Stack Four takes a look at what can happen when you can overwrite the saved instruction pointer (standard buffer overflow).
Hints
/* * phoenix/stack-four, by https://exploit.education * * The aim is to execute the function complete_level by modifying the * saved return address, and pointing it to the complete_level() function. * * Why were the apple and orange all alone? Because the bananna split. */ #include <err.h> #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #define BANNER \ "Welcome to " LEVELNAME ", brought to you by https://exploit.education" char *gets(char *); void complete_level() { printf("Congratulations, you've finished " LEVELNAME " :-) Well done!\n"); exit(0); } void start_level() { char buffer[64]; void *ret; gets(buffer); ret = __builtin_return_address(0); printf("and will be returning to %p\n", ret); } int main(int argc, char **argv) { printf("%s\n", BANNER); start_level(); }