This is a common way of executing shellcode in a PoC.

Exec (before the cast) points to memory containing the shellcode data.

To actually start executing the shellcode, you just need to somehow cause the program counter to point to the address of the shellcode.

An easy way to change the program counter is by calling a function ... which is what this line does.

Read this as "cast exec to a pointer to a function that takes zero arguments and returns void and call the function with no arguments."

This is the same as:

   typedef void (*some_func)();
   some_func func = (some_func)exec;
   func();

To familiarize yourself with C syntax regarding pointers, read about the "right-left rule" [1]

[1] http://ieng9.ucsd.edu/~cs30x/rt_lt.rule.html

This is insanely clever. Thanks a lot for the explanation

Without reading the article: it looks like it casts exec to a function pointer with void return type and no arguments, and calls it. (Disclaimer: I'm paid for writing Java :( )

Almost. It's casting exec to a pointer to a function that "returns" void and takes no arguments and then calling the function. Search for "C right-left rule" (without quotes) to see some hints on how to read complex declarations (mostly applies to casting too). I like http://ieng9.ucsd.edu/~cs30x/rt_lt.rule.html

It's actually a cast to a function pointer with signature: void exec(). The trailing brackets () then make the program call the function.