ret2win: Redirect to an Existing Function

// vuln.c  --  compiled with mitigations off for teaching
#include <stdio.h>
#include <string.h>

void win(void) {                 // the "hidden" target
    puts("You reached win(): flag unlocked.");
}

void vuln(void) {
    char buf[64];
    gets(buf);                   // UNBOUNDED read -> overflow
}

int main(void) {
    vuln();
    return 0;
}

• win() already exists in the binary; we just need ret to land on it.
• Payload shape: padding to reach the saved RET, then the address of win.