The terminal on the homepage is not a mock-up. It is a complete virtualized computer - a custom 32-bit CPU compiled to WebAssembly, running a real kernel, filesystem, and full userland in your browser. Somewhere inside it is a bug. Your job is to exploit it.
After logging in, you are an unprivileged user. Escalate to root and read the flag at /root/flag.
This is genuine binary exploitation - no web tricks, no guessing, no hidden URLs. Everything you need is inside the machine, and the machine fights back. Find what runs as root, work out how it breaks, and turn that into a shell.
The entire OS - the shell, the tools, the compiler and assembler - is written in a small self-hosting C dialect (the vulnerable program itself is hand-written TB32 assembly). If you want to understand what you are reversing, the language is documented in the TBC language reference, and the instruction set in the TB32 assembly reference.
tonicbox - the default password (1234) is shown on the login screen. Then type help.find / -perm -4000.objdump, nm, and ropgadget are already in the box.pack, unpack, and calc are there so you never need to leave the terminal.cat /root/flag.