title: Address of environment variable different for each directory
body: <p>I'm writing a return-to-libc attack. My script retrieves the system(), exit() and shell addresses as follows (it's a sh script that calls some c programs):</p>
  
  <p>Create the environment variable for the xh shell:
      <code>export egg=/bin/xh</code></p>
  
  <p>Retrieve the address of the xh shell: <code>printf("%p\n", getenv("egg"));</code></p>
  
  <p>Get the address of system(): <code>void (*system_addr)(int) = dlsym(RTLD_NEXT, "system");</code></p>
  
  <p>Get the address of exit(): <code>void (*exit_addr)(int) = dlsym(RTLD_NEXT, "exit");</code></p>
  
  <p>I then overflow the buffer with the correct amount of filler + address of <code>system()</code> + address of <code>exit()</code> + address of <code>/bin/xh</code>.</p>
  
  <p>When I run my exploit (<code>./exploit.sh</code>) the xh shell is dropped correctly. The problem is when I create a simple Makefile to run my script, I get a segmentation fault. The Makefile looks like this:</p>
  
  <pre><code>all:
  ./exploit8.sh
  </code></pre>
  
  <p>My guess is that the addresses of environment variables depend on the name with which the program is called, as is explained in <a href="https://stackoverflow.com/questions/7781494/randomization-of-environment-variable-addresses">this answer</a>. This is true because I tested changing the name of the vulnerable program and the address I had to provide depended on the (length) of the name.  </p>
  
  <p>I need a way to find the correct address of <code>egg</code> that is independent of the name of the vulnerable program. Is there an elegant way to do this instead of brute-forcing until the xh shell is dropped?</p>
  
  <p>I've also read that the addresses of <code>system()</code> and <code>exit()</code> change with <code>make</code> but I don't think that's my problem since I dynamically load the addresses in my exploit.  </p>
  
  <p><strong>EDIT</strong></p>
  
  <p>I've just tried to print the address of <code>egg</code> and then brute-forced by checking all 256*256 addresses nearby but no address hit the spot. It seems that the address of <code>egg</code> is completely different when using <code>make</code>.</p>