exploit-exercises.com walkthrough - Nebula level02

So here's our challenge: http://exploit-exercises.com/nebula/level02.

We have an environment value USER copied to the buffer without any checking. In the next step the buffer content is executed with a system() call. Basically we just need to prepare USER environment variable with a "proper" content and we are good to go:

level02 walkthrough.

And that's all :)