To better understand buffer overflow, I can suggest this site. It contains extremely clear explanation, but it doesn't explain how to take advantage of the strange situation that occurs after the overflow.
Despite of this, the following site explains better.
Before you read the guides, please pay attention to these few indications:
Memory is divided in segments and every segment is divided in items located at a certain offset inside the same segment: Every item in the segment is accessed at starting position (offset) plus memory allocation for every kind of item (how many bytes are needed to allocate object in memory segment), so you should be aware of what does it means "Segmentation fault" and NEVER get out of bounds in programming techniques.
The second guide, uses two kinds of Operating System: Linux and Windows; The duality is extremely important, because you'll see that the offset of the Instruction Pointer (
0x7c9d30d7) is written in reverse order in exploit coding (
buff = 'x90'*230+'xd7x30x9dx7c'+'x43'*366).
The target is a FTP server which is vulnerable to stack overflow, but the concept behind the scenes is the same in case of writing and executing a little C script with keyboard input, as you proposed.
In the end of the guide, the attacker listens on TCP port 443 on Linux host and receive a shell prompt (the exploit in reverse shell) from a Windows host (the vulnerable FTP server).
Because of these guides, you should understand the phrase I wrote: "Make the software do something else it was originally programmed with input data"
As an advice, I can suggest you start on the first guide, then pass to the second and turn back to the first, just to understand possibly obscure passages.
By a hacker perspective, XSS, RFI or even SQL are all poor of interest;
The SQL language, for example, is useful to retrieve (or modify data) from a database using the boolean logic.
When you need to get information regarding tables, columns and records, you pass conditions to the SQL engine as parameters; These parameters are compared together with the logic of AND, OR, NOT.
Imagine adding (injecting) a new parameter (syntax must be correct) to a predefined SQL statement, where the resulting condition is always true respect to the original restricted one; In such way, you can bypass the restriction.
That's it, extremely simple, no hacking techniques or skill are needed.
By the way, an exploit as NSA EternalBlue (and derivates) is very appreciated, because overwrites part of the authentication process (challenge-response), connect to resources without specified password and injects new code using a hidden interprocess communication channel on SMBv1 unpatched Windows machines.