#include #include #include void unused_function() { printf("you did it! ROP achieved, we never call this function\n"); printf("calling /bin/sh...\n"); system("/bin/sh"); } void vuln(char* input) { char buffer[32]; // copy input but dont check size, purposefully vulnerable so we can ROP our way through stuff strcpy(buffer, input); printf("Your argument was: %s\n", buffer); } int main(int argc, char** argv) { if (argc != 2) { printf("Usage: %s \n", argv[0]); return 1; } vuln(argv[1]); return 0; }