csivitu/ctf-challenges

An aggregation of CTF challenges and write-ups for csictf 2020!

CTF Challenges

CTF challenges for csictf 2020.
Explore the docs »

View Demo · Report Bug · Request Feature

Table of Contents

• About the Project
• Getting Started
  • Installation
• Template
• Contributing
• License
• Contributors

About The Project

This is a repository to store CTF challenges to be deployed for csictf.

Getting Started

Note: This is a beginner CTF, hence the challenges should be of easy / moderate difficulty.

Note: DO NOT PLAGIARIZE challenges from other CTFs. You can take inspiration but not have the exact same challenge.

The following are the categories of challenges that are to be made:

• Pwn
• Web
• OSINT
• Linux
• Crypto
• Forensics
• Reversing
• Miscellaneous

Installation

1. Clone the repo

git clone https://github.com/csivitu/ctf-challenges.git

Template

Flag Format

• The flags must be enclosed in csictf{}.
• They can have numbers, alphabets, _s, 's, !s, .s, +s, -s, @s, #s, $s, %s, :s, >s.
• They must be related to the challenge.
• They must not be so simple that you can guess them.

Here's a regex for the flag format.

/^csictf{[\w_!@#?$%\.'"+:->]{5,50}}$/

Here's a sample flag.

csictf{th1s_i5_4_s4mpl3_fl4g'+!-.@#$%?}

Directory Structure

The following are guidelines for creating challenge folders.

• Each challenge has it's own folder, which is placed in the relevant directory amongst the ones enlisted above.
• Each challenge must have a README.md file describing how to solve the challenge, along with the relevant code / files that needs to be run / deployed on the server.
• The flag must be present in the README.md for the challenge.
• We prefer having each challenge in it's own docker container, so that it's simple to deploy.

- pwn/
  - n00binary/
    - static/
      - img1.png
    - README.md
    - n00binary
    - n00binary.c
    - Dockerfile
- web/
  - localize/
    - README.md
    - localize.php
    - Dockerfile

The static folder contains images that may be used in the README.md.

Template for Challenge README

As mentioned earlier, each challenge requires a README. The README must be written in such a way that this can serve as an official write-up later. This should have the following format.

# Challenge Name

Author: [author](https://github.com/author)

## Description

Brief Description about challenge

## Requirements

- Docker: [Dockerfile](./Dockerfile)

## Sources

- [sample.py](./sample.py)
- [sample.txt](./sample.txt)

<!-- Remove this comment, and the '\' before '```' -->
\```
Challenge description to go up on the website.

Hint 1: If any - Points 100
Hint 2: If any - Points 200
\```

## Exploit

<!-- Much more detailed description than the following. -->
Reverse `sample.py` to decrypt the flag in `sample.txt.`
<br />

The last line should be the flag.
<br />

The flag is:

\```
csictf{some_flag_here}
\```

Refer to this sample for writing the exploit section.

challenge.yml

Every challenge must have a challenge.yml, in the format specified in challenge-example.yml. This is MANDATORY, without this the challenge will not be deployed. Remove the comments in the specified format, leave out the value, decay and minimum keys as they are in the template. Every challenge has 500 points initially and decays to 100 points over 450 solves.

Dockerfiles

Here are some Dockerfiles you can refer to while making your own. Make sure you test it locally before making the PR.

• Node.js Server
• Flask Server
• Netcat to Python
• Pwn Binary

Make sure you read the Dockerfiles and include the necessary files like the flag.txt. REMEMBER TO ADD THE README.md and challenge.yml FILES TO .dockerignore, BECAUSE IT HAS THE SOLUTION..

Contributing

Besides contribution of challenges, contribution of ideas for challenges is also appreciated. You can put forward your ideas to @roerohan, @theProgrammerDavid and @thebongy.

Contributions are what make the open source community such an amazing place to be learn, inspire, and create. Any contributions you make are greatly appreciated.

1. Fork the Project.
2. Submit your idea for the challenge in the respective README.
3. File a Pull Request with the challenge-idea tag. Each challenge must have it's own PR.
4. Once the challenge is approved, the tag is changed to challenge-approved, we comment on the PR.
5. Build the final challenge and update the same PR.
6. Make sure all commit messages are in accordance with the guidelines in CONTRIBUTING.md.
7. Any issues in the challenge will be addressed using GitHub Issues.

You are requested to follow the contribution guidelines specified in CONTRIBUTING.md while contributing to the project 😄.

License

Distributed under the MIT License. See LICENSE for more information.

Contributors ✨

Thanks goes to these wonderful people (emoji key):

Rohan Mukherjee 📖 🚇 💻	Rishit Bansal 📖	theProgrammerDavid 📖	AJ1479 📖 💻	alias-rahil 📖 💻	ashikka 📖 💻	parthkgh24 📖 💻
Atharva-Gundawar 📖 💻	SrishtiGohain 📖 💻	harsoh 📖 💻	tangobeer 📖 💻	Shivansh Sharma 📖 💻	Pragati1610 📖 💻

This project follows the all-contributors specification. Contributions of any kind welcome!

ctf-challenges's Issues

Scale up CTFd

CTFd needs to be scaled up before the start of the CTF.

Automatic deployment of challenges

Need to setup a github action, or some sort of CI/CD to do the following:

1. Build every challenge in every subfolder inside a docker container
2. Push the docker containers to a private registry (we could maybe use github packages (1GB limit :( ), or maybe our private gitlab too)
3. Login on the challenge server and pull and restart updated containers

A note about 3, we have to make sure to not unnecessarily restart every challenge, only ones that have to be updated should be restarted. This will be crucial during the CTF too, to roll out quick fixes

Stress testing the challenges

I will be performing some stress testing on challenges, to help determine whether we need more quotas. will post results/findings here

Playing challenges on local machine

Do we have to use the CLI tool in the github repo to initialize this project and play on our local machine ?

Challenge and server monitoring/health checks

Need to setup some sort of a script to keep performing health checks on each challenge (and the CTFd platform), and possibly notify us too, if something is going wrong. Could also maybe automatically restart service

Another idea is to also integrate this with the discord bot we were planning to make

Supress rsync output

@alias-rahil Please suppress the rsync command output in the Where am I challenge, it throws a lot of warnings and crowds the CI logs

Setup Cloudflare DNS, reverse proxy

Need to setup cloudflare to make sure we don't get DDOS'd xP

Add ports/URLs to descriptions.

Update URLs and netcat ports in challenge.ymls and READMEs.

Challenges Wave #1

• Arushi
• Atharva
• Parth
• Pragati
• Prannay
• Rahil
• Shivansh
• Soham
• Srishti
• Subham

Add all challenge contributors in the README

:)

Additional Exploits / Ideas

@AJ1479 @ritwikgoel
This is a list of popular exploits. Challenges can be made from them. Kindly distribute them among the rest of Sr.Tech

1. ret2libc
2. Bit flipping in AES
3. PHP Code injection
4. Obfuscated javascript in frontend
5. DOM clobbering
6. CSRF
7. XXE
8. Template injection
9. Wiener's attack
10. Specific challenge about RSA
11. Mega nmap challenge

Challenges with RCE, nsjail to be added.

Need to prevent fork bomb

These challenges may be fork bombed because RCE is possible.
Fork bomb prevention added to:

(RCE is probably not possible but whatever XD) Implies it's not priority

Web

• Body Count

Linux

• AKA
• find32
• Where am I

Miscellaneous

• Brobot
• Escape Plan
• Prison Break (RCE is probably not possible but whatever XD)

Pwn

(RCE is probably not possible but whatever XD)

• Global Warming
• pwn-intended-0x1
• pwn-intended-0x2
• pwn-intended-0x3

Reversing

(RCE is probably not possible but whatever XD)

• Blaise
• Vietnam

Need to port all challenges to use the challenge.yml format as described by ctfcli

https://github.com/CTFd/ctfcli/blob/master/ctfcli/spec/challenge-example.yml

Add contributors

No sshd service running inside container

ctf-challenges/linux/Where am I/Dockerfile

Line 19 in 33ef02b

CMD ["/bin/ash", "-c", "/usr/sbin/sshd -D & nc -lkp 9999 -e /script.sh"]

After deployment and using nc to connect to the port 9999, I receive the "Where am I?" prompt. I go go the /root/.ssh/ directory to locate the private key and run:

$ ssh root@localhost -i id_rsa

But I don't get a returning connection or response. There doesn't appear to be any SSH service running or listening in the container on port 22.

Challenges Wave #2

Challenge idea submitted:

• Arushi
• Ashikka
• Atharva
• Parth
• Pragati
• Prannay
• Rahil
• Shivansh
• Soham
• Srishti
• Subham