set environment variable in GDB from output of command

Question

I am trying to exploit a buffer overflow in a challenge, the buffer gets it's value from an environment variable. In GDB I know that you can set environment variables using the command:

set environment username = test

However I need to pass the username variable special characters, so I need to do something like:

set environment username= $(echo -e '\xff\x4c......')

But that command doesn't get executed and the username variable contains literally what I wrote down, does anybody know a trick to pass special characters to an environment variable?

See also: stackoverflow.com/q/55593045/94687

imz -- Ivan Zakharyaschev
– imz -- Ivan Zakharyaschev

2020-03-06 20:53:45 +00:00
Commented Mar 6, 2020 at 20:53 — imz -- Ivan Zakharyaschev
– imz -- Ivan Zakharyaschev, Commented Mar 6, 2020 at 20:53

gavv · Accepted Answer · 2016-01-11 17:13:25Z

6

Well, if you really need to do it from GDB, here is one example:

hello.c

#include <stdlib.h>
#include <stdio.h>

int main(int argc, char** argv) {
    printf("argv[1]=%s\n", argv[1]);
    printf("VAR=%s\n", getenv("VAR"));
    return 0;
}

Example:

$ gcc -g -o hello hello.c
$ gdb ./hello
...
(gdb) set exec-wrapper bash -c 'exec env VAR="`echo myEnv`" "$@"' --
(gdb) r myArg
...
argv[1]=myArg
VAR=myEnv

Change VAR and echo myEnv to a variable and command you need.

But note that setting VAR from shell before starting GDB also works:

$ VAR=`echo Hey there` gdb ./hello
...
(gdb) r myArg
...
argv[1]=myArg
VAR=Hey there

edited Jan 11, 2016 at 17:13

answered Jan 11, 2016 at 17:07

gavv

4,9401 gold badge25 silver badges42 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

x-yuri Over a year ago

Why do you introduce an extra bash process? set exec-wrapper env VAR="`echo myEnv`" should suffice.

imz -- Ivan Zakharyaschev · Accepted Answer · 2020-03-06 20:50:48Z

1

When starting gdb from shell command-line, you can specify which program to run, with which arguments (with --args), and even modify the environment of the program with the help of env!

I just did it successfully like this:

gdb --ex=run --args env LD_BIND=now LD_DEBUG=libs \
apt-get install --yes $(cat pkgs-to-install-to-crash-apt)

--ex=run is to ask gdb to run it immediately.

answered Mar 6, 2020 at 20:50

imz -- Ivan Zakharyaschev

5,1316 gold badges56 silver badges109 bronze badges

1 Comment

x-yuri Over a year ago

In this case gdb first starts env, which exec's apt-get. If you set a breakpoint on main (or use start) and env has the main symbol, it will stop in env, not in apt-get. More details here.

Collectives™ on Stack Overflow

set environment variable in GDB from output of command

2 Answers 2

1 Comment

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related