The service was a statically linked 32-bit C binary. The service consisted of the binary itself, a script (run.sh) to start it, a folder (data) to store the service data and a Docker environment. One thing to note here is that all these files were mounted into the Docker as read/write The binary had very few protections enabled and had multiple RWX-segments. Upon connecting to the service, you were prompted to either register a new user or login with an existing one. After the login, you could either append a new receipt to an index or print the receipt stored at an index. When the connection is closed, all added receipts were stored on disk in a folder named after the user. The filenames were decimal numbers representing the index of the receipt with the filecontent being the receipt itself.

For the full write-up, see link