C gives you the memory — and the footguns

C has no seatbelts: you manage memory by hand, and the CPU trusts you completely. That's why the fastest software and the deepest vulnerabilities live in C. Learn how C lays out memory and you learn how exploits are born.

By the end of this course you'll take a vulnerable C program and overwrite its return address to hijack execution — the classic "ret2win" — entirely in your lab with gcc and gdb.

🎯 Your target

ls -la ~/cexploit/
cat ~/cexploit/README.txt
cat ~/cexploit/vuln.c          # read the source — the bug is in here

🎯 Challenge: Open your lab, read vuln.c, and run ./vuln once. What does it ask for, and does it ever call win() on its own?

Show solution

cat ~/cexploit/vuln.c
echo hi | ~/cexploit/vuln      # prints "returned normally (no win)"

win() exists but is never called by main. Your whole job is to reach it anyway — by corrupting the stack.

⚖️ Exploit only the lab binary or software you own. Memory-corruption attacks on others' systems are illegal.

Liked it? 10 more lessons are waiting.

11 lessons · knowledge checks · final exam · verifiable certificate · in-browser Live-Lab

Unlock all courses · CHF 9/month Buy only this course · CHF 19

What's in C for Hackers

1. Why C Is the Exploiter’s LanguageFree
2. The Toolchain — gcc & Running Binaries🔒 Foundations
3. Pointers & Addresses🔒 Memory
4. The Stack & the Return Address🔒 Memory
5. Debugging with gdb🔒 Tools
6. Spotting the Vulnerability🔒 Analysis
7. Crash It — Prove You Control RIP🔒 Exploitation
8. Find the Exact Offset🔒 Exploitation
9. ret2win — Hijack Execution🔒 Exploitation
10. Why Modern Binaries Fight Back🔒 Defense
11. Final Exam — Smash the Stack🔒 Certification

Continue in the interactive course reader →

Why C Is the Exploiter’s Language

C gives you the memory — and the footguns

🎯 Your target

Liked it? 10 more lessons are waiting.

What's in C for Hackers