PicoCTF 2013 - rop2

This time I decided to check next challenge from Pico CTF (2013) called rop2. Below you will find the details...
We will start here:

According to the source:

...we need to call system() with new value. Let's try:

So far, so good.

Next (using gdb-peda):

So now: preparing new payload:

Trying it in gdb session:

 ...and outside the gdb:

Looks good. :)



See you next time!

Cheers