destructivevoice/destructivefarm

📢 🔒 Exploit manager for attack-defense CTF competitions

Destructive Farm

Language: English | Русский

Exploit farm for attack-defense CTF competitions

Read the FAQ if you want to know what attack-defense CTFs are, why you need this exploit farm for them, and why it has the architecture described below.

Components

1. An exploit is a script that steals flags from some service of other teams. It is written by a participant during the competition and should accept the victim's host (IP address or domain) as the first command-line argument, attack them and print flags to stdout.

   Example | More details

2. A farm client is a tool that periodically runs exploits to attack other teams and looks after their work. It is being run by a participant on their laptop after they've written an exploit.

   The client is a one-file script start_sploit.py from this repository.

   More details

3. A farm server is a tool that collects flags from farm clients, sends them to the checksystem, monitors the usage of quotas and shows the stats about the accepted and rejected flags. It is being configured and run by a team's admin at the start of the competition. After that, team members can use a web interface (see the screenshot above) to watch the exploits' results and stats.

   The server is a Flask web service from the server directory of this repository.

   More details

The arrows display the flow of the flags

Future Plans

See the list here.

Authors

Copyright © 2017–2018 Aleksandr Borzunov

Inspired by the Bay's farm.

destructivefarm's Issues

how to Add more than token?

Hi,
How to add more than token by team generated by CheckSystem?

  'SYSTEM_PROTOCOL': 'forcad_tcp',
  'SYSTEM_HOST': '127.0.0.1',
  'SYSTEM_PORT': 31337,
  'TEAM_TOKEN': 'd7c5987a9a87b321',

Connection refused submitting flags

Hi,
why I 've:
127.0.0.1 - - [03/May/2020 18:08:14] "GET /api/get_config HTTP/1.1" 200 -
127.0.0.1 - - [03/May/2020 18:08:19] "POST /api/post_flags HTTP/1.1" 200 -
[2020-05-03 18:08:20,587] DEBUG in submit_loop: Submitting 1 flags (out of 1 in queue)
[2020-05-03 18:08:20,588] ERROR in submit_loop: Exception on submitting flags: ConnectionRefusedError: [Errno 111] Connection refused
127.0.0.1 - - [03/May/2020 18:08:25] "POST /ui/show_flags HTTP/1.1" 200 -
[2020-05-03 18:08:25,591] DEBUG in submit_loop: Submitting 1 flags (out of 1 in queue)
[2020-05-03 18:08:25,591] ERROR in submit_loop: Exception on submitting flags: ConnectionRefusedError: [Errno 111] Connection refused
127.0.0.1 - - [03/May/2020 18:08:30] "GET / HTTP/1.1" 200 -

Future Plans

I will be glad to review pull requests implementing the features listed below. If you plan to make a large contribution, please create an issue to discuss the planned changes in advance. If your PR is accepted, I will consider adding you to the "Contributors" section in the readme.

Feel free to make PRs with new checksystem protocols as well.

User experience:

• Don't require shebang if --interpreter is set (implemented by @TheAvidDev).
• Short variant for --server-url.
• Show the number of flags added (and the number of new flags) after using the "Add Flags Manually" form (Found X new flags among Y flags in the form). The current behavior is misleading if a user adds an already existing flag (looks like nothing has happened).
• Use virtualenv for the server to avoid dependency conflict. Set up everything and install deps in start_server.sh. Mention the feature in the rejected Docker-related PRs.
• Measure the percentage of the exploits that surpassed the time limit only using the last N attacks.
• Don't reset the flag search form with Ctrl+R. Add a separate "Clear" button. This may require a better front-end framework (see below).

Reliability:

• Add a limit for the number of flags per (sploit, team) to the farm client to avoid bloating the farm server DB during aggressive flag spamming. When the limit is reached, show a warning and send only a small random subset of flags.
• Simplify get_fair_share() with the table algorithm. The current implementation has a bias towards sending more flags from smaller groups that can be undesirable.

Optimizing resource use:

• Add an option to run Python exploits in threads instead of processes. Measure the profit.
• (?) If an exploit finishes before the time limit, we can increase the time limit for other exploits.
• (?) The farm client runs 2 threads and 1 process for each exploit instance. We can reduce this to 1 thread and 1 process if we read the exploit output using select() (but may be too complicated). Measure the profit.

Ideas:

• Make releases, write a changelog.
• Add a "Plots" tab with performance plots (= the number of received/ACCEPTED/REJECTED flags) for each exploit. After a click - performance plots of this exploit for each victim.
• Send stdout/stderr of each exploit instance to the farm server. Add an "Exploit Instances" tab with all sploit instances where a user can open their output. Don't print the output on the client (show a nice curses UI instead).
• Log exceptions from the submit loop to stderr (implemented by @abbradar).
• Add a "Logs" tab to the web interface with exceptions from the submit loop.
• start_sploit.py sends a sploit source (if it's a script) to the farm server. A user can open it there. Store the source code gzipped, identify by hash (no ids). Maybe add "Sources" tab?
• Randomize User-Agent in exploits.
• Parse scoreboards to get the team list (add scoreboard protocols?).
• Protect API with password (implemented by @nsychev).
• (?) Check the amount of free RAM. In case of problems, don't run new processes and kill the existing ones. This may be too complicated or may be solved via configuring the OOM killer of the OS instead.
• (?) Use digest auth instead of basic auth.

Testing:

• (?) Test kill() and flush() on different OS more thoroughly.
• (?) Add typing.
• (?) Add unit tests.

Refactoring:

• Use ORM (don't construct SQL queries by hand in server/views.py).
• Use a modern front-end framework.
• Resolve TODO and FIXME comments in the code.

Default password

Hi,
Nice work.
what's the default admin and password of application?
thank you