EnvVarSetUID.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "id": "ad2157ad-d5d7-4898-9dc7-5914736c5116",
   "metadata": {},
   "source": [
    "# Set-UID Programs and Environment Variables\n",
    "\n",
    "## Need for Privileged Programs\n",
    "\n",
    "- many system programs and configuration files are root/admin owned with restricted access to regular users\n",
    "- some of these programs need to be executed by regular users regular usage of the system\n",
    "\n",
    "## Password Dilemma\n",
    "\n",
    "- let's see the permission of `/etc/shadow` file\n",
    "- how do regular users change their password?"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "id": "2a4510a5-64ec-43f7-86ee-150ba3c8d2ef",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "-rw-r----- 1 root shadow 1505 Jan 26 15:24 /etc/shadow\n"
     ]
    }
   ],
   "source": [
    "! ls -al /etc/shadow"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "id": "3b117fe0-a3cc-4f61-9b02-18dfb0fb077c",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "getfacl: Removing leading '/' from absolute path names\n",
      "# file: etc/shadow\n",
      "# owner: root\n",
      "# group: shadow\n",
      "user::rw-\n",
      "group::r--\n",
      "other::---\n",
      "\n"
     ]
    }
   ],
   "source": [
    "! getfacl /etc/shadow"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "c42cca2c-3090-4c0a-9296-5249cc384c5e",
   "metadata": {},
   "source": [
    "## Two-Tier Approach\n",
    "\n",
    "- implementing fine-grained access control in OS make the over complicated\n",
    "    - requires major redesign/rewrite of all major OS kernels\n",
    "- OS relies on extension to enforce fine grained access control\n",
    "- privileged programs are such extensions\n",
    "\n",
    "![image.png](./media/setuid-approach.png)\n",
    "\n",
    "- there are two types of privileged programs:\n",
    "\n",
    "### Daemons\n",
    "- computer program/process that runs in the background\n",
    "- typically needs to run as root or other privileged users\n",
    "\n",
    "\n",
    "### Set-UID programs\n",
    "- widely used in \\*NIX systems\n",
    "- programs are marked with a speical bit\n",
    "\n",
    "## Setuid Programs\n",
    "\n",
    "- setuid programs are a device to allow users to acquire new priviledges for a limited amunt of time\n",
    "- they provide a meas for overriding the protection schemes designed in \\*NIX systems\n",
    "- `setuid` programs are written in a way that it provides a granual access to individual line of a protected file/resource\n",
    "- powersuit analogy - suit that gives power to whoever uses it\n",
    "- which of the following group is the power suit?\n",
    "    - superman/spiderman suit?\n",
    "    - ironman/antman suit?\n",
    "    \n",
    "- allow users to run a program with the program owner's privilege\n",
    "- the privilege is temporary while the program is being executed\n",
    "\n",
    "### Case study - passwd program\n",
    "- **passwd** program is used to change user's password\n",
    "- let's see the access control list of **passwd** program\n",
    "- note `s` in ACL and the owner:group"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "id": "28f30806-e6fb-445a-abac-0cd902e941fb",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "-rwsr-xr-x 1 root root 72344 Jan  5 19:57 /usr/bin/passwd\n"
     ]
    }
   ],
   "source": [
    "! ls -l /usr/bin/passwd"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "id": "2de2566c-78ae-484d-ba6f-4625a8b17318",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "getfacl: Removing leading '/' from absolute path names\n",
      "# file: usr/bin/passwd\n",
      "# owner: root\n",
      "# group: root\n",
      "# flags: s--\n",
      "user::rwx\n",
      "group::r-x\n",
      "other::r-x\n",
      "\n"
     ]
    }
   ],
   "source": [
    "! getfacl /usr/bin/passwd"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "5eb5536b-0cb5-4be4-90ee-38c1e9095f99",
   "metadata": {},
   "source": [
    "## Set-UID Concept\n",
    "\n",
    "- every process has two User IDs:\n",
    "\n",
    "#### Real UID (RUID)\n",
    "- identifies the real owner of the process\n",
    "\n",
    "#### Effective UID (EUID)\n",
    "- identifies privilege of a process\n",
    "- access control is based on **EUID**\n",
    "\n",
    "- when a normal program is executed, **RUID = EUID**\n",
    "    - both IDs equal to the ID of the user who runs the program\n",
    "- when a **set-uid** is executed, **RUID != EUID**\n",
    "    - RUID still equals to user's ID who runs the program\n",
    "    - EUID howover is equal to the program owner's ID\n",
    "    - if the program is owned by root, the program runs with the root privilege\n",
    "    \n",
    "### meowcat - copy cat\n",
    "- create a program that behaves like the `cat` program\n",
    "- the demo program is provided in `demos/setuid` folder\n",
    "- let's change the working diectory to `demos/setuid`\n",
    "- use jupyter notebook's magic symbol to do that: `%`"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 35,
   "id": "7e8583a9-e3e8-4db4-adac-e0ac085de95b",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "'/home/kali/SoftwareSecurity/demos/setuid'"
      ]
     },
     "execution_count": 35,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "%pwd"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "id": "551dd7af-d955-4478-8d76-c33676ac260d",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "/home/kali/SoftwareSecurity/demos/setuid\n"
     ]
    }
   ],
   "source": [
    "%cd demos/setuid"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "id": "9da04deb-36c8-48e9-8948-dcc735a297df",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Requirement already satisfied: pickleshare in /home/kali/miniconda3/lib/python3.11/site-packages (0.7.5)\n"
     ]
    }
   ],
   "source": [
    "# if you get a warning when using magic symbol...\n",
    "# UserWarning: using dhist requires you to install the `pickleshare` library.\n",
    "! pip install pickleshare"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 10,
   "id": "7f2219ed-c5e8-4925-8980-381cfedd7767",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "total 60\n",
      "drwxr-xr-x  2 kali kali  4096 Jan 31 13:23 .\n",
      "drwxr-xr-x 17 kali kali  4096 Jan 24 15:20 ..\n",
      "-rw-r--r--  1 kali kali   443 Jan 31 13:23 Makefile\n",
      "-rw-r--r--  1 kali kali    15 Jan 24 15:20 data.txt\n",
      "-rwxr-xr-x  1 kali kali 37160 Jan 24 15:20 meowcat\n",
      "-rw-r--r--  1 kali kali   911 Jan 24 15:20 meowcat.cpp\n"
     ]
    }
   ],
   "source": [
    "! ls -al"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 11,
   "id": "921cac9e-a34c-47c3-9b1a-3748e3e55a3f",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "// Program that mimics bash cat program\n",
      "#include <iostream>\n",
      "#include <cstdio>\n",
      "#include <fstream>\n",
      "#include <string>\n",
      "\n",
      "using namespace std;\n",
      "\n",
      "int main(int argc, char* argv[]) {\n",
      "    if (argc <= 1) {\n",
      "        printf(\"Usage: program <filepath>\\n\");\n",
      "        return 1;\n",
      "    }\n",
      "    ifstream fin;\n",
      "    fin.open(argv[1], fin.in | fin.binary | fin.ate);\n",
      "\n",
      "    if (!fin.is_open())\n",
      "        cout << \"Failed to open \" << argv[1] << '\\n';\n",
      "    else {\n",
      "        // findout the size of the the file; get position in input sequence\n",
      "        size_t size = fin.tellg();\n",
      "        // Set position in input sequence\n",
      "        fin.seekg(0, fin.beg);\n",
      "        // allocate memory to store file contents\n",
      "        char * buffer = new char[size];\n",
      "        \n",
      "        if (fin.read(buffer, size))\n",
      "        {\n",
      "            cout << buffer << endl;\n",
      "            // parse buffer in memory...\n",
      "        }\n",
      "        delete[] buffer;\n",
      "        fin.close();\n",
      "    }\n",
      "    return 0;\n",
      "}\n"
     ]
    }
   ],
   "source": [
    "! cat meowcat.cpp"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 36,
   "id": "f155c815-3736-4677-9fda-59a4b0a89330",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "COMPILER = g++\n",
      "\n",
      "COMPILER_FLAGS = -g -Wall -std=c++17\n",
      "\n",
      "# the build target executable program name of your choice\n",
      "PROGRAM_NAME = meowcat\n",
      "\n",
      "# list all .cpp files separated by space; files must exist!\n",
      "CPP_FILES = meowcat.cpp\n",
      "\n",
      ".PHONY: build\n",
      "build:\n",
      "\t$(COMPILER) $(COMPILER_FLAGS) $(CPP_FILES) -o $(PROGRAM_NAME)\n",
      "\t# # make clean ruleudo chown root:root $(PROGRAM_NAME)\n",
      "\t# sudo chmod +s $(PROGRAM_NAME)\n",
      "\n",
      ".PHONY: clean\n",
      "clean:\n",
      "\trm -f $(PROGRAM_NAME) *.o\n"
     ]
    }
   ],
   "source": [
    "! cat Makefile"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 37,
   "id": "c9818387-14f8-400b-bd57-dca7ec5f314f",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "g++ -g -Wall -std=c++17 meowcat.cpp -o meowcat\n",
      "# # make clean ruleudo chown root:root meowcat\n",
      "# sudo chmod +s meowcat\n"
     ]
    }
   ],
   "source": [
    "! make"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 14,
   "id": "64e0a29f-b12a-4a26-b220-85f9cf45ea28",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Usage: program <filepath>\n"
     ]
    }
   ],
   "source": [
    "! ./meowcat"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 40,
   "id": "722f9908-0d47-4299-8577-d387a40fce90",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "total 60\n",
      "drwxr-xr-x  2 kali kali  4096 Feb  2 15:09 .\n",
      "drwxr-xr-x 17 kali kali  4096 Jan 24 15:20 ..\n",
      "-rw-r--r--  1 kali kali   443 Jan 31 13:23 Makefile\n",
      "-rw-r--r--  1 kali kali    15 Jan 31 15:46 data.txt\n",
      "-rwxr-xr-x  1 kali kali 37152 Feb  2 15:09 meowcat\n",
      "-rw-r--r--  1 kali kali   911 Jan 24 15:20 meowcat.cpp\n"
     ]
    }
   ],
   "source": [
    "! ls -al"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 41,
   "id": "1c9ede62-8f17-4e5e-8ea0-b3899dda2227",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "# file: meowcat\n",
      "# owner: kali\n",
      "# group: kali\n",
      "user::rwx\n",
      "group::r-x\n",
      "other::r-x\n",
      "\n"
     ]
    }
   ],
   "source": [
    "! getfacl meowcat"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 42,
   "id": "50c4b4b3-c292-46fc-970e-831ec7bebaed",
   "metadata": {},
   "outputs": [],
   "source": [
    "! echo \"hello there...\" > data.txt"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 43,
   "id": "70648265-effb-4f9d-9476-ca8b3222d062",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "hello there...\n"
     ]
    }
   ],
   "source": [
    "! cat data.txt"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 44,
   "id": "b43c295f-3b55-48c0-b78b-a0c116953f33",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "hello there...\n",
      "\n"
     ]
    }
   ],
   "source": [
    "! ./meowcat data.txt"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 45,
   "id": "b217ec78-c36e-4200-969c-fdfc122247e2",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Failed to open /etc/shadow\n"
     ]
    }
   ],
   "source": [
    "! ./meowcat /etc/shadow"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 19,
   "id": "4e635fb1-1d9e-40c3-a18c-346eecbb72a9",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "total 60\n",
      "drwxr-xr-x  2 kali kali  4096 Jan 31 15:45 .\n",
      "drwxr-xr-x 17 kali kali  4096 Jan 24 15:20 ..\n",
      "-rw-r--r--  1 kali kali   443 Jan 31 13:23 Makefile\n",
      "-rw-r--r--  1 kali kali    15 Jan 31 15:46 data.txt\n",
      "-rwxr-xr-x  1 kali kali 37152 Jan 31 15:45 meowcat\n",
      "-rw-r--r--  1 kali kali   911 Jan 24 15:20 meowcat.cpp\n"
     ]
    }
   ],
   "source": [
    "! ls -al "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 47,
   "id": "30236fc2-656e-4717-9e53-d99a32f0335a",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "getfacl: Removing leading '/' from absolute path names\n",
      "# file: usr/bin/sudo\n",
      "# owner: root\n",
      "# group: root\n",
      "# flags: s--\n",
      "user::rwx\n",
      "group::r-x\n",
      "other::r-x\n",
      "\n"
     ]
    }
   ],
   "source": [
    "! getfacl $(which sudo)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 48,
   "id": "767c55d0-1f8d-4031-b912-b2268d78c030",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "[sudo] password for kali: "
     ]
    }
   ],
   "source": [
    "# let's set the ownership of the program to root to setuid\n",
    "! echo kali | sudo -S chown root meowcat"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 49,
   "id": "e0abeb2f-259f-462b-8e73-9bd92294e037",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "-rwxr-xr-x 1 root kali 37152 Feb  2 15:09 meowcat\n"
     ]
    }
   ],
   "source": [
    "! ls -al meowcat"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 50,
   "id": "ebbeeac8-9c01-4d5b-919a-183a298070bc",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "# file: meowcat\n",
      "# owner: root\n",
      "# group: kali\n",
      "user::rwx\n",
      "group::r-x\n",
      "other::r-x\n",
      "\n"
     ]
    }
   ],
   "source": [
    "! getfacl meowcat"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 51,
   "id": "7ac23b57-537f-4982-91e4-fe917948fe86",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "[sudo] password for kali: "
     ]
    }
   ],
   "source": [
    "# let's setuid chmod 4755\n",
    "! echo kali | sudo -S chmod u+s meowcat"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 52,
   "id": "fb61abfe-049e-4774-bf9d-de0c76c041f9",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "-rwsr-xr-x 1 root kali 37152 Feb  2 15:09 meowcat\n"
     ]
    }
   ],
   "source": [
    "! ls -al meowcat"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 54,
   "id": "c0302d6f-40d4-4403-adac-ed317536f83f",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "hello there...\n"
     ]
    }
   ],
   "source": [
    "! cat data.txt"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 56,
   "id": "7f04a49f-c4a7-4f50-8a5e-9c9dbf8b3016",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "zsh:1: no such file or directory: ./meowcata\n"
     ]
    }
   ],
   "source": [
    "! ./meowcata data.txt"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 57,
   "id": "1385eccd-86c2-4ba5-add0-5cf670083f76",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "[sudo] password for kali: "
     ]
    }
   ],
   "source": [
    "# if the owner isn't root or privileged user, the program is setuid but NOT privilege\n",
    "! echo kali | sudo -S chown user meowcat"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 58,
   "id": "f3ac687a-4660-468c-97c9-95593b9bf732",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "-rwxr-xr-x 1 user kali 37152 Feb  2 15:09 meowcat\n"
     ]
    }
   ],
   "source": [
    "! ls -al meowcat"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 59,
   "id": "f1080572-f09b-4e64-8826-218b7ce75577",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "[sudo] password for kali: "
     ]
    }
   ],
   "source": [
    "! echo kali | sudo -S chmod 4777 meowcat"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 60,
   "id": "5de2b8c8-c797-45e7-aedf-c54700698b13",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "-rwsrwxrwx 1 user kali 37152 Feb  2 15:09 meowcat\n"
     ]
    }
   ],
   "source": [
    "! ls -al meowcat"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 61,
   "id": "a721e313-ab88-4fdb-9dcf-c85ddac22d39",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Failed to open /etc/shadow\n"
     ]
    }
   ],
   "source": [
    "! ./meowcat /etc/shadow"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "7e35a56b-3bbf-4cf8-937b-f1198dfdbee7",
   "metadata": {},
   "source": [
    "## What programs need setuid?\n",
    "\n",
    "- programs that require to access sensitive, system-wide data, files, configs, etc.\n",
    "- is it safe to setuid every programs?\n",
    "    - /bin/cat, /bin/sh, nano, vi, etc.\n"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "e5ab0abb-6011-48f9-a199-a2bfe31e44d5",
   "metadata": {},
   "source": [
    "## Environment Variables\n",
    "\n",
    "- environment variables are integral part of all OS\n",
    "- these are dynamic values that can have significant influence over the behavior of programs and processes\n",
    "- these variables are outside the program that store configuration or settings and their values can be changed without modifying the programs' actual code \n",
    "- one of the most important `env` variable is `PATH`\n",
    "    - PATH stores the locations to search for various binaries, libraries, and executable programs\n",
    "- programs and scripts can access environment variables to adapt their behavior based on the configuration and requirements of the system they're being executed\n",
    "- OSes provide various ways to set and access environment variables\n",
    "- system APIs are available to programming languages to access and set environment variables in the programs\n",
    "- in Linux, env variables play important roles when using Terminals to run programs\n",
    "- `env` or `printenv` commands list all the environment variables available to the current user\n",
    "- variable names are case sensitive\n",
    "- normally ALL_CAPS are used for env variable names"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "5783724d-32d9-4dc0-9123-f59f24189f51",
   "metadata": {},
   "outputs": [],
   "source": [
    "#! /usr/bin/env python\n",
    "\n",
    "print ('hello world')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 64,
   "id": "06370f2a-fe7d-4908-a94f-bba93b8b3dca",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Python 3.11.7 | packaged by conda-forge | (main, Dec 23 2023, 14:43:09) [GCC 12.3.0] on linux\n",
      "Type \"help\", \"copyright\", \"credits\" or \"license\" for more information.\n",
      ">>> \n",
      "Traceback (most recent call last):\n",
      "  File \"<stdin>\", line 0, in <module>\n",
      "KeyboardInterrupt\n",
      ">>> "
     ]
    }
   ],
   "source": [
    "! /usr/bin/env python"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "e83b134a-9342-4ceb-8e4c-19ea1bcd0069",
   "metadata": {},
   "source": [
    "### Setting and Accessing Environment Variables\n",
    "\n",
    "- env variables can be set in many places depending on the needs\n",
    "\n",
    "1. System wide\n",
    "    - /etc/environment\n",
    "    - /etc/profile\n",
    "2. User specific\n",
    "    - ~/.profile\n",
    "    - ~/.bashrc\n",
    "    - ~/.zshrc"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 65,
   "id": "c80d786a-9bb1-464e-a1e0-ca57054e87b1",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "# START KALI-DEFAULTS CONFIG\n",
      "# Everything from here and until STOP KALI-DEFAULTS CONFIG\n",
      "# was installed by the kali-defaults package, and it will\n",
      "# be removed if ever the kali-defaults package is removed.\n",
      "# If you want to disable a line, please do NOT remove it,\n",
      "# as it would be added back when kali-defaults is upgraded.\n",
      "# Instead, comment the line out, and your change will be\n",
      "# preserved across upgrades.\n",
      "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/local/games:/usr/games\n",
      "COMMAND_NOT_FOUND_INSTALL_PROMPT=1\n",
      "POWERSHELL_UPDATECHECK=Off\n",
      "POWERSHELL_TELEMETRY_OPTOUT=1\n",
      "DOTNET_CLI_TELEMETRY_OPTOUT=1\n",
      "# STOP KALI-DEFAULTS CONFIG\n"
     ]
    }
   ],
   "source": [
    "! cat /etc/environment"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 67,
   "id": "e28e6c7f-94f3-4075-a063-840d483f1ea9",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "/home/kali\n"
     ]
    }
   ],
   "source": [
    "! echo $HOME"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 68,
   "id": "852024e9-36b0-424d-98b7-105afe152058",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "# ~/.zshrc file for zsh interactive shells.\n",
      "# see /usr/share/doc/zsh/examples/zshrc for examples\n",
      "\n",
      "setopt autocd              # change directory just by typing its name\n",
      "#setopt correct            # auto correct mistakes\n",
      "setopt interactivecomments # allow comments in interactive mode\n",
      "setopt magicequalsubst     # enable filename expansion for arguments of the form ‘anything=expression’\n",
      "setopt nonomatch           # hide error message if there is no match for the pattern\n",
      "setopt notify              # report the status of background jobs immediately\n",
      "setopt numericglobsort     # sort filenames numerically when it makes sense\n",
      "setopt promptsubst         # enable command substitution in prompt\n",
      "\n",
      "WORDCHARS=${WORDCHARS//\\/} # Don't consider certain characters part of the word\n",
      "\n",
      "# hide EOL sign ('%')\n",
      "PROMPT_EOL_MARK=\"\"\n",
      "\n",
      "# configure key keybindings\n",
      "bindkey -e                                        # emacs key bindings\n",
      "bindkey ' ' magic-space                           # do history expansion on space\n",
      "bindkey '^U' backward-kill-line                   # ctrl + U\n",
      "bindkey '^[[3;5~' kill-word                       # ctrl + Supr\n",
      "bindkey '^[[3~' delete-char                       # delete\n",
      "bindkey '^[[1;5C' forward-word                    # ctrl + ->\n",
      "bindkey '^[[1;5D' backward-word                   # ctrl + <-\n",
      "bindkey '^[[5~' beginning-of-buffer-or-history    # page up\n",
      "bindkey '^[[6~' end-of-buffer-or-history          # page down\n",
      "bindkey '^[[H' beginning-of-line                  # home\n",
      "bindkey '^[[F' end-of-line                        # end\n",
      "bindkey '^[[Z' undo                               # shift + tab undo last action\n",
      "\n",
      "# enable completion features\n",
      "autoload -Uz compinit\n",
      "compinit -d ~/.cache/zcompdump\n",
      "zstyle ':completion:*:*:*:*:*' menu select\n",
      "zstyle ':completion:*' auto-description 'specify: %d'\n",
      "zstyle ':completion:*' completer _expand _complete\n",
      "zstyle ':completion:*' format 'Completing %d'\n",
      "zstyle ':completion:*' group-name ''\n",
      "zstyle ':completion:*' list-colors ''\n",
      "zstyle ':completion:*' list-prompt %SAt %p: Hit TAB for more, or the character to insert%s\n",
      "zstyle ':completion:*' matcher-list 'm:{a-zA-Z}={A-Za-z}'\n",
      "zstyle ':completion:*' rehash true\n",
      "zstyle ':completion:*' select-prompt %SScrolling active: current selection at %p%s\n",
      "zstyle ':completion:*' use-compctl false\n",
      "zstyle ':completion:*' verbose true\n",
      "zstyle ':completion:*:kill:*' command 'ps -u $USER -o pid,%cpu,tty,cputime,cmd'\n",
      "\n",
      "# History configurations\n",
      "HISTFILE=~/.zsh_history\n",
      "HISTSIZE=1000\n",
      "SAVEHIST=2000\n",
      "setopt hist_expire_dups_first # delete duplicates first when HISTFILE size exceeds HISTSIZE\n",
      "setopt hist_ignore_dups       # ignore duplicated commands history list\n",
      "setopt hist_ignore_space      # ignore commands that start with space\n",
      "setopt hist_verify            # show command with history expansion to user before running it\n",
      "#setopt share_history         # share command history data\n",
      "\n",
      "# force zsh to show the complete history\n",
      "alias history=\"history 0\"\n",
      "\n",
      "# configure `time` format\n",
      "TIMEFMT=$'\\nreal\\t%E\\nuser\\t%U\\nsys\\t%S\\ncpu\\t%P'\n",
      "\n",
      "# make less more friendly for non-text input files, see lesspipe(1)\n",
      "#[ -x /usr/bin/lesspipe ] && eval \"$(SHELL=/bin/sh lesspipe)\"\n",
      "\n",
      "# set variable identifying the chroot you work in (used in the prompt below)\n",
      "if [ -z \"${debian_chroot:-}\" ] && [ -r /etc/debian_chroot ]; then\n",
      "    debian_chroot=$(cat /etc/debian_chroot)\n",
      "fi\n",
      "\n",
      "# set a fancy prompt (non-color, unless we know we \"want\" color)\n",
      "case \"$TERM\" in\n",
      "    xterm-color|*-256color) color_prompt=yes;;\n",
      "esac\n",
      "\n",
      "# uncomment for a colored prompt, if the terminal has the capability; turned\n",
      "# off by default to not distract the user: the focus in a terminal window\n",
      "# should be on the output of commands, not on the prompt\n",
      "force_color_prompt=yes\n",
      "\n",
      "if [ -n \"$force_color_prompt\" ]; then\n",
      "    if [ -x /usr/bin/tput ] && tput setaf 1 >&/dev/null; then\n",
      "        # We have color support; assume it's compliant with Ecma-48\n",
      "        # (ISO/IEC-6429). (Lack of such support is extremely rare, and such\n",
      "        # a case would tend to support setf rather than setaf.)\n",
      "        color_prompt=yes\n",
      "    else\n",
      "        color_prompt=\n",
      "    fi\n",
      "fi\n",
      "\n",
      "configure_prompt() {\n",
      "    prompt_symbol=㉿\n",
      "    # Skull emoji for root terminal\n",
      "    #[ \"$EUID\" -eq 0 ] && prompt_symbol=💀\n",
      "    case \"$PROMPT_ALTERNATIVE\" in\n",
      "        twoline)\n",
      "            PROMPT=$'%F{%(#.blue.green)}┌──${debian_chroot:+($debian_chroot)─}${VIRTUAL_ENV:+($(basename $VIRTUAL_ENV))─}(%B%F{%(#.red.blue)}%n'$prompt_symbol$'%m%b%F{%(#.blue.green)})-[%B%F{reset}%(6~.%-1~/…/%4~.%5~)%b%F{%(#.blue.green)}]\\n└─%B%(#.%F{red}#.%F{blue}$)%b%F{reset} '\n",
      "            # Right-side prompt with exit codes and background processes\n",
      "            #RPROMPT=$'%(?.. %? %F{red}%B⨯%b%F{reset})%(1j. %j %F{yellow}%B⚙%b%F{reset}.)'\n",
      "            ;;\n",
      "        oneline)\n",
      "            PROMPT=$'${debian_chroot:+($debian_chroot)}${VIRTUAL_ENV:+($(basename $VIRTUAL_ENV))}%B%F{%(#.red.blue)}%n@%m%b%F{reset}:%B%F{%(#.blue.green)}%~%b%F{reset}%(#.#.$) '\n",
      "            RPROMPT=\n",
      "            ;;\n",
      "        backtrack)\n",
      "            PROMPT=$'${debian_chroot:+($debian_chroot)}${VIRTUAL_ENV:+($(basename $VIRTUAL_ENV))}%B%F{red}%n@%m%b%F{reset}:%B%F{blue}%~%b%F{reset}%(#.#.$) '\n",
      "            RPROMPT=\n",
      "            ;;\n",
      "    esac\n",
      "    unset prompt_symbol\n",
      "}\n",
      "\n",
      "# The following block is surrounded by two delimiters.\n",
      "# These delimiters must not be modified. Thanks.\n",
      "# START KALI CONFIG VARIABLES\n",
      "PROMPT_ALTERNATIVE=twoline\n",
      "NEWLINE_BEFORE_PROMPT=yes\n",
      "# STOP KALI CONFIG VARIABLES\n",
      "\n",
      "if [ \"$color_prompt\" = yes ]; then\n",
      "    # override default virtualenv indicator in prompt\n",
      "    VIRTUAL_ENV_DISABLE_PROMPT=1\n",
      "\n",
      "    configure_prompt\n",
      "\n",
      "    # enable syntax-highlighting\n",
      "    if [ -f /usr/share/zsh-syntax-highlighting/zsh-syntax-highlighting.zsh ]; then\n",
      "        . /usr/share/zsh-syntax-highlighting/zsh-syntax-highlighting.zsh\n",
      "        ZSH_HIGHLIGHT_HIGHLIGHTERS=(main brackets pattern)\n",
      "        ZSH_HIGHLIGHT_STYLES[default]=none\n",
      "        ZSH_HIGHLIGHT_STYLES[unknown-token]=underline\n",
      "        ZSH_HIGHLIGHT_STYLES[reserved-word]=fg=cyan,bold\n",
      "        ZSH_HIGHLIGHT_STYLES[suffix-alias]=fg=green,underline\n",
      "        ZSH_HIGHLIGHT_STYLES[global-alias]=fg=green,bold\n",
      "        ZSH_HIGHLIGHT_STYLES[precommand]=fg=green,underline\n",
      "        ZSH_HIGHLIGHT_STYLES[commandseparator]=fg=blue,bold\n",
      "        ZSH_HIGHLIGHT_STYLES[autodirectory]=fg=green,underline\n",
      "        ZSH_HIGHLIGHT_STYLES[path]=bold\n",
      "        ZSH_HIGHLIGHT_STYLES[path_pathseparator]=\n",
      "        ZSH_HIGHLIGHT_STYLES[path_prefix_pathseparator]=\n",
      "        ZSH_HIGHLIGHT_STYLES[globbing]=fg=blue,bold\n",
      "        ZSH_HIGHLIGHT_STYLES[history-expansion]=fg=blue,bold\n",
      "        ZSH_HIGHLIGHT_STYLES[command-substitution]=none\n",
      "        ZSH_HIGHLIGHT_STYLES[command-substitution-delimiter]=fg=magenta,bold\n",
      "        ZSH_HIGHLIGHT_STYLES[process-substitution]=none\n",
      "        ZSH_HIGHLIGHT_STYLES[process-substitution-delimiter]=fg=magenta,bold\n",
      "        ZSH_HIGHLIGHT_STYLES[single-hyphen-option]=fg=green\n",
      "        ZSH_HIGHLIGHT_STYLES[double-hyphen-option]=fg=green\n",
      "        ZSH_HIGHLIGHT_STYLES[back-quoted-argument]=none\n",
      "        ZSH_HIGHLIGHT_STYLES[back-quoted-argument-delimiter]=fg=blue,bold\n",
      "        ZSH_HIGHLIGHT_STYLES[single-quoted-argument]=fg=yellow\n",
      "        ZSH_HIGHLIGHT_STYLES[double-quoted-argument]=fg=yellow\n",
      "        ZSH_HIGHLIGHT_STYLES[dollar-quoted-argument]=fg=yellow\n",
      "        ZSH_HIGHLIGHT_STYLES[rc-quote]=fg=magenta\n",
      "        ZSH_HIGHLIGHT_STYLES[dollar-double-quoted-argument]=fg=magenta,bold\n",
      "        ZSH_HIGHLIGHT_STYLES[back-double-quoted-argument]=fg=magenta,bold\n",
      "        ZSH_HIGHLIGHT_STYLES[back-dollar-quoted-argument]=fg=magenta,bold\n",
      "        ZSH_HIGHLIGHT_STYLES[assign]=none\n",
      "        ZSH_HIGHLIGHT_STYLES[redirection]=fg=blue,bold\n",
      "        ZSH_HIGHLIGHT_STYLES[comment]=fg=black,bold\n",
      "        ZSH_HIGHLIGHT_STYLES[named-fd]=none\n",
      "        ZSH_HIGHLIGHT_STYLES[numeric-fd]=none\n",
      "        ZSH_HIGHLIGHT_STYLES[arg0]=fg=cyan\n",
      "        ZSH_HIGHLIGHT_STYLES[bracket-error]=fg=red,bold\n",
      "        ZSH_HIGHLIGHT_STYLES[bracket-level-1]=fg=blue,bold\n",
      "        ZSH_HIGHLIGHT_STYLES[bracket-level-2]=fg=green,bold\n",
      "        ZSH_HIGHLIGHT_STYLES[bracket-level-3]=fg=magenta,bold\n",
      "        ZSH_HIGHLIGHT_STYLES[bracket-level-4]=fg=yellow,bold\n",
      "        ZSH_HIGHLIGHT_STYLES[bracket-level-5]=fg=cyan,bold\n",
      "        ZSH_HIGHLIGHT_STYLES[cursor-matchingbracket]=standout\n",
      "    fi\n",
      "else\n",
      "    PROMPT='${debian_chroot:+($debian_chroot)}%n@%m:%~%(#.#.$) '\n",
      "fi\n",
      "unset color_prompt force_color_prompt\n",
      "\n",
      "toggle_oneline_prompt(){\n",
      "    if [ \"$PROMPT_ALTERNATIVE\" = oneline ]; then\n",
      "        PROMPT_ALTERNATIVE=twoline\n",
      "    else\n",
      "        PROMPT_ALTERNATIVE=oneline\n",
      "    fi\n",
      "    configure_prompt\n",
      "    zle reset-prompt\n",
      "}\n",
      "zle -N toggle_oneline_prompt\n",
      "bindkey ^P toggle_oneline_prompt\n",
      "\n",
      "# If this is an xterm set the title to user@host:dir\n",
      "case \"$TERM\" in\n",
      "xterm*|rxvt*|Eterm|aterm|kterm|gnome*|alacritty)\n",
      "    TERM_TITLE=$'\\e]0;${debian_chroot:+($debian_chroot)}${VIRTUAL_ENV:+($(basename $VIRTUAL_ENV))}%n@%m: %~\\a'\n",
      "    ;;\n",
      "*)\n",
      "    ;;\n",
      "esac\n",
      "\n",
      "precmd() {\n",
      "    # Print the previously configured title\n",
      "    print -Pnr -- \"$TERM_TITLE\"\n",
      "\n",
      "    # Print a new line before the prompt, but only if it is not the first line\n",
      "    if [ \"$NEWLINE_BEFORE_PROMPT\" = yes ]; then\n",
      "        if [ -z \"$_NEW_LINE_BEFORE_PROMPT\" ]; then\n",
      "            _NEW_LINE_BEFORE_PROMPT=1\n",
      "        else\n",
      "            print \"\"\n",
      "        fi\n",
      "    fi\n",
      "}\n",
      "\n",
      "# enable color support of ls, less and man, and also add handy aliases\n",
      "if [ -x /usr/bin/dircolors ]; then\n",
      "    test -r ~/.dircolors && eval \"$(dircolors -b ~/.dircolors)\" || eval \"$(dircolors -b)\"\n",
      "    export LS_COLORS=\"$LS_COLORS:ow=30;44:\" # fix ls color for folders with 777 permissions\n",
      "\n",
      "    alias ls='ls --color=auto'\n",
      "    #alias dir='dir --color=auto'\n",
      "    #alias vdir='vdir --color=auto'\n",
      "\n",
      "    alias grep='grep --color=auto'\n",
      "    alias fgrep='fgrep --color=auto'\n",
      "    alias egrep='egrep --color=auto'\n",
      "    alias diff='diff --color=auto'\n",
      "    alias ip='ip --color=auto'\n",
      "\n",
      "    export LESS_TERMCAP_mb=$'\\E[1;31m'     # begin blink\n",
      "    export LESS_TERMCAP_md=$'\\E[1;36m'     # begin bold\n",
      "    export LESS_TERMCAP_me=$'\\E[0m'        # reset bold/blink\n",
      "    export LESS_TERMCAP_so=$'\\E[01;33m'    # begin reverse video\n",
      "    export LESS_TERMCAP_se=$'\\E[0m'        # reset reverse video\n",
      "    export LESS_TERMCAP_us=$'\\E[1;32m'     # begin underline\n",
      "    export LESS_TERMCAP_ue=$'\\E[0m'        # reset underline\n",
      "\n",
      "    # Take advantage of $LS_COLORS for completion as well\n",
      "    zstyle ':completion:*' list-colors \"${(s.:.)LS_COLORS}\"\n",
      "    zstyle ':completion:*:*:kill:*:processes' list-colors '=(#b) #([0-9]#)*=0=01;31'\n",
      "fi\n",
      "\n",
      "# some more ls aliases\n",
      "alias ll='ls -l'\n",
      "alias la='ls -A'\n",
      "alias l='ls -CF'\n",
      "\n",
      "# enable auto-suggestions based on the history\n",
      "if [ -f /usr/share/zsh-autosuggestions/zsh-autosuggestions.zsh ]; then\n",
      "    . /usr/share/zsh-autosuggestions/zsh-autosuggestions.zsh\n",
      "    # change suggestion color\n",
      "    ZSH_AUTOSUGGEST_HIGHLIGHT_STYLE='fg=#999'\n",
      "fi\n",
      "\n",
      "# enable command-not-found if installed\n",
      "if [ -f /etc/zsh_command_not_found ]; then\n",
      "    . /etc/zsh_command_not_found\n",
      "fi\n",
      "\n",
      "# >>> conda initialize >>>\n",
      "# !! Contents within this block are managed by 'conda init' !!\n",
      "__conda_setup=\"$('/home/kali/miniconda3/bin/conda' 'shell.zsh' 'hook' 2> /dev/null)\"\n",
      "if [ $? -eq 0 ]; then\n",
      "    eval \"$__conda_setup\"\n",
      "else\n",
      "    if [ -f \"/home/kali/miniconda3/etc/profile.d/conda.sh\" ]; then\n",
      "        . \"/home/kali/miniconda3/etc/profile.d/conda.sh\"\n",
      "    else\n",
      "        export PATH=\"/home/kali/miniconda3/bin:$PATH\"\n",
      "    fi\n",
      "fi\n",
      "unset __conda_setup\n",
      "# <<< conda initialize <<<\n",
      "\n"
     ]
    }
   ],
   "source": [
    "! cat $HOME/.zshrc"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 69,
   "id": "6e504b03-3b68-4afe-8c49-6f3720d910a0",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "/home/kali/miniconda3/bin:/home/kali/miniconda3/condabin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/local/games:/usr/games\n"
     ]
    }
   ],
   "source": [
    "! echo $PATH"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "4c0dd990-0e63-4db4-9e34-b8381e1daa4b",
   "metadata": {},
   "source": [
    "### Types of Env Variables\n",
    "\n",
    "#### shell variable\n",
    "- like local variables in programs; available to the current shell until it's terminated\n",
    "- can't have trailing and leading space around the '=' sign unlike in many programming languages\n",
    "- space is a special character -- word/command separater -- in bash scripting\n",
    "\n",
    "```bash\n",
    "VAR_NAME=\"VALUE...\"\n",
    "```\n",
    "\n",
    "#### environment or system variables\n",
    "- like global variables; they can be available system-wide across the Terminals\n",
    "- temporary env variable can be exported from the Terminal and availble only to that Terminal\n",
    "- permenant env variables are exported from init script such as `~/.zshrc` everytime a Terminal is launched\n",
    "\n",
    "```bash\n",
    "export VAR[=\"VALUE...\"]\n",
    "set VAR1=\"some other values\"\n",
    "```\n",
    "\n",
    "- can't create shell and environemnt variables from Jupyter Notebooks\n",
    "- use Terminal instead...\n",
    "- add `$` before the variable name when reading the value"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 70,
   "id": "ee111a57-78af-4567-9e3c-ece31628c2f2",
   "metadata": {},
   "outputs": [],
   "source": [
    "! VAR=test"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 71,
   "id": "fa74474f-0540-4d30-8aa2-65c0ee2c59ef",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\n"
     ]
    }
   ],
   "source": [
    "! echo $VAR"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "515b1768-170c-4d14-a763-521556fb475f",
   "metadata": {},
   "source": [
    "```bash\n",
    "(base) ┌──(kali㉿kali)-[~/projects/SoftwareSecurity/demos/setuid]\n",
    "└─$ VAR=\"Some data\"\n",
    "                                                                                                     \n",
    "(base) ┌──(kali㉿kali)-[~/projects/SoftwareSecurity/demos/setuid]\n",
    "└─$ echo $VAR            \n",
    "Some data\n",
    "\n",
    "(base) ┌──(kali㉿kali)-[~/projects/SoftwareSecurity/demos/setuid]\n",
    "└─$ cd             \n",
    "                                                                                                     \n",
    "(base) ┌──(kali㉿kali)-[~]\n",
    "└─$ echo $VAR\n",
    "Some data\n",
    "\n",
    "(base) ┌──(kali㉿kali)-[~]\n",
    "└─$ export VAR\n",
    "                                                                                                     \n",
    "(base) ┌──(kali㉿kali)-[~]\n",
    "└─$ env | grep VAR\n",
    "VAR=Some data\n",
    "```"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "2a5db768-c9e1-44fe-80f3-f0a98f5c2989",
   "metadata": {},
   "source": [
    "### Update existing env variable\n",
    "\n",
    "- sometime we may need to temporarily and dynamically add a new path to the PATH variable\n",
    "\n",
    "```bash\n",
    "(base) ┌──(kali㉿kali)-[~]\n",
    "└─$ PATH=$PATH:$HOME/bin\n",
    "                                                                                                     \n",
    "(base) ┌──(kali㉿kali)-[~]\n",
    "└─$ export PATH \n",
    "\n",
    "# one liner\n",
    "(base) ┌──(kali㉿kali)-[~]\n",
    "└─$ export PATH=$PATH:$HOME/bin\n",
    "\n",
    "(base) ┌──(kali㉿kali)-[~]\n",
    "└─$ env | grep ^PATH=\n",
    "PATH=/home/kali/miniconda3/bin:/home/kali/miniconda3/condabin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/local/games:/usr/games:/home/kali//home/kali/bin\n",
    "```\n",
    "\n",
    "### Delete environment variables\n",
    "\n",
    "- can use `unset` command or assign empty value to temporarily delete them\n",
    "- can update the corresponding setting files to permanently delete them\n",
    "\n",
    "```\n",
    "unset NAME\n",
    "NAME=\"\"\n",
    "```\n",
    "\n",
    "# How to access environment variables from C/C++ programs\n",
    "\n",
    "- you can pass `*char []` to the main as the third argument\n",
    "- you can use global varaiable `environ`\n",
    "- you can use system API such as `getenv(var_name)`, `putenv()`, `setenv(), unsetenv()`, etc.\n",
    "- let's see how they works\n",
    "- example codes provided in `demos/envvars` folder"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "id": "aaff19b4-11b2-4f8f-814a-913f2a5bc5e3",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "'/home/kali/projects/SoftwareSecurity'"
      ]
     },
     "execution_count": 1,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "%pwd"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "id": "56892645-51c8-47e7-b71c-1297662d4a51",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "/home/kali/projects/SoftwareSecurity/demos/envvars\n"
     ]
    }
   ],
   "source": [
    "%cd demos/envvars"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "id": "3455ef74-3a3a-4d9f-aadd-f83434c2a99e",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "#include <cstdio>\n",
      "\n",
      "// envp[] can only be used within the main program \n",
      "// needs to be passsed to other functions as needed\n",
      "int main(int argc, char* argv[], char* envp[]) {\n",
      "    printf(\"Total argument count = %d\\n\", argc);\n",
      "    for(int i=0; i < argc; i++){\n",
      "        printf(\"arg[%d] = %s\\n\", i, argv[i]);\n",
      "    }\n",
      "    printf(\"Now printing environment variables accessing envp array:\\n\");\n",
      "    int i = 0;\n",
      "    while (envp[i] != NULL) {\n",
      "        printf(\"%s\\n\", envp[i++]);\n",
      "    }\n",
      "    return 0;\n",
      "}"
     ]
    }
   ],
   "source": [
    "! cat pass_env.cpp"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "id": "bcd0d1bc-0e47-463a-b125-899106727a0d",
   "metadata": {},
   "outputs": [],
   "source": [
    "! g++ -o pass_env pass_env.cpp"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "id": "8ccdaf5e-4468-4d3c-9d84-263d61012605",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Total argument count = 4\n",
      "arg[0] = ./pass_env\n",
      "arg[1] = hi\n",
      "arg[2] = there\n",
      "arg[3] = world!\n",
      "Now printing environment variables accessing envp array:\n",
      "SHELL=/usr/bin/zsh\n",
      "SESSION_MANAGER=local/kali:@/tmp/.ICE-unix/1083,unix/kali:/tmp/.ICE-unix/1083\n",
      "WINDOWID=0\n",
      "QT_ACCESSIBILITY=1\n",
      "COLORTERM=truecolor\n",
      "GCC_RANLIB=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-gcc-ranlib\n",
      "XDG_CONFIG_DIRS=/etc/xdg\n",
      "XDG_SESSION_PATH=/org/freedesktop/DisplayManager/Session0\n",
      "XDG_MENU_PREFIX=xfce-\n",
      "CONDA_EXE=/home/kali/miniconda3/bin/conda\n",
      "_CE_M=\n",
      "build_alias=x86_64-conda-linux-gnu\n",
      "CMAKE_ARGS=-DCMAKE_AR=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-ar -DCMAKE_CXX_COMPILER_AR=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-gcc-ar -DCMAKE_C_COMPILER_AR=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-gcc-ar -DCMAKE_RANLIB=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-ranlib -DCMAKE_CXX_COMPILER_RANLIB=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-gcc-ranlib -DCMAKE_C_COMPILER_RANLIB=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-gcc-ranlib -DCMAKE_LINKER=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-ld -DCMAKE_STRIP=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-strip\n",
      "POWERSHELL_UPDATECHECK=Off\n",
      "LANGUAGE=\n",
      "LESS_TERMCAP_se=\u001b[0m\n",
      "GPROF=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-gprof\n",
      "LESS_TERMCAP_so=\u001b[01;33m\n",
      "POWERSHELL_TELEMETRY_OPTOUT=1\n",
      "CONDA_TOOLCHAIN_BUILD=x86_64-conda-linux-gnu\n",
      "_CONDA_PYTHON_SYSCONFIGDATA_NAME=_sysconfigdata_x86_64_conda_cos6_linux_gnu\n",
      "SSH_AUTH_SOCK=/tmp/ssh-7Cod7ftLpH3C/agent.1083\n",
      "DOTNET_CLI_TELEMETRY_OPTOUT=1\n",
      "STRINGS=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-strings\n",
      "CPP=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-cpp\n",
      "DESKTOP_SESSION=lightdm-xsession\n",
      "SSH_AGENT_PID=1134\n",
      "XML_CATALOG_FILES=file:///home/kali/miniconda3/etc/xml/catalog file:///etc/xml/catalog\n",
      "GTK_MODULES=gail:atk-bridge\n",
      "XDG_SEAT=seat0\n",
      "PWD=/home/kali/projects/SoftwareSecurity/demos/envvars\n",
      "XDG_SESSION_DESKTOP=lightdm-xsession\n",
      "LOGNAME=kali\n",
      "QT_QPA_PLATFORMTHEME=qt5ct\n",
      "XDG_SESSION_TYPE=x11\n",
      "CONDA_PREFIX=/home/kali/miniconda3\n",
      "PANEL_GDK_CORE_DEVICE_EVENTS=0\n",
      "CXX=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-c++\n",
      "CXXFLAGS=-fvisibility-inlines-hidden -std=c++17 -fmessage-length=0 -march=nocona -mtune=haswell -ftree-vectorize -fPIC -fstack-protector-strong -fno-plt -O2 -ffunction-sections -pipe -isystem /home/kali/miniconda3/include\n",
      "XAUTHORITY=/home/kali/.Xauthority\n",
      "CONDA_TOOLCHAIN_HOST=x86_64-conda-linux-gnu\n",
      "XDG_GREETER_DATA_DIR=/var/lib/lightdm/data/kali\n",
      "DEBUG_CXXFLAGS=-fvisibility-inlines-hidden -std=c++17 -fmessage-length=0 -march=nocona -mtune=haswell -ftree-vectorize -fPIC -fstack-protector-all -fno-plt -Og -g -Wall -Wextra -fvar-tracking-assignments -ffunction-sections -pipe -isystem /home/kali/miniconda3/include\n",
      "COMMAND_NOT_FOUND_INSTALL_PROMPT=1\n",
      "LDFLAGS=-Wl,-O2 -Wl,--sort-common -Wl,--as-needed -Wl,-z,relro -Wl,-z,now -Wl,--disable-new-dtags -Wl,--gc-sections -Wl,--allow-shlib-undefined -Wl,-rpath,/home/kali/miniconda3/lib -Wl,-rpath-link,/home/kali/miniconda3/lib -L/home/kali/miniconda3/lib\n",
      "HOME=/home/kali\n",
      "LANG=C.UTF-8\n",
      "MESON_ARGS=--buildtype release\n",
      "DEBUG_CFLAGS=-march=nocona -mtune=haswell -ftree-vectorize -fPIC -fstack-protector-all -fno-plt -Og -g -Wall -Wextra -fvar-tracking-assignments -ffunction-sections -pipe -isystem /home/kali/miniconda3/include\n",
      "LS_COLORS=rs=0:di=01;34:ln=01;36:mh=00:pi=40;33:so=01;35:do=01;35:bd=40;33;01:cd=40;33;01:or=40;31;01:mi=00:su=37;41:sg=30;43:ca=00:tw=30;42:ow=34;42:st=37;44:ex=01;32:*.tar=01;31:*.tgz=01;31:*.arc=01;31:*.arj=01;31:*.taz=01;31:*.lha=01;31:*.lz4=01;31:*.lzh=01;31:*.lzma=01;31:*.tlz=01;31:*.txz=01;31:*.tzo=01;31:*.t7z=01;31:*.zip=01;31:*.z=01;31:*.dz=01;31:*.gz=01;31:*.lrz=01;31:*.lz=01;31:*.lzo=01;31:*.xz=01;31:*.zst=01;31:*.tzst=01;31:*.bz2=01;31:*.bz=01;31:*.tbz=01;31:*.tbz2=01;31:*.tz=01;31:*.deb=01;31:*.rpm=01;31:*.jar=01;31:*.war=01;31:*.ear=01;31:*.sar=01;31:*.rar=01;31:*.alz=01;31:*.ace=01;31:*.zoo=01;31:*.cpio=01;31:*.7z=01;31:*.rz=01;31:*.cab=01;31:*.wim=01;31:*.swm=01;31:*.dwm=01;31:*.esd=01;31:*.avif=01;35:*.jpg=01;35:*.jpeg=01;35:*.mjpg=01;35:*.mjpeg=01;35:*.gif=01;35:*.bmp=01;35:*.pbm=01;35:*.pgm=01;35:*.ppm=01;35:*.tga=01;35:*.xbm=01;35:*.xpm=01;35:*.tif=01;35:*.tiff=01;35:*.png=01;35:*.svg=01;35:*.svgz=01;35:*.mng=01;35:*.pcx=01;35:*.mov=01;35:*.mpg=01;35:*.mpeg=01;35:*.m2v=01;35:*.mkv=01;35:*.webm=01;35:*.webp=01;35:*.ogm=01;35:*.mp4=01;35:*.m4v=01;35:*.mp4v=01;35:*.vob=01;35:*.qt=01;35:*.nuv=01;35:*.wmv=01;35:*.asf=01;35:*.rm=01;35:*.rmvb=01;35:*.flc=01;35:*.avi=01;35:*.fli=01;35:*.flv=01;35:*.gl=01;35:*.dl=01;35:*.xcf=01;35:*.xwd=01;35:*.yuv=01;35:*.cgm=01;35:*.emf=01;35:*.ogv=01;35:*.ogx=01;35:*.aac=00;36:*.au=00;36:*.flac=00;36:*.m4a=00;36:*.mid=00;36:*.midi=00;36:*.mka=00;36:*.mp3=00;36:*.mpc=00;36:*.ogg=00;36:*.ra=00;36:*.wav=00;36:*.oga=00;36:*.opus=00;36:*.spx=00;36:*.xspf=00;36:*~=00;90:*#=00;90:*.bak=00;90:*.crdownload=00;90:*.dpkg-dist=00;90:*.dpkg-new=00;90:*.dpkg-old=00;90:*.dpkg-tmp=00;90:*.old=00;90:*.orig=00;90:*.part=00;90:*.rej=00;90:*.rpmnew=00;90:*.rpmorig=00;90:*.rpmsave=00;90:*.swp=00;90:*.tmp=00;90:*.ucf-dist=00;90:*.ucf-new=00;90:*.ucf-old=00;90::ow=30;44:\n",
      "XDG_CURRENT_DESKTOP=XFCE\n",
      "CXX_FOR_BUILD=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-c++\n",
      "CONDA_BACKUP_HOST=kali\n",
      "ELFEDIT=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-elfedit\n",
      "CONDA_PROMPT_MODIFIER=(base) \n",
      "CMAKE_PREFIX_PATH=/home/kali/miniconda3:/home/kali/miniconda3/x86_64-conda-linux-gnu/sysroot/usr\n",
      "XDG_SEAT_PATH=/org/freedesktop/DisplayManager/Seat0\n",
      "CPPFLAGS=-DNDEBUG -D_FORTIFY_SOURCE=2 -O2 -isystem /home/kali/miniconda3/include\n",
      "LD=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-ld\n",
      "READELF=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-readelf\n",
      "GXX=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-g++\n",
      "GCC_AR=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-gcc-ar\n",
      "ADDR2LINE=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-addr2line\n",
      "XDG_SESSION_CLASS=user\n",
      "TERM=xterm-color\n",
      "LESS_TERMCAP_mb=\u001b[1;31m\n",
      "LESS_TERMCAP_me=\u001b[0m\n",
      "LESS_TERMCAP_md=\u001b[1;36m\n",
      "_CE_CONDA=\n",
      "GCC_NM=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-gcc-nm\n",
      "SIZE=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-size\n",
      "HOST=x86_64-conda-linux-gnu\n",
      "CC_FOR_BUILD=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-cc\n",
      "USER=kali\n",
      "COLORFGBG=15;0\n",
      "CONDA_SHLVL=1\n",
      "AR=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-ar\n",
      "AS=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-as\n",
      "DEBUG_CPPFLAGS=-D_DEBUG -D_FORTIFY_SOURCE=2 -Og -isystem /home/kali/miniconda3/include\n",
      "host_alias=x86_64-conda-linux-gnu\n",
      "DISPLAY=:0.0\n",
      "LESS_TERMCAP_ue=\u001b[0m\n",
      "SHLVL=2\n",
      "NM=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-nm\n",
      "LESS_TERMCAP_us=\u001b[1;32m\n",
      "GCC=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-gcc\n",
      "XDG_VTNR=7\n",
      "XDG_SESSION_ID=2\n",
      "LD_GOLD=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-ld.gold\n",
      "CONDA_PYTHON_EXE=/home/kali/miniconda3/bin/python\n",
      "XDG_RUNTIME_DIR=/run/user/1000\n",
      "CONDA_DEFAULT_ENV=base\n",
      "OBJCOPY=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-objcopy\n",
      "STRIP=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-strip\n",
      "QT_AUTO_SCREEN_SCALE_FACTOR=0\n",
      "XDG_DATA_DIRS=/usr/share/xfce4:/usr/local/share/:/usr/share/:/usr/share\n",
      "OBJDUMP=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-objdump\n",
      "PATH=/home/kali/miniconda3/bin:/home/kali/miniconda3/condabin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/local/games:/usr/games\n",
      "CC=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-cc\n",
      "GDMSESSION=lightdm-xsession\n",
      "CFLAGS=-march=nocona -mtune=haswell -ftree-vectorize -fPIC -fstack-protector-strong -fno-plt -O2 -ffunction-sections -pipe -isystem /home/kali/miniconda3/include\n",
      "CXXFILT=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-c++filt\n",
      "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus\n",
      "BUILD=x86_64-conda-linux-gnu\n",
      "_JAVA_OPTIONS=-Dawt.useSystemAAFontSettings=on -Dswing.aatext=true\n",
      "RANLIB=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-ranlib\n",
      "CONDA_BUILD_SYSROOT=/home/kali/miniconda3/x86_64-conda-linux-gnu/sysroot\n",
      "OLDPWD=/home/kali/projects/SoftwareSecurity/demos/envvars\n",
      "_=/home/kali/projects/SoftwareSecurity/demos/envvars/./pass_env\n",
      "PYDEVD_USE_FRAME_EVAL=NO\n",
      "JPY_SESSION_NAME=ca5d2bce-67a5-464e-9812-13b7ab6a184d\n",
      "JPY_PARENT_PID=791209\n",
      "CLICOLOR=1\n",
      "FORCE_COLOR=1\n",
      "CLICOLOR_FORCE=1\n",
      "PAGER=cat\n",
      "GIT_PAGER=cat\n",
      "MPLBACKEND=module://matplotlib_inline.backend_inline\n"
     ]
    }
   ],
   "source": [
    "! ./pass_env hi there world!"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "id": "3b40eb6b-235d-4a87-aa1c-5a4f0c516979",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "#include <cstdio>\n",
      "\n",
      "extern char** environ;\n",
      "\n",
      "int main(int argc, char* argv[]) {\n",
      "    int i = 0;\n",
      "    while (environ[i] != NULL) {\n",
      "        printf(\"%s\\n\", environ[i++]);\n",
      "    }\n",
      "    return 0;\n",
      "}\n"
     ]
    }
   ],
   "source": [
    "! cat global_env.cpp"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "id": "74cde797-f16a-42b9-a456-3520e3a314fa",
   "metadata": {},
   "outputs": [],
   "source": [
    "! g++ -o global_env global_env.cpp"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "id": "39174164-3245-4e7b-b29a-e658310ec70f",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "SHELL=/usr/bin/zsh\n",
      "SESSION_MANAGER=local/kali:@/tmp/.ICE-unix/1083,unix/kali:/tmp/.ICE-unix/1083\n",
      "WINDOWID=0\n",
      "QT_ACCESSIBILITY=1\n",
      "COLORTERM=truecolor\n",
      "GCC_RANLIB=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-gcc-ranlib\n",
      "XDG_CONFIG_DIRS=/etc/xdg\n",
      "XDG_SESSION_PATH=/org/freedesktop/DisplayManager/Session0\n",
      "XDG_MENU_PREFIX=xfce-\n",
      "CONDA_EXE=/home/kali/miniconda3/bin/conda\n",
      "_CE_M=\n",
      "build_alias=x86_64-conda-linux-gnu\n",
      "CMAKE_ARGS=-DCMAKE_AR=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-ar -DCMAKE_CXX_COMPILER_AR=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-gcc-ar -DCMAKE_C_COMPILER_AR=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-gcc-ar -DCMAKE_RANLIB=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-ranlib -DCMAKE_CXX_COMPILER_RANLIB=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-gcc-ranlib -DCMAKE_C_COMPILER_RANLIB=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-gcc-ranlib -DCMAKE_LINKER=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-ld -DCMAKE_STRIP=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-strip\n",
      "POWERSHELL_UPDATECHECK=Off\n",
      "LANGUAGE=\n",
      "LESS_TERMCAP_se=\u001b[0m\n",
      "GPROF=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-gprof\n",
      "LESS_TERMCAP_so=\u001b[01;33m\n",
      "POWERSHELL_TELEMETRY_OPTOUT=1\n",
      "CONDA_TOOLCHAIN_BUILD=x86_64-conda-linux-gnu\n",
      "_CONDA_PYTHON_SYSCONFIGDATA_NAME=_sysconfigdata_x86_64_conda_cos6_linux_gnu\n",
      "SSH_AUTH_SOCK=/tmp/ssh-7Cod7ftLpH3C/agent.1083\n",
      "DOTNET_CLI_TELEMETRY_OPTOUT=1\n",
      "STRINGS=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-strings\n",
      "CPP=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-cpp\n",
      "DESKTOP_SESSION=lightdm-xsession\n",
      "SSH_AGENT_PID=1134\n",
      "XML_CATALOG_FILES=file:///home/kali/miniconda3/etc/xml/catalog file:///etc/xml/catalog\n",
      "GTK_MODULES=gail:atk-bridge\n",
      "XDG_SEAT=seat0\n",
      "PWD=/home/kali/projects/SoftwareSecurity/demos/envvars\n",
      "XDG_SESSION_DESKTOP=lightdm-xsession\n",
      "LOGNAME=kali\n",
      "QT_QPA_PLATFORMTHEME=qt5ct\n",
      "XDG_SESSION_TYPE=x11\n",
      "CONDA_PREFIX=/home/kali/miniconda3\n",
      "PANEL_GDK_CORE_DEVICE_EVENTS=0\n",
      "CXX=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-c++\n",
      "CXXFLAGS=-fvisibility-inlines-hidden -std=c++17 -fmessage-length=0 -march=nocona -mtune=haswell -ftree-vectorize -fPIC -fstack-protector-strong -fno-plt -O2 -ffunction-sections -pipe -isystem /home/kali/miniconda3/include\n",
      "XAUTHORITY=/home/kali/.Xauthority\n",
      "CONDA_TOOLCHAIN_HOST=x86_64-conda-linux-gnu\n",
      "XDG_GREETER_DATA_DIR=/var/lib/lightdm/data/kali\n",
      "DEBUG_CXXFLAGS=-fvisibility-inlines-hidden -std=c++17 -fmessage-length=0 -march=nocona -mtune=haswell -ftree-vectorize -fPIC -fstack-protector-all -fno-plt -Og -g -Wall -Wextra -fvar-tracking-assignments -ffunction-sections -pipe -isystem /home/kali/miniconda3/include\n",
      "COMMAND_NOT_FOUND_INSTALL_PROMPT=1\n",
      "LDFLAGS=-Wl,-O2 -Wl,--sort-common -Wl,--as-needed -Wl,-z,relro -Wl,-z,now -Wl,--disable-new-dtags -Wl,--gc-sections -Wl,--allow-shlib-undefined -Wl,-rpath,/home/kali/miniconda3/lib -Wl,-rpath-link,/home/kali/miniconda3/lib -L/home/kali/miniconda3/lib\n",
      "HOME=/home/kali\n",
      "LANG=C.UTF-8\n",
      "MESON_ARGS=--buildtype release\n",
      "DEBUG_CFLAGS=-march=nocona -mtune=haswell -ftree-vectorize -fPIC -fstack-protector-all -fno-plt -Og -g -Wall -Wextra -fvar-tracking-assignments -ffunction-sections -pipe -isystem /home/kali/miniconda3/include\n",
      "LS_COLORS=rs=0:di=01;34:ln=01;36:mh=00:pi=40;33:so=01;35:do=01;35:bd=40;33;01:cd=40;33;01:or=40;31;01:mi=00:su=37;41:sg=30;43:ca=00:tw=30;42:ow=34;42:st=37;44:ex=01;32:*.tar=01;31:*.tgz=01;31:*.arc=01;31:*.arj=01;31:*.taz=01;31:*.lha=01;31:*.lz4=01;31:*.lzh=01;31:*.lzma=01;31:*.tlz=01;31:*.txz=01;31:*.tzo=01;31:*.t7z=01;31:*.zip=01;31:*.z=01;31:*.dz=01;31:*.gz=01;31:*.lrz=01;31:*.lz=01;31:*.lzo=01;31:*.xz=01;31:*.zst=01;31:*.tzst=01;31:*.bz2=01;31:*.bz=01;31:*.tbz=01;31:*.tbz2=01;31:*.tz=01;31:*.deb=01;31:*.rpm=01;31:*.jar=01;31:*.war=01;31:*.ear=01;31:*.sar=01;31:*.rar=01;31:*.alz=01;31:*.ace=01;31:*.zoo=01;31:*.cpio=01;31:*.7z=01;31:*.rz=01;31:*.cab=01;31:*.wim=01;31:*.swm=01;31:*.dwm=01;31:*.esd=01;31:*.avif=01;35:*.jpg=01;35:*.jpeg=01;35:*.mjpg=01;35:*.mjpeg=01;35:*.gif=01;35:*.bmp=01;35:*.pbm=01;35:*.pgm=01;35:*.ppm=01;35:*.tga=01;35:*.xbm=01;35:*.xpm=01;35:*.tif=01;35:*.tiff=01;35:*.png=01;35:*.svg=01;35:*.svgz=01;35:*.mng=01;35:*.pcx=01;35:*.mov=01;35:*.mpg=01;35:*.mpeg=01;35:*.m2v=01;35:*.mkv=01;35:*.webm=01;35:*.webp=01;35:*.ogm=01;35:*.mp4=01;35:*.m4v=01;35:*.mp4v=01;35:*.vob=01;35:*.qt=01;35:*.nuv=01;35:*.wmv=01;35:*.asf=01;35:*.rm=01;35:*.rmvb=01;35:*.flc=01;35:*.avi=01;35:*.fli=01;35:*.flv=01;35:*.gl=01;35:*.dl=01;35:*.xcf=01;35:*.xwd=01;35:*.yuv=01;35:*.cgm=01;35:*.emf=01;35:*.ogv=01;35:*.ogx=01;35:*.aac=00;36:*.au=00;36:*.flac=00;36:*.m4a=00;36:*.mid=00;36:*.midi=00;36:*.mka=00;36:*.mp3=00;36:*.mpc=00;36:*.ogg=00;36:*.ra=00;36:*.wav=00;36:*.oga=00;36:*.opus=00;36:*.spx=00;36:*.xspf=00;36:*~=00;90:*#=00;90:*.bak=00;90:*.crdownload=00;90:*.dpkg-dist=00;90:*.dpkg-new=00;90:*.dpkg-old=00;90:*.dpkg-tmp=00;90:*.old=00;90:*.orig=00;90:*.part=00;90:*.rej=00;90:*.rpmnew=00;90:*.rpmorig=00;90:*.rpmsave=00;90:*.swp=00;90:*.tmp=00;90:*.ucf-dist=00;90:*.ucf-new=00;90:*.ucf-old=00;90::ow=30;44:\n",
      "XDG_CURRENT_DESKTOP=XFCE\n",
      "CXX_FOR_BUILD=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-c++\n",
      "CONDA_BACKUP_HOST=kali\n",
      "ELFEDIT=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-elfedit\n",
      "CONDA_PROMPT_MODIFIER=(base) \n",
      "CMAKE_PREFIX_PATH=/home/kali/miniconda3:/home/kali/miniconda3/x86_64-conda-linux-gnu/sysroot/usr\n",
      "XDG_SEAT_PATH=/org/freedesktop/DisplayManager/Seat0\n",
      "CPPFLAGS=-DNDEBUG -D_FORTIFY_SOURCE=2 -O2 -isystem /home/kali/miniconda3/include\n",
      "LD=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-ld\n",
      "READELF=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-readelf\n",
      "GXX=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-g++\n",
      "GCC_AR=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-gcc-ar\n",
      "ADDR2LINE=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-addr2line\n",
      "XDG_SESSION_CLASS=user\n",
      "TERM=xterm-color\n",
      "LESS_TERMCAP_mb=\u001b[1;31m\n",
      "LESS_TERMCAP_me=\u001b[0m\n",
      "LESS_TERMCAP_md=\u001b[1;36m\n",
      "_CE_CONDA=\n",
      "GCC_NM=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-gcc-nm\n",
      "SIZE=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-size\n",
      "HOST=x86_64-conda-linux-gnu\n",
      "CC_FOR_BUILD=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-cc\n",
      "USER=kali\n",
      "COLORFGBG=15;0\n",
      "CONDA_SHLVL=1\n",
      "AR=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-ar\n",
      "AS=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-as\n",
      "DEBUG_CPPFLAGS=-D_DEBUG -D_FORTIFY_SOURCE=2 -Og -isystem /home/kali/miniconda3/include\n",
      "host_alias=x86_64-conda-linux-gnu\n",
      "DISPLAY=:0.0\n",
      "LESS_TERMCAP_ue=\u001b[0m\n",
      "SHLVL=2\n",
      "NM=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-nm\n",
      "LESS_TERMCAP_us=\u001b[1;32m\n",
      "GCC=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-gcc\n",
      "XDG_VTNR=7\n",
      "XDG_SESSION_ID=2\n",
      "LD_GOLD=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-ld.gold\n",
      "CONDA_PYTHON_EXE=/home/kali/miniconda3/bin/python\n",
      "XDG_RUNTIME_DIR=/run/user/1000\n",
      "CONDA_DEFAULT_ENV=base\n",
      "OBJCOPY=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-objcopy\n",
      "STRIP=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-strip\n",
      "QT_AUTO_SCREEN_SCALE_FACTOR=0\n",
      "XDG_DATA_DIRS=/usr/share/xfce4:/usr/local/share/:/usr/share/:/usr/share\n",
      "OBJDUMP=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-objdump\n",
      "PATH=/home/kali/miniconda3/bin:/home/kali/miniconda3/condabin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/local/games:/usr/games\n",
      "CC=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-cc\n",
      "GDMSESSION=lightdm-xsession\n",
      "CFLAGS=-march=nocona -mtune=haswell -ftree-vectorize -fPIC -fstack-protector-strong -fno-plt -O2 -ffunction-sections -pipe -isystem /home/kali/miniconda3/include\n",
      "CXXFILT=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-c++filt\n",
      "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus\n",
      "BUILD=x86_64-conda-linux-gnu\n",
      "_JAVA_OPTIONS=-Dawt.useSystemAAFontSettings=on -Dswing.aatext=true\n",
      "RANLIB=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-ranlib\n",
      "CONDA_BUILD_SYSROOT=/home/kali/miniconda3/x86_64-conda-linux-gnu/sysroot\n",
      "OLDPWD=/home/kali/projects/SoftwareSecurity/demos/envvars\n",
      "_=/home/kali/projects/SoftwareSecurity/demos/envvars/./global_env\n",
      "PYDEVD_USE_FRAME_EVAL=NO\n",
      "JPY_SESSION_NAME=ca5d2bce-67a5-464e-9812-13b7ab6a184d\n",
      "JPY_PARENT_PID=791209\n",
      "CLICOLOR=1\n",
      "FORCE_COLOR=1\n",
      "CLICOLOR_FORCE=1\n",
      "PAGER=cat\n",
      "GIT_PAGER=cat\n",
      "MPLBACKEND=module://matplotlib_inline.backend_inline\n"
     ]
    }
   ],
   "source": [
    "! ./global_env"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 10,
   "id": "2c37c1b6-e84c-4ab8-b9d8-cbfdad27bd2d",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "#include <cstdio>\n",
      "#include <stdlib.h> // getenv, putenv, setenv, unsetenv, etc.\n",
      "// see: http://www.manpagez.com/man/3/getenv/\n",
      "\n",
      "int main(int argc, char* argv[]) {\n",
      "  if (argc == 2) {\n",
      "    // read value of env variable\n",
      "    //getenv(char * name) retruns NUL-terminated string; if name doesn't exists, returns NULL\n",
      "    printf(\"%s=%s\\n\", argv[1], getenv(argv[1]));\n",
      "  }\n",
      "  else if (argc == 3) { \n",
      "    // set env variable, 0 doesn't overwrite, 1 overwrites\n",
      "    int result = setenv(argv[1], argv[2], 0); // returns 0 on successful, -1 otherwise\n",
      "    if (result == 0) {\n",
      "      printf(\"Successfully set env variable!\\n\");\n",
      "      printf(\"%s=%s\\n\", argv[1], getenv(argv[1]));\n",
      "      // you can't use setenv to export variables from current process to the calling process (shell)\n",
      "    }\n",
      "    else {\n",
      "      printf(\"Couldn't set env variable!\");\n",
      "    }\n",
      "  }\n",
      "  else {\n",
      "    printf(\"%s\\n\", \"Usage READ: program ENV_VAR_NAME\");\n",
      "    printf(\"%s\\n\", \"Usage SET: program ENV_VAR_NAME VALUE\");\n",
      "  }\n",
      "  return 0;\n",
      "}\n"
     ]
    }
   ],
   "source": [
    "! cat get_set_env.cpp"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 11,
   "id": "54fc835b-970a-41da-8e37-d97a05b8fbdf",
   "metadata": {},
   "outputs": [],
   "source": [
    "! g++ -o get_set_env get_set_env.cpp"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 13,
   "id": "e5b999fe-83bf-4c27-a14a-967a0e104697",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "PATH=/home/kali/miniconda3/bin:/home/kali/miniconda3/condabin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/local/games:/usr/games\n"
     ]
    }
   ],
   "source": [
    "! ./get_set_env PATH"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 14,
   "id": "90b9032c-eb99-4409-a548-023da34b6f66",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Successfully set env variable!\n",
      "TEST=HELLO THERE\n"
     ]
    }
   ],
   "source": [
    "! ./get_set_env TEST \"HELLO THERE\""
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 15,
   "id": "703077fe-1b6a-41a9-83d2-a785935eaf9d",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "TEST=(null)\n"
     ]
    }
   ],
   "source": [
    "# rerunning the program doesn't find the newly set environement variable\n",
    "# the program is rerun everytime...\n",
    "! ./get_set_env TEST"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "40d94905-4da5-483a-8525-443457b4c893",
   "metadata": {},
   "source": [
    "## How a process gets its environment variables\n",
    "\n",
    "- one of the two ways\n",
    "- if a new process is created using `fork()`, the parent process copies and passes its environment variables to the child process\n",
    "- if a process runs a new process in itself (using `execve()`), the processe's environment variable is overwritten by the new env vars provided to the new process\n",
    "    - current environment variables are essentially lost/overwritten\n",
    "- `execve()` system API has 3 parameters\n",
    "    - `filename, argv, envp`\n",
    "- https://man7.org/linux/man-pages/man2/execve.2.html\n",
    "\n",
    "```cpp\n",
    "execv(const char* filename, char *const argv[], char *const envp[]);\n",
    "```\n",
    "- let's see how `execve` can pass the env variables to processes"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 23,
   "id": "b09f1b03-96c9-4170-9486-b707980d3814",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "#include <cstdio>\n",
      "#include <unistd.h>\n",
      "\n",
      "extern char** environ;\n",
      "\n",
      "int main(int argc, char* argv[], char* envp[]) {\n",
      "    int i = 0;\n",
      "    char* arg[2];\n",
      "    char* newenv[3];\n",
      "    if (argc < 2) {\n",
      "        printf(\"Missing required argument 1, 2, 3\");\n",
      "        printf(\"Usage: ./execve_passenv [1/2/3]\");\n",
      "        return 1;\n",
      "    }\n",
      "\n",
      "    // construct the argument array\n",
      "    arg[0] = \"/usr/bin/env\"; arg[1] = NULL;\n",
      "\n",
      "    // construct the environment variable array\n",
      "    newenv[0] = \"AAA=aaa\";\n",
      "    newenv[1] = \"BBB=123\";\n",
      "    newenv[2] = NULL;\n",
      "    switch(argv[1][0]) {\n",
      "        case '1': // passing no env variable\n",
      "            execve(arg[0], arg, NULL);\n",
      "            break;\n",
      "        case '2': // passing new env variables\n",
      "            execve(arg[0], arg, newenv); \n",
      "            break;\n",
      "        case '3': // passing current env variables\n",
      "            execve(arg[0], arg, environ);\n",
      "            break;\n",
      "        default: // passing no env variable\n",
      "            execve(arg[0], arg, NULL);\n",
      "    }\n",
      "\n",
      "}\n"
     ]
    }
   ],
   "source": [
    "! cat execve_passenv.cpp"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 24,
   "id": "be331593-5a57-4a31-9933-8f0d05f3bdaf",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\u001b[01m\u001b[Kexecve_passenv.cpp:\u001b[m\u001b[K In function ‘\u001b[01m\u001b[Kint\u001b[01;32m\u001b[K main\u001b[m\u001b[K(int, char**, char**)\u001b[m\u001b[K’:\n",
      "\u001b[01m\u001b[Kexecve_passenv.cpp:17:14:\u001b[m\u001b[K \u001b[01;35m\u001b[Kwarning: \u001b[m\u001b[KISO C++ forbids converting a string constant to ‘\u001b[01m\u001b[Kchar*\u001b[m\u001b[K’ [\u001b[01;35m\u001b[K\u001b]8;;https://gcc.gnu.org/onlinedocs/gcc/Warning-Options.html#index-Wwrite-strings\u0007-Wwrite-strings\u001b]8;;\u0007\u001b[m\u001b[K]\n",
      "   17 |     arg[0] = \u001b[01;35m\u001b[K\"/usr/bin/env\"\u001b[m\u001b[K; arg[1] = NULL;\n",
      "      |              \u001b[01;35m\u001b[K^~~~~~~~~~~~~~\u001b[m\u001b[K\n",
      "\u001b[01m\u001b[Kexecve_passenv.cpp:20:17:\u001b[m\u001b[K \u001b[01;35m\u001b[Kwarning: \u001b[m\u001b[KISO C++ forbids converting a string constant to ‘\u001b[01m\u001b[Kchar*\u001b[m\u001b[K’ [\u001b[01;35m\u001b[K\u001b]8;;https://gcc.gnu.org/onlinedocs/gcc/Warning-Options.html#index-Wwrite-strings\u0007-Wwrite-strings\u001b]8;;\u0007\u001b[m\u001b[K]\n",
      "   20 |     newenv[0] = \u001b[01;35m\u001b[K\"AAA=aaa\"\u001b[m\u001b[K;\n",
      "      |                 \u001b[01;35m\u001b[K^~~~~~~~~\u001b[m\u001b[K\n",
      "\u001b[01m\u001b[Kexecve_passenv.cpp:21:17:\u001b[m\u001b[K \u001b[01;35m\u001b[Kwarning: \u001b[m\u001b[KISO C++ forbids converting a string constant to ‘\u001b[01m\u001b[Kchar*\u001b[m\u001b[K’ [\u001b[01;35m\u001b[K\u001b]8;;https://gcc.gnu.org/onlinedocs/gcc/Warning-Options.html#index-Wwrite-strings\u0007-Wwrite-strings\u001b]8;;\u0007\u001b[m\u001b[K]\n",
      "   21 |     newenv[1] = \u001b[01;35m\u001b[K\"BBB=123\"\u001b[m\u001b[K;\n",
      "      |                 \u001b[01;35m\u001b[K^~~~~~~~~\u001b[m\u001b[K\n"
     ]
    }
   ],
   "source": [
    "! g++ -o execve_passenv execve_passenv.cpp"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 25,
   "id": "835eb11c-bd49-4df5-a42f-1c45c5d0d155",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Missing required argument 1, 2, 3Usage: ./execve_passenv [1/2/3]"
     ]
    }
   ],
   "source": [
    "# no envvariables are printed for default and option 1\n",
    "! ./execve_passenv"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 26,
   "id": "f9d25141-d0e9-43cb-93cf-0e300f114583",
   "metadata": {},
   "outputs": [],
   "source": [
    "! ./execve_passenv 1"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 27,
   "id": "b516277f-cf6a-45b2-837a-f197c0ed5d1e",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "AAA=aaa\n",
      "BBB=123\n"
     ]
    }
   ],
   "source": [
    "! ./execve_passenv 2"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 28,
   "id": "ab7a2fdc-2080-43e9-9f19-ed39de3c54ab",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "SHELL=/usr/bin/zsh\n",
      "SESSION_MANAGER=local/kali:@/tmp/.ICE-unix/1083,unix/kali:/tmp/.ICE-unix/1083\n",
      "WINDOWID=0\n",
      "QT_ACCESSIBILITY=1\n",
      "COLORTERM=truecolor\n",
      "GCC_RANLIB=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-gcc-ranlib\n",
      "XDG_CONFIG_DIRS=/etc/xdg\n",
      "XDG_SESSION_PATH=/org/freedesktop/DisplayManager/Session0\n",
      "XDG_MENU_PREFIX=xfce-\n",
      "CONDA_EXE=/home/kali/miniconda3/bin/conda\n",
      "_CE_M=\n",
      "build_alias=x86_64-conda-linux-gnu\n",
      "CMAKE_ARGS=-DCMAKE_AR=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-ar -DCMAKE_CXX_COMPILER_AR=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-gcc-ar -DCMAKE_C_COMPILER_AR=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-gcc-ar -DCMAKE_RANLIB=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-ranlib -DCMAKE_CXX_COMPILER_RANLIB=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-gcc-ranlib -DCMAKE_C_COMPILER_RANLIB=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-gcc-ranlib -DCMAKE_LINKER=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-ld -DCMAKE_STRIP=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-strip\n",
      "POWERSHELL_UPDATECHECK=Off\n",
      "LANGUAGE=\n",
      "LESS_TERMCAP_se=\u001b[0m\n",
      "GPROF=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-gprof\n",
      "LESS_TERMCAP_so=\u001b[01;33m\n",
      "POWERSHELL_TELEMETRY_OPTOUT=1\n",
      "CONDA_TOOLCHAIN_BUILD=x86_64-conda-linux-gnu\n",
      "_CONDA_PYTHON_SYSCONFIGDATA_NAME=_sysconfigdata_x86_64_conda_cos6_linux_gnu\n",
      "SSH_AUTH_SOCK=/tmp/ssh-7Cod7ftLpH3C/agent.1083\n",
      "DOTNET_CLI_TELEMETRY_OPTOUT=1\n",
      "STRINGS=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-strings\n",
      "CPP=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-cpp\n",
      "DESKTOP_SESSION=lightdm-xsession\n",
      "SSH_AGENT_PID=1134\n",
      "XML_CATALOG_FILES=file:///home/kali/miniconda3/etc/xml/catalog file:///etc/xml/catalog\n",
      "GTK_MODULES=gail:atk-bridge\n",
      "XDG_SEAT=seat0\n",
      "PWD=/home/kali/projects/SoftwareSecurity/demos/envvars\n",
      "XDG_SESSION_DESKTOP=lightdm-xsession\n",
      "LOGNAME=kali\n",
      "QT_QPA_PLATFORMTHEME=qt5ct\n",
      "XDG_SESSION_TYPE=x11\n",
      "CONDA_PREFIX=/home/kali/miniconda3\n",
      "PANEL_GDK_CORE_DEVICE_EVENTS=0\n",
      "CXX=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-c++\n",
      "CXXFLAGS=-fvisibility-inlines-hidden -std=c++17 -fmessage-length=0 -march=nocona -mtune=haswell -ftree-vectorize -fPIC -fstack-protector-strong -fno-plt -O2 -ffunction-sections -pipe -isystem /home/kali/miniconda3/include\n",
      "XAUTHORITY=/home/kali/.Xauthority\n",
      "CONDA_TOOLCHAIN_HOST=x86_64-conda-linux-gnu\n",
      "XDG_GREETER_DATA_DIR=/var/lib/lightdm/data/kali\n",
      "DEBUG_CXXFLAGS=-fvisibility-inlines-hidden -std=c++17 -fmessage-length=0 -march=nocona -mtune=haswell -ftree-vectorize -fPIC -fstack-protector-all -fno-plt -Og -g -Wall -Wextra -fvar-tracking-assignments -ffunction-sections -pipe -isystem /home/kali/miniconda3/include\n",
      "COMMAND_NOT_FOUND_INSTALL_PROMPT=1\n",
      "LDFLAGS=-Wl,-O2 -Wl,--sort-common -Wl,--as-needed -Wl,-z,relro -Wl,-z,now -Wl,--disable-new-dtags -Wl,--gc-sections -Wl,--allow-shlib-undefined -Wl,-rpath,/home/kali/miniconda3/lib -Wl,-rpath-link,/home/kali/miniconda3/lib -L/home/kali/miniconda3/lib\n",
      "HOME=/home/kali\n",
      "LANG=C.UTF-8\n",
      "MESON_ARGS=--buildtype release\n",
      "DEBUG_CFLAGS=-march=nocona -mtune=haswell -ftree-vectorize -fPIC -fstack-protector-all -fno-plt -Og -g -Wall -Wextra -fvar-tracking-assignments -ffunction-sections -pipe -isystem /home/kali/miniconda3/include\n",
      "LS_COLORS=rs=0:di=01;34:ln=01;36:mh=00:pi=40;33:so=01;35:do=01;35:bd=40;33;01:cd=40;33;01:or=40;31;01:mi=00:su=37;41:sg=30;43:ca=00:tw=30;42:ow=34;42:st=37;44:ex=01;32:*.tar=01;31:*.tgz=01;31:*.arc=01;31:*.arj=01;31:*.taz=01;31:*.lha=01;31:*.lz4=01;31:*.lzh=01;31:*.lzma=01;31:*.tlz=01;31:*.txz=01;31:*.tzo=01;31:*.t7z=01;31:*.zip=01;31:*.z=01;31:*.dz=01;31:*.gz=01;31:*.lrz=01;31:*.lz=01;31:*.lzo=01;31:*.xz=01;31:*.zst=01;31:*.tzst=01;31:*.bz2=01;31:*.bz=01;31:*.tbz=01;31:*.tbz2=01;31:*.tz=01;31:*.deb=01;31:*.rpm=01;31:*.jar=01;31:*.war=01;31:*.ear=01;31:*.sar=01;31:*.rar=01;31:*.alz=01;31:*.ace=01;31:*.zoo=01;31:*.cpio=01;31:*.7z=01;31:*.rz=01;31:*.cab=01;31:*.wim=01;31:*.swm=01;31:*.dwm=01;31:*.esd=01;31:*.avif=01;35:*.jpg=01;35:*.jpeg=01;35:*.mjpg=01;35:*.mjpeg=01;35:*.gif=01;35:*.bmp=01;35:*.pbm=01;35:*.pgm=01;35:*.ppm=01;35:*.tga=01;35:*.xbm=01;35:*.xpm=01;35:*.tif=01;35:*.tiff=01;35:*.png=01;35:*.svg=01;35:*.svgz=01;35:*.mng=01;35:*.pcx=01;35:*.mov=01;35:*.mpg=01;35:*.mpeg=01;35:*.m2v=01;35:*.mkv=01;35:*.webm=01;35:*.webp=01;35:*.ogm=01;35:*.mp4=01;35:*.m4v=01;35:*.mp4v=01;35:*.vob=01;35:*.qt=01;35:*.nuv=01;35:*.wmv=01;35:*.asf=01;35:*.rm=01;35:*.rmvb=01;35:*.flc=01;35:*.avi=01;35:*.fli=01;35:*.flv=01;35:*.gl=01;35:*.dl=01;35:*.xcf=01;35:*.xwd=01;35:*.yuv=01;35:*.cgm=01;35:*.emf=01;35:*.ogv=01;35:*.ogx=01;35:*.aac=00;36:*.au=00;36:*.flac=00;36:*.m4a=00;36:*.mid=00;36:*.midi=00;36:*.mka=00;36:*.mp3=00;36:*.mpc=00;36:*.ogg=00;36:*.ra=00;36:*.wav=00;36:*.oga=00;36:*.opus=00;36:*.spx=00;36:*.xspf=00;36:*~=00;90:*#=00;90:*.bak=00;90:*.crdownload=00;90:*.dpkg-dist=00;90:*.dpkg-new=00;90:*.dpkg-old=00;90:*.dpkg-tmp=00;90:*.old=00;90:*.orig=00;90:*.part=00;90:*.rej=00;90:*.rpmnew=00;90:*.rpmorig=00;90:*.rpmsave=00;90:*.swp=00;90:*.tmp=00;90:*.ucf-dist=00;90:*.ucf-new=00;90:*.ucf-old=00;90::ow=30;44:\n",
      "XDG_CURRENT_DESKTOP=XFCE\n",
      "CXX_FOR_BUILD=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-c++\n",
      "CONDA_BACKUP_HOST=kali\n",
      "ELFEDIT=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-elfedit\n",
      "CONDA_PROMPT_MODIFIER=(base) \n",
      "CMAKE_PREFIX_PATH=/home/kali/miniconda3:/home/kali/miniconda3/x86_64-conda-linux-gnu/sysroot/usr\n",
      "XDG_SEAT_PATH=/org/freedesktop/DisplayManager/Seat0\n",
      "CPPFLAGS=-DNDEBUG -D_FORTIFY_SOURCE=2 -O2 -isystem /home/kali/miniconda3/include\n",
      "LD=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-ld\n",
      "READELF=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-readelf\n",
      "GXX=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-g++\n",
      "GCC_AR=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-gcc-ar\n",
      "ADDR2LINE=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-addr2line\n",
      "XDG_SESSION_CLASS=user\n",
      "TERM=xterm-color\n",
      "LESS_TERMCAP_mb=\u001b[1;31m\n",
      "LESS_TERMCAP_me=\u001b[0m\n",
      "LESS_TERMCAP_md=\u001b[1;36m\n",
      "_CE_CONDA=\n",
      "GCC_NM=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-gcc-nm\n",
      "SIZE=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-size\n",
      "HOST=x86_64-conda-linux-gnu\n",
      "CC_FOR_BUILD=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-cc\n",
      "USER=kali\n",
      "COLORFGBG=15;0\n",
      "CONDA_SHLVL=1\n",
      "AR=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-ar\n",
      "AS=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-as\n",
      "DEBUG_CPPFLAGS=-D_DEBUG -D_FORTIFY_SOURCE=2 -Og -isystem /home/kali/miniconda3/include\n",
      "host_alias=x86_64-conda-linux-gnu\n",
      "DISPLAY=:0.0\n",
      "LESS_TERMCAP_ue=\u001b[0m\n",
      "SHLVL=2\n",
      "NM=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-nm\n",
      "LESS_TERMCAP_us=\u001b[1;32m\n",
      "GCC=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-gcc\n",
      "XDG_VTNR=7\n",
      "XDG_SESSION_ID=2\n",
      "LD_GOLD=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-ld.gold\n",
      "CONDA_PYTHON_EXE=/home/kali/miniconda3/bin/python\n",
      "XDG_RUNTIME_DIR=/run/user/1000\n",
      "CONDA_DEFAULT_ENV=base\n",
      "OBJCOPY=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-objcopy\n",
      "STRIP=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-strip\n",
      "QT_AUTO_SCREEN_SCALE_FACTOR=0\n",
      "XDG_DATA_DIRS=/usr/share/xfce4:/usr/local/share/:/usr/share/:/usr/share\n",
      "OBJDUMP=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-objdump\n",
      "PATH=/home/kali/miniconda3/bin:/home/kali/miniconda3/condabin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/local/games:/usr/games\n",
      "CC=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-cc\n",
      "GDMSESSION=lightdm-xsession\n",
      "CFLAGS=-march=nocona -mtune=haswell -ftree-vectorize -fPIC -fstack-protector-strong -fno-plt -O2 -ffunction-sections -pipe -isystem /home/kali/miniconda3/include\n",
      "CXXFILT=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-c++filt\n",
      "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus\n",
      "BUILD=x86_64-conda-linux-gnu\n",
      "_JAVA_OPTIONS=-Dawt.useSystemAAFontSettings=on -Dswing.aatext=true\n",
      "RANLIB=/home/kali/miniconda3/bin/x86_64-conda-linux-gnu-ranlib\n",
      "CONDA_BUILD_SYSROOT=/home/kali/miniconda3/x86_64-conda-linux-gnu/sysroot\n",
      "OLDPWD=/home/kali/projects/SoftwareSecurity/demos/envvars\n",
      "_=/home/kali/projects/SoftwareSecurity/demos/envvars/./execve_passenv\n",
      "PYDEVD_USE_FRAME_EVAL=NO\n",
      "JPY_SESSION_NAME=ca5d2bce-67a5-464e-9812-13b7ab6a184d\n",
      "JPY_PARENT_PID=791209\n",
      "CLICOLOR=1\n",
      "FORCE_COLOR=1\n",
      "CLICOLOR_FORCE=1\n",
      "PAGER=cat\n",
      "GIT_PAGER=cat\n",
      "MPLBACKEND=module://matplotlib_inline.backend_inline\n"
     ]
    }
   ],
   "source": [
    "! ./execve_passenv 3"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "3a5fe23f-68b9-403b-9b94-b5b8f21f634b",
   "metadata": {},
   "source": [
    "## Memory Locations for program arguments and environment variables\n",
    "\n",
    "- let's see the stack frame of main function\n",
    "\n",
    "![Env Variables and Main](./media/env_stack.png)\n"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "95244bdc-1283-4885-b5c9-46542f78b700",
   "metadata": {},
   "source": [
    "## Futher Readings and References\n",
    "- How to Write Setuid Programs - https://nob.cs.ucdavis.edu/~bishop/secprog/1987-sproglogin.pdf\n",
    "- Setuid BSDI Man page - https://seedsecuritylabs.org/Labs_20.04/Software/Environment_Variable_and_SetUID/files/setuid.pdf\n",
    "- Setuid Demystified - https://web.ecs.syr.edu/~wedu/minix/projects/setuid_paper.pdf"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "5fa1df07-4bb8-4a44-a966-b3008f408cfa",
   "metadata": {},
   "outputs": [],
   "source": []
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3 (ipykernel)",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.11.7"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 5
}