In level06 just change environment variable to 'fr' and now try to overwrite the eip with shellcode as in level5 !!!

Shellcode-1»

How about exploting Path Variable »