> For the complete documentation index, see [llms.txt](https://ret2basic.gitbook.io/ctfwriteup/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ret2basic.gitbook.io/ctfwriteup/web2-ctf/pwn.college/exploitation/hijacking-to-shellcode.md).

# Hijacking to Shellcode

## Lecture

{% embed url="<https://youtu.be/lsY2g09Hjr0>" %}
Hijacking to Shellcode
{% endembed %}

## Example from the Shellcoding Module

```c
void bye1() { puts("Goodbye!"); }
void bye2() { puts("Farewell!"); }
void hello(char *name, void (*bye_func)())
{
    printf("Hello %s!\n", name);
    bye_func();
}
int main(int argc, char **argv)
{
    char name[1024];
    gets(name);
    srand(time(0));
    if (rand() % 2) hello(bye1, name);
    else hello(name, bye2);
}
```

* **Bug 1:** `hello(bye1, name)` should be `hello(name, bye1)`.
* **Bug 2:** `gets(name)` causes buffer overflow.