2026-09-25 14:04:33 +08:00
|
|
|
{
|
|
|
|
|
"sets": {
|
|
|
|
|
"gemastik18": {
|
|
|
|
|
"label": "GEMASTIK XVIII",
|
|
|
|
|
"repo": "github.com/rayhanhanaputra/gemastik18-final",
|
|
|
|
|
"note": "Game aktif saat ini"
|
|
|
|
|
},
|
|
|
|
|
"xvi": {
|
|
|
|
|
"label": "GEMASTIK XVI",
|
|
|
|
|
"repo": "github.com/vidner/gemastik-xvi-final",
|
|
|
|
|
"note": "Distributed \u2014 toggle untuk aktifkan"
|
|
|
|
|
},
|
|
|
|
|
"xvii": {
|
|
|
|
|
"label": "GEMASTIK XVII",
|
|
|
|
|
"repo": "github.com/vidner/gemastik-xvii-final",
|
|
|
|
|
"note": "Distributed \u2014 toggle untuk aktifkan"
|
|
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
"challenges": [
|
|
|
|
|
{
|
|
|
|
|
"name": "blogpost",
|
|
|
|
|
"set": "gemastik18",
|
|
|
|
|
"category": "web",
|
|
|
|
|
"desc": "Flask blog with exiftool + SSTI",
|
|
|
|
|
"chall_offset": 0,
|
|
|
|
|
"ssh_offset": 22,
|
|
|
|
|
"enabled": true,
|
|
|
|
|
"service_dir": "blogpost",
|
2026-09-26 14:40:10 +08:00
|
|
|
"org_port": 10000,
|
|
|
|
|
"ssh_user": "ctfuser"
|
2026-09-25 14:04:33 +08:00
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"name": "carbeat",
|
|
|
|
|
"set": "gemastik18",
|
|
|
|
|
"category": "pwn",
|
|
|
|
|
"desc": "Binary exploitation menu",
|
|
|
|
|
"chall_offset": 1,
|
|
|
|
|
"ssh_offset": 23,
|
|
|
|
|
"enabled": true,
|
|
|
|
|
"service_dir": "carbeat",
|
2026-09-26 14:40:10 +08:00
|
|
|
"org_port": 11000,
|
|
|
|
|
"ssh_user": "ctfuser"
|
2026-09-25 14:04:33 +08:00
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"name": "cdn",
|
|
|
|
|
"set": "gemastik18",
|
|
|
|
|
"category": "web",
|
|
|
|
|
"desc": "CDN/image proxy SSTI",
|
|
|
|
|
"chall_offset": 2,
|
|
|
|
|
"ssh_offset": 24,
|
|
|
|
|
"enabled": true,
|
|
|
|
|
"service_dir": "cdn",
|
2026-09-26 14:40:10 +08:00
|
|
|
"org_port": 12000,
|
|
|
|
|
"ssh_user": "ctfuser"
|
2026-09-25 14:04:33 +08:00
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"name": "phew",
|
|
|
|
|
"set": "gemastik18",
|
|
|
|
|
"category": "crypto",
|
|
|
|
|
"desc": "Paillier crypto oracle",
|
|
|
|
|
"chall_offset": 3,
|
|
|
|
|
"ssh_offset": 25,
|
|
|
|
|
"enabled": true,
|
|
|
|
|
"service_dir": "phew",
|
2026-09-26 14:40:10 +08:00
|
|
|
"org_port": 13000,
|
|
|
|
|
"ssh_user": "ctfuser"
|
2026-09-25 14:04:33 +08:00
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"name": "sheesh",
|
|
|
|
|
"set": "gemastik18",
|
|
|
|
|
"category": "crypto",
|
|
|
|
|
"desc": "AES padding oracle",
|
|
|
|
|
"chall_offset": 4,
|
|
|
|
|
"ssh_offset": 26,
|
|
|
|
|
"enabled": true,
|
|
|
|
|
"service_dir": "sheesh",
|
2026-09-26 14:40:10 +08:00
|
|
|
"org_port": 14000,
|
|
|
|
|
"ssh_user": "ctfuser"
|
2026-09-25 14:04:33 +08:00
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"name": "warmup",
|
|
|
|
|
"set": "gemastik18",
|
|
|
|
|
"category": "warmup",
|
|
|
|
|
"desc": "Go file viewer (path traversal)",
|
|
|
|
|
"chall_offset": 5,
|
|
|
|
|
"ssh_offset": 27,
|
|
|
|
|
"enabled": true,
|
|
|
|
|
"service_dir": "warmup",
|
2026-09-26 14:40:10 +08:00
|
|
|
"org_port": 15000,
|
|
|
|
|
"ssh_user": "ctfuser"
|
2026-09-25 14:04:33 +08:00
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"name": "art",
|
|
|
|
|
"set": "xvi",
|
|
|
|
|
"category": "web",
|
|
|
|
|
"desc": "Ruby ASCII art renderer",
|
|
|
|
|
"chall_offset": 10,
|
|
|
|
|
"ssh_offset": 110,
|
2026-09-26 14:40:10 +08:00
|
|
|
"enabled": true,
|
2026-09-25 14:04:33 +08:00
|
|
|
"service_dir": "art",
|
2026-09-26 14:40:10 +08:00
|
|
|
"org_port": 10000,
|
|
|
|
|
"ssh_user": "root"
|
2026-09-25 14:04:33 +08:00
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"name": "xl",
|
|
|
|
|
"set": "xvi",
|
|
|
|
|
"category": "web",
|
|
|
|
|
"desc": "Node XL spreadsheets app",
|
|
|
|
|
"chall_offset": 11,
|
|
|
|
|
"ssh_offset": 111,
|
2026-09-26 14:40:10 +08:00
|
|
|
"enabled": true,
|
2026-09-25 14:04:33 +08:00
|
|
|
"service_dir": "xl",
|
2026-09-26 14:40:10 +08:00
|
|
|
"org_port": 11000,
|
|
|
|
|
"ssh_user": "root"
|
2026-09-25 14:04:33 +08:00
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"name": "gemas-notes",
|
|
|
|
|
"set": "xvi",
|
|
|
|
|
"category": "web",
|
|
|
|
|
"desc": "Note service + MySQL + validation (multi-container)",
|
|
|
|
|
"chall_offset": 12,
|
|
|
|
|
"ssh_offset": 112,
|
|
|
|
|
"enabled": false,
|
|
|
|
|
"service_dir": "gemas-notes",
|
2026-09-26 14:40:10 +08:00
|
|
|
"org_port": 12000,
|
|
|
|
|
"ssh_user": "root"
|
2026-09-25 14:04:33 +08:00
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"name": "pasta",
|
|
|
|
|
"set": "xvi",
|
|
|
|
|
"category": "web",
|
|
|
|
|
"desc": "Pasta pastebin (FTP-ish? web)",
|
|
|
|
|
"chall_offset": 13,
|
|
|
|
|
"ssh_offset": 113,
|
|
|
|
|
"enabled": false,
|
|
|
|
|
"service_dir": "pasta",
|
2026-09-26 14:40:10 +08:00
|
|
|
"org_port": 13000,
|
|
|
|
|
"ssh_user": "root"
|
2026-09-25 14:04:33 +08:00
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"name": "burvesigner",
|
|
|
|
|
"set": "xvi",
|
|
|
|
|
"category": "crypto",
|
|
|
|
|
"desc": "Burve-style signature oracle",
|
|
|
|
|
"chall_offset": 14,
|
|
|
|
|
"ssh_offset": 114,
|
|
|
|
|
"enabled": false,
|
|
|
|
|
"service_dir": "burvesigner",
|
2026-09-26 14:40:10 +08:00
|
|
|
"org_port": 14000,
|
|
|
|
|
"ssh_user": "root"
|
2026-09-25 14:04:33 +08:00
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"name": "hirnfick",
|
|
|
|
|
"set": "xvi",
|
|
|
|
|
"category": "pwn",
|
|
|
|
|
"desc": "Brainfuck-ish binary",
|
|
|
|
|
"chall_offset": 15,
|
|
|
|
|
"ssh_offset": 115,
|
|
|
|
|
"enabled": false,
|
|
|
|
|
"service_dir": "hirnfick",
|
2026-09-26 14:40:10 +08:00
|
|
|
"org_port": 15000,
|
|
|
|
|
"ssh_user": "root"
|
2026-09-25 14:04:33 +08:00
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"name": "gemas-fetcher",
|
|
|
|
|
"set": "xvi",
|
|
|
|
|
"category": "web",
|
|
|
|
|
"desc": "URL fetcher + MongoDB (multi-container)",
|
|
|
|
|
"chall_offset": 16,
|
|
|
|
|
"ssh_offset": 116,
|
|
|
|
|
"enabled": false,
|
|
|
|
|
"service_dir": "gemas-fetcher",
|
2026-09-26 14:40:10 +08:00
|
|
|
"org_port": 16000,
|
|
|
|
|
"ssh_user": "root"
|
2026-09-25 14:04:33 +08:00
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"name": "s3",
|
|
|
|
|
"set": "xvi",
|
|
|
|
|
"category": "web",
|
|
|
|
|
"desc": "S3-ish service",
|
|
|
|
|
"chall_offset": 20,
|
|
|
|
|
"ssh_offset": 120,
|
2026-09-26 14:40:10 +08:00
|
|
|
"enabled": true,
|
2026-09-25 14:04:33 +08:00
|
|
|
"service_dir": "s3",
|
2026-09-26 14:40:10 +08:00
|
|
|
"org_port": 20000,
|
|
|
|
|
"ssh_user": "root"
|
2026-09-25 14:04:33 +08:00
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"name": "crawlback",
|
|
|
|
|
"set": "xvi",
|
|
|
|
|
"category": "web",
|
|
|
|
|
"desc": "PHP crawlback SSRF",
|
|
|
|
|
"chall_offset": 21,
|
|
|
|
|
"ssh_offset": 121,
|
|
|
|
|
"enabled": false,
|
|
|
|
|
"service_dir": "crawlback",
|
2026-09-26 14:40:10 +08:00
|
|
|
"org_port": 21000,
|
|
|
|
|
"ssh_user": "root"
|
2026-09-25 14:04:33 +08:00
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"name": "back-to-basic",
|
|
|
|
|
"set": "xvi",
|
|
|
|
|
"category": "warmup",
|
|
|
|
|
"desc": "Warmup binary (warmup)",
|
|
|
|
|
"chall_offset": 22,
|
|
|
|
|
"ssh_offset": 122,
|
|
|
|
|
"enabled": false,
|
|
|
|
|
"service_dir": "back-to-basic",
|
2026-09-26 14:40:10 +08:00
|
|
|
"org_port": 22000,
|
|
|
|
|
"ssh_user": "root"
|
2026-09-25 14:04:33 +08:00
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"name": "anti-alchemy",
|
|
|
|
|
"set": "xvii",
|
|
|
|
|
"category": "web",
|
|
|
|
|
"desc": "Alchemy flask app (web)",
|
|
|
|
|
"chall_offset": 30,
|
|
|
|
|
"ssh_offset": 130,
|
2026-09-26 14:40:10 +08:00
|
|
|
"enabled": true,
|
2026-09-25 14:04:33 +08:00
|
|
|
"service_dir": "anti-alchemy",
|
2026-09-26 14:40:10 +08:00
|
|
|
"org_port": 11000,
|
|
|
|
|
"ssh_user": "root"
|
2026-09-25 14:04:33 +08:00
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"name": "asmr",
|
|
|
|
|
"set": "xvii",
|
|
|
|
|
"category": "pwn",
|
|
|
|
|
"desc": "ASMR pwn (ubuntu 24.04)",
|
|
|
|
|
"chall_offset": 31,
|
|
|
|
|
"ssh_offset": 131,
|
|
|
|
|
"enabled": false,
|
|
|
|
|
"service_dir": "asmr",
|
2026-09-26 14:40:10 +08:00
|
|
|
"org_port": 15000,
|
|
|
|
|
"ssh_user": "root"
|
2026-09-25 14:04:33 +08:00
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"name": "bit-canvas",
|
|
|
|
|
"set": "xvii",
|
|
|
|
|
"category": "pwn",
|
|
|
|
|
"desc": "C xinetd pwn",
|
|
|
|
|
"chall_offset": 32,
|
|
|
|
|
"ssh_offset": 132,
|
2026-09-26 14:40:10 +08:00
|
|
|
"enabled": true,
|
2026-09-25 14:04:33 +08:00
|
|
|
"service_dir": "bit-canvas",
|
2026-09-26 14:40:10 +08:00
|
|
|
"org_port": 20000,
|
|
|
|
|
"ssh_user": "root"
|
2026-09-25 14:04:33 +08:00
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"name": "fjb",
|
|
|
|
|
"set": "xvii",
|
|
|
|
|
"category": "web-pwn",
|
|
|
|
|
"desc": "Node web+pwn",
|
|
|
|
|
"chall_offset": 33,
|
|
|
|
|
"ssh_offset": 133,
|
|
|
|
|
"enabled": false,
|
|
|
|
|
"service_dir": "fjb",
|
2026-09-26 14:40:10 +08:00
|
|
|
"org_port": 17000,
|
|
|
|
|
"ssh_user": "root"
|
2026-09-25 14:04:33 +08:00
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"name": "gift-card",
|
|
|
|
|
"set": "xvii",
|
|
|
|
|
"category": "crypto",
|
|
|
|
|
"desc": "Crypto gift card",
|
|
|
|
|
"chall_offset": 34,
|
|
|
|
|
"ssh_offset": 134,
|
2026-09-26 14:40:10 +08:00
|
|
|
"enabled": true,
|
2026-09-25 14:04:33 +08:00
|
|
|
"service_dir": "gift-card",
|
2026-09-26 14:40:10 +08:00
|
|
|
"org_port": 21000,
|
|
|
|
|
"ssh_user": "root"
|
2026-09-25 14:04:33 +08:00
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"name": "gift-voucher",
|
|
|
|
|
"set": "xvii",
|
|
|
|
|
"category": "crypto",
|
|
|
|
|
"desc": "Crypto gift voucher",
|
|
|
|
|
"chall_offset": 35,
|
|
|
|
|
"ssh_offset": 135,
|
2026-09-26 14:40:10 +08:00
|
|
|
"enabled": true,
|
2026-09-25 14:04:33 +08:00
|
|
|
"service_dir": "gift-voucher",
|
2026-09-26 14:40:10 +08:00
|
|
|
"org_port": 16000,
|
|
|
|
|
"ssh_user": "root"
|
2026-09-25 14:04:33 +08:00
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"name": "gleam-drive",
|
|
|
|
|
"set": "xvii",
|
|
|
|
|
"category": "web-crypto",
|
|
|
|
|
"desc": "Gleam drive web-crypto",
|
|
|
|
|
"chall_offset": 36,
|
|
|
|
|
"ssh_offset": 136,
|
2026-09-26 14:40:10 +08:00
|
|
|
"enabled": true,
|
2026-09-25 14:04:33 +08:00
|
|
|
"service_dir": "gleam-drive",
|
2026-09-26 14:40:10 +08:00
|
|
|
"org_port": 12000,
|
|
|
|
|
"scheme": "https",
|
|
|
|
|
"ssh_user": "root"
|
2026-09-25 14:04:33 +08:00
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"name": "go-green",
|
|
|
|
|
"set": "xvii",
|
|
|
|
|
"category": "rev",
|
|
|
|
|
"desc": "Go reverse engineering (xinetd)",
|
|
|
|
|
"chall_offset": 37,
|
|
|
|
|
"ssh_offset": 137,
|
|
|
|
|
"enabled": false,
|
|
|
|
|
"service_dir": "go-green",
|
2026-09-26 14:40:10 +08:00
|
|
|
"org_port": 20000,
|
|
|
|
|
"ssh_user": "root"
|
2026-09-25 14:04:33 +08:00
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"name": "kode-viewer",
|
|
|
|
|
"set": "xvii",
|
|
|
|
|
"category": "web",
|
|
|
|
|
"desc": "Node kode viewer + redis (multi-container)",
|
|
|
|
|
"chall_offset": 38,
|
|
|
|
|
"ssh_offset": 138,
|
|
|
|
|
"enabled": false,
|
|
|
|
|
"service_dir": "kode-viewer",
|
2026-09-26 14:40:10 +08:00
|
|
|
"org_port": 10000,
|
|
|
|
|
"ssh_user": "root"
|
2026-09-25 14:04:33 +08:00
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"name": "more-less",
|
|
|
|
|
"set": "xvii",
|
|
|
|
|
"category": "web",
|
|
|
|
|
"desc": "Python more/less web",
|
|
|
|
|
"chall_offset": 39,
|
|
|
|
|
"ssh_offset": 139,
|
2026-09-26 14:40:10 +08:00
|
|
|
"enabled": true,
|
2026-09-25 14:04:33 +08:00
|
|
|
"service_dir": "more-less",
|
2026-09-26 14:40:10 +08:00
|
|
|
"org_port": 22000,
|
|
|
|
|
"ssh_user": "root"
|
2026-09-25 14:04:33 +08:00
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"name": "tempest-poc",
|
|
|
|
|
"set": "xvii",
|
|
|
|
|
"category": "web",
|
|
|
|
|
"desc": "Tempest POC (backend + frontend)",
|
|
|
|
|
"chall_offset": 40,
|
|
|
|
|
"ssh_offset": 140,
|
|
|
|
|
"enabled": false,
|
|
|
|
|
"service_dir": "tempest-poc",
|
2026-09-26 14:40:10 +08:00
|
|
|
"org_port": 14080,
|
|
|
|
|
"ssh_user": "root"
|
2026-09-25 14:04:33 +08:00
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"name": "ticketer",
|
|
|
|
|
"set": "xvii",
|
|
|
|
|
"category": "crypto",
|
|
|
|
|
"desc": "Ticketer crypto oracle (socat)",
|
|
|
|
|
"chall_offset": 41,
|
|
|
|
|
"ssh_offset": 141,
|
2026-09-26 14:40:10 +08:00
|
|
|
"enabled": true,
|
2026-09-25 14:04:33 +08:00
|
|
|
"service_dir": "ticketer",
|
2026-09-26 14:40:10 +08:00
|
|
|
"org_port": 14000,
|
|
|
|
|
"ssh_user": "root"
|
2026-09-25 14:04:33 +08:00
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
}
|