ret2winOne.c

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

int INPUT=300; //Give enough to overflow
int BUFFER=175;

void win(void){
    /*Win Condition
      We Want to jump here
    */
    printf("\n ===== Win ===== \n\n");
    system("/bin/sh");  //Tradition to get a shell
}

void lose(void){
    /* Lose Condition */
    printf("Lose :(\n");
}

int main(int argc, char* argv[]){
    /* Main Function*/
    char buffer[BUFFER];
    char readBuffer[INPUT];

    setvbuf(stdout, NULL, _IONBF, 0);
    //Pointer to the lose function
    void (*fp)(void) = lose;

    printf("--- Overflow the Buffer ---\n");
    printf("Current Memory Address is %p\n",lose);
    printf("Aim for %p\n", win);    

    printf("What is your input >");
    //fflush(stdout);
    fgets(readBuffer, INPUT, stdin);
    //Strip newline
    readBuffer[strcspn(readBuffer, "\n")] = 0;
    printf("You entered >%s<\n", readBuffer);
    
    memcpy(buffer, readBuffer, strlen(readBuffer));
    printf("Off to %p\n",fp);
    fp();
    
    return 0;
}