Rating: 5.0
The source code is fairly straightfoward. First the `init` function disables buffering. Then, two 64 byte buffers are initialized: `flag` and `your_try`. The former is read from the file at `./file`, and the latter is read from `scanf`. These buffers are then compared using `strncmp`. If the strings match, then the `win` function is ran, which gives us shell access by running `system("/bin/sh")`.
Our goal is clearly to run `win` by getting `strncmp(your_try, flag, length) == 0` to return `true`. The C documenation tells us the following about `strncmp`:
**This function starts comparing the first character of each string. If they are equal to each other, it continues with the following pairs until the characters differ, until a terminating null-character is reached, or until num characters match in both strings, whichever happens first.**
The key here is "until a terminating null-character is reached". This means that the funciton will stop comparing once it reaches a null byte (`0x00`) in either string. So, if we start our input with a null byte, then it will stop comparing immediately and think that `your_try` is equal to `flag`. Since `scanf` reads 64 bytes, we will pass 64 null bytes as our inputs.
Once we have shell access, we can just run `cat ./flag` to read the flag. We will append this to our input, along with `\n` at the end so that the shell runs our command. We can pass this input into `nc` using `printf`. The command that does this is:
```
(printf "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0cat ./flag\n") | nc 34.146.101.4 30007
```
