Overflow the buffer and call the system function with a pointer to the username, that contains /bin/sh.