level1.c

//gcc -o level1 level1.c -fno-stack-protector -z execstack -mpreferred-stack-boundary=2
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

void dummy()
{
        setresuid(geteuid(),geteuid(),geteuid());
        system("sleep 1; cat /etc/shadow;");
    exit(0);
}

int *p;
void func(char *arg)
{
        char buf[16];
        p = (int *)&buf[sizeof(buf)];

    printf("dummy() is at: 0x%08x\n", dummy);
        printf("before:   SEBP=%p\n\t  SEIP=0x%08x\n", *p, *(p+1));
        strcpy(buf, arg);
        printf("after:    SEBP=%p\n\t  SEIP=0x%08x\n", *p, *(p+1));

}
int main(int argc, char *argv[])
{
        if(!argv[1]) {
        printf("No command found...\n");
        return;
    }
        func(argv[1]);
}