ret2winOne.c

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

int INPUT=300; //Give enough to overflow
int BUFFER=150;

void win(void){
    /*Win Condition
      We Want to jump here
    */
    printf("\n ===== Win ===== \n\n");
    system("/bin/sh");  //Tradition to get a shell
}

void lose(void){
    /* Lose Condition */
    printf("Lose :(\n");
}

void copyData(char* readBuffer){

  char buffer[BUFFER];

  strcpy(buffer, readBuffer);
}

int main(int argc, char* argv[]){

    //Pointer to the lose function
    void (*fp)(void) = lose;

    /* Main Function*/
    //char buffer[BUFFER];

    char readBuffer[INPUT];

    setvbuf(stdout, NULL, _IONBF, 0);

    printf("--- Overflow the Buffer ---\n");
    printf("Current Memory Address is %p\n",lose);
    printf("Aim for %p\n", win);    

    printf("What is your input >");
    scanf("%s", readBuffer);
    printf("You entered >%s<\n", readBuffer);
    copyData(readBuffer);

    printf("Off to %p\n",fp);
    //fp();
    lose();
    
    return 0;
}