title: Buffer Overflow Attack
body: <p>I'm trying to execute a very simple buffer overflow attack. I'm pretty much a newbie to this. So, if this question is stupid, please excuse me :-)</p>
  
  <p>The code:</p>
  
  <pre><code>#include&lt;stdio.h&gt;
  #include&lt;stdlib.h&gt;
  
  int i, n;
  
  void confused(int i) 
  {
   printf("**Who called me? Why am I here?? *** %x\n ", i);
  }
  
  void shell_call(char *c) 
  {
   printf(" ***Now calling \"%s\" shell command *** \n", c);
   system(c);
  }
  
  void victim_func()
  {
   int a[4];
   printf("Enter n:  ");  scanf("%d",&amp;n);
   printf("~~~~~~~~~~~~~ values and address of n locations ~~~~~~~~~~");
   for (i = 0;i &lt;n ;i++) 
    printf ("\n a[%d] = %x, address = %x", i, a[i], &amp;a[i]);
   printf("\nEnter %d HEX Values \n", n);
  
   // Buffer Overflow vulnerability HERE!
  
   for (i=0;i&lt;n;i++)  scanf("%x",&amp;a[i]);
     printf("Done reading junk numbers\n");
  }
  
  int main() 
  {
   victim_func();
   printf(“\n done”);
   return 0; 
  }
  </code></pre>
  
  <p>When I use objdump to get the function addresses, I have the following:</p>
  
  <pre><code>main(): 0x804854d
  Address of main() where printf() is called: 0x8048563
  victim_func(): 0x8048455
  confused(): 0x8048414
  </code></pre>
  
  <p>Now, what I want is to jump to the function 'confused()' from victim_func() by overflowing the buffer there, and overwriting the return address to the address of confused(). And I want to return back from confused() to the printf() statement in main, and exit normally. So, I provide the following input</p>
  
  <pre><code>Enter n: 7
  Enter 7 HEX values:
  1
  2
  3
  4
  5
  8048414 (This is to jump to confused)
  8048563 (this is to jump to printf() in main)
  </code></pre>
  
  <p>Although, the program prints "Done" from that printf statement, it is jumping back to victim_func() and prints "Enter n:"</p>
  
  <p>What am I doing wrong? Any help would be greatly appreciated!</p>
  
  <p>PS: I'm not sure if I have put the question right. Please let me know, if any more information is needed.</p>