This C source code has a few bugs, but only one method provides easy exploitation on Linux. The exploit overwrites a Global Offset Table entry for a networking socket call by abusing printf. Our payload has been injected in a specially crafted form in order to execute properly due to manipulation of the data. The payload executes the 'id' command in the context of the running server. Shellcode size restrictions were a factor, because your data gets overwritten with zeros. It takes some hacking kungfu...watch and learn :-)