title: Failed to get root shell while loading execl() function
body: <pre><code>#include &lt;stdio.h&gt;
  #include &lt;unistd.h&gt;
  #include &lt;string.h&gt;
  
  int good(int addr) {
      printf("Address of hmm: %p\n", addr);
  }
  
  int hmm() {
      printf("Win.\n");
      execl("/bin/sh", "sh", NULL);
  }
  
  extern char **environ;
  
  int main(int argc, char **argv) {
  
      int i, limit;
  
      for(i = 0; environ[i] != NULL; i++) 
          memset(environ[i], 0x00, strlen(environ[i]));
  
      int (*fptr)(int) = good;
      char buf[32];
  
      if(strlen(argv[1]) &lt;= 40) limit = strlen(argv[1]);
  
      for(i = 0; i &lt;= limit; i++) {
          buf[i] = argv[1][i];
          if(i &lt; 36) buf[i] = 0x41;
      }
  
      int (*hmmptr)(int) = hmm;
  
      (*fptr)((int)hmmptr);
  
      return 0;
  
  }
  </code></pre>
  
  <p>I compiled the above C program as root without any type of stack protection (gcc -fno-stack-protector -o out test.c) and exploited as normal user. I failed to get the root shell. </p>
  
  <p>This is the same code which I had exploited from 'smashthestack'.</p>