this one. Each program has its own set of environment variables, that's it.

Why is the address of the environment variable calculated that way (or more specifically why is the base address 0xbffffffa)?

Because the Linux kernel is implemented like so.

If I used the execl() function instead of the execle() could I not have used the shellcode environment variable?

execl() does not let you specify environment variables, if that's what you're interested in.

  • I thought environment variable were system variables you could see by typing "env" in the terminal. So why would I need to create that array? I know that the function "getenv()" exists which will return the address of the environment variable. So what is this for? – matanc1 May 31 '13 at 21:24
  • @Shookie "I thought environment variable were system variables you could see by typing "env" in the terminal." - they are. " So why would I need to create that array?" - you don't need to. And this has nothing to do with `getenv()`. This function **sets** the environment variables. –  May 31 '13 at 21:28
0
 int execle(const char *path, const char *arg0, ...
         /* const char *argn, (char *)0,char *const envp[]*/);

The envp[] array is a pointer to all of the UNIX environment variables for the process to be created. That defines the "environment" for the new process.

jim mcnamara
  • 16,005
  • 2
  • 34
  • 51