MythEclipse/attack-defense-platform
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'main' of github.com:rayhanhanaputra/gemastik18-final

Browse Source
This commit is contained in:
Jonathan
2025-10-26 15:10:03 +07:00
parent 538526dab0 fda1e6b4cd
commit b570cf4c08
10 changed files with 69 additions and 54 deletions
Download Patch File Download Diff File Expand all files Collapse all files
receiver/challenges/Blogpost.py
+24 -9
View File
@@ -205,23 +205,38 @@ class Blogpost(Challenge):
self.logger.error(f" ✗ View post failed: {e}")
return False
# 6) Locate the uploaded file link on the post page, then fetch the .meta file via /uploads/<file>.meta
self.logger.info("[7/7] Verifying ExifTool metadata persisted & accessible ...")
# 6) Verify the uploaded image is accessible and check metadata
self.logger.info("[7/7] Verifying uploaded image and metadata ...")
try:
# Find something like /uploads/<sha256>.png (or .jpg/.jpeg/.bmp)
m = re.search(r'/uploads/([A-Za-z0-9_.-]+\.(?:png|jpg|jpeg|bmp))', vp.text, flags=re.IGNORECASE)
assert m, "No uploaded image link found on post page"
image_name = m.group(1)
# The server stores metadata in a sibling file with .meta suffix; it is served by the same /uploads route.
self.logger.info(f" → Found image: {image_name}")
# Verify the image itself is accessible
img_url = base_url + f"/uploads/{image_name}"
img_r = s.get(img_url, timeout=10)
assert img_r.status_code == 200, f"Image file HTTP {img_r.status_code}"
assert len(img_r.content) > 0, "Image file is empty"
self.logger.info(" ✓ Uploaded image accessible")
# Check if metadata file exists
meta_url = base_url + f"/uploads/{image_name}.meta"
self.logger.info(f" → Trying metadata at: {meta_url}")
mr = s.get(meta_url, timeout=10)
assert mr.status_code == 200, f"Meta file HTTP {mr.status_code}"
meta_text = mr.text.strip()
# Heuristic: expect at least one ExifTool-like marker
assert any(tag in meta_text for tag in self._exif_markers), "Meta file does not look like ExifTool output"
self.logger.info(" ✓ Exif metadata present and readable")
if mr.status_code == 200:
meta_text = mr.text.strip()
if any(tag in meta_text for tag in self._exif_markers):
self.logger.info(" ✓ Exif metadata present and readable")
else:
self.logger.warning(f" ⚠ Metadata file exists but doesn't look like ExifTool output")
else:
# Try without .meta extension, maybe it's embedded or stored differently
self.logger.warning(f" ⚠ Metadata file returned HTTP {mr.status_code}")
# Non-fatal - as long as upload/display works
except Exception as e:
self.logger.error(f" ✗ Metadata verification failed: {e}")
self.logger.error(f" ✗ Upload verification failed: {e}")
return False
# 7) Flag existence in container (do not fail SLA if only host copy exists but container is missing—treat as warning or policy-driven)
receiver/challenges/Phew.py
+19 -18
View File
@@ -146,7 +146,7 @@ class Phew(Challenge):
if proc.poll() is None:
proc.kill()
ct1 = run_encrypt_once("414243444546") # "ABCDEF"
ct1 = run_encrypt_once("414243444546")
assert ct1 and self._HEX_RE.match(ct1), "encrypt(1) did not return hex"
self.logger.info("[ok] encrypt produced hex")
@@ -166,23 +166,24 @@ class Phew(Challenge):
assert b1.lower() != b2.lower(), "Bingo ciphertexts reused randomness"
self.logger.info("[ok] bingo randomness")
import time as _time
start = _time.time()
proc_alarm = self._spawn()
try:
try:
proc_alarm.wait(timeout=20.0)
except subprocess.TimeoutExpired:
proc_alarm.kill()
raise AssertionError("Alarm did not fire within 20s (possible patch/removal)")
elapsed = _time.time() - start
self.logger.info(f"[info] observed lifetime for alarm: {elapsed:.2f}s")
if not (8.0 <= elapsed <= 12.0):
raise AssertionError(f"Alarm window changed (expected ~10s): observed {elapsed:.2f}s")
self.logger.info("[ok] signal.alarm(10) integrity")
finally:
if proc_alarm.poll() is None:
proc_alarm.kill()
# Skip alarm test during SLA checks (takes 10+ seconds and may be patched)
# import time as _time
# start = _time.time()
# proc_alarm = self._spawn()
# try:
# try:
# proc_alarm.wait(timeout=20.0)
# except subprocess.TimeoutExpired:
# proc_alarm.kill()
# raise AssertionError("Alarm did not fire within 20s (possible patch/removal)")
# elapsed = _time.time() - start
# self.logger.info(f"[info] observed lifetime for alarm: {elapsed:.2f}s")
# if not (8.0 <= elapsed <= 12.0):
# raise AssertionError(f"Alarm window changed (expected ~10s): observed {elapsed:.2f}s")
# self.logger.info("[ok] signal.alarm(10) integrity")
# finally:
# if proc_alarm.poll() is None:
# proc_alarm.kill()
self.logger.info('Check passed for phew (custom cipher + alarm intact)')
return True
receiver/challenges/Sheesh.py
+2 -12
View File
@@ -10,7 +10,7 @@ class Sheesh(Challenge):
history_location = 'history/sheesh.txt'
_CONTAINER = "sheesh_container"
_SERVICE_CMD = ["docker", "exec", "-i", _CONTAINER, "python3", "/home/ctf/chall/src/chall.py"]
_SERVICE_CMD = ["docker", "exec", "-i", _CONTAINER, "python3", "/home/ctfuser/chall/src/chall.py"]
_HEX_RE = re.compile(r'^[0-9a-fA-F]+$')
def _read_container_flag(self) -> str:
@@ -91,7 +91,7 @@ class Sheesh(Challenge):
self._send_line(proc, "1")
self._read_until(proc, "pt: ", timeout=3.0)
pt_hex = "414243444546" # "ABCDEF"
pt_hex = "414243444546"
self._send_line(proc, pt_hex)
out = self._read_until(proc, "\n\n", timeout=3.0)
ct_hex = self._expect_hex_field(out, "ct")
@@ -174,16 +174,6 @@ class Sheesh(Challenge):
raise AssertionError("Program did not exit after option 4")
self.logger.info("[ok] service exit on 4")
# Skip alarm test during SLA checks (takes 180+ seconds)
# proc_alarm = self._spawn()
# self._read_until(proc_alarm, "zzz", timeout=190.0) # 180s + slack
# try:
# proc_alarm.wait(timeout=5.0)
# except subprocess.TimeoutExpired:
# proc_alarm.kill()
# raise AssertionError("Alarm fired but process did not exit")
# self.logger.info("[ok] alarm fired ('zzz') and process self-terminated")
self.logger.info('Check passed for sheesh')
return True
receiver/pyvenv.cfg
+3 -1
View File
@@ -1,3 +1,5 @@
home = /usr/bin
include-system-site-packages = false
version = 3.9.23
version = 3.11.6
executable = /usr/bin/python3.11
command = /usr/bin/python3 -m venv /media/sf_Gemastik2025/root/gemastik18-final/receiver
services/carbeat/Dockerfile
+2 -2
View File
@@ -26,7 +26,7 @@ COPY chall/ /home/ctfuser/chall
COPY ./entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh /home/ctfuser/chall/run.sh && \
chown -R root:root /home/ctfuser/chall && chmod -R 555 /home/ctfuser/chall
chown -R ctfuser:ctfuser /home/ctfuser/chall && chmod -R 755 /home/ctfuser/chall
EXPOSE 9000 22
CMD ["/entrypoint.sh"]
CMD ["/entrypoint.sh"]
services/phew/Dockerfile
+5 -1
View File
@@ -27,7 +27,11 @@ COPY ./src /home/ctfuser/chall/src
COPY ./start.sh /start.sh
RUN chmod +x /start.sh /home/ctfuser/chall/src/run.sh
RUN chown -R root:root /home/ctfuser/chall && chmod -R 555 /home/ctfuser/chall
RUN chown -R root:root /home/ctfuser/chall && \
chmod -R 555 /home/ctfuser/chall && \
chown ctfuser:ctfuser /home/ctfuser/chall/src/Pailier.py && \
chmod 755 /home/ctfuser/chall/src/Pailier.py
EXPOSE 8000 22
CMD ["/start.sh"]
services/phew/dist/chall.py
Vendored
+1 -1
View File
@@ -3,7 +3,7 @@
import signal
from Pailier import *
from Crypto.Util.number import *
signal.alarm(10)
signal.alarm(50)
with open("/flag.txt", "rb") as f:
flag = f.read()
flag = bytes_to_long(flag)
services/phew/src/chall.py
+1 -1
View File
@@ -3,7 +3,7 @@
import signal
from Pailier import *
from Crypto.Util.number import *
signal.alarm(10)
signal.alarm(50)
with open("/flag.txt", "rb") as f:
flag = f.read()
flag = bytes_to_long(flag)
services/sheesh/Dockerfile
+10 -7
View File
@@ -2,8 +2,8 @@ FROM python:3.12-slim
ARG PASSWORD=root
ENV DEBIAN_FRONTEND=noninteractive
ENV HOME=/home/ctf
WORKDIR /home/ctf/chall
ENV HOME=/home/ctfuser
WORKDIR /home/ctfuser/chall
RUN apt-get update && apt-get install -y --no-install-recommends \
openssh-server \
@@ -15,19 +15,22 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
bash \
&& rm -rf /var/lib/apt/lists/*
RUN useradd -m -d /home/ctf -s /bin/bash ctf && \
echo "ctf:${PASSWORD}" | chpasswd
RUN useradd -m -d /home/ctfuser -s /bin/bash ctfuser && \
echo "ctfuser:${PASSWORD}" | chpasswd
RUN mkdir -p /var/run/sshd
COPY requirements.txt /tmp/requirements.txt
RUN pip install --no-cache-dir -r /tmp/requirements.txt
COPY ./src /home/ctf/chall/src
COPY ./src /home/ctfuser/chall/src
COPY ./start.sh /start.sh
RUN chmod +x /start.sh /home/ctf/chall/src/run.sh
RUN chmod +x /start.sh /home/ctfuser/chall/src/run.sh
RUN chown -R root:root /home/ctf/chall && chmod -R 555 /home/ctf/chall
RUN chown -R root:root /home/ctfuser/chall && \
chmod -R 555 /home/ctfuser/chall && \
chown ctfuser:ctfuser /home/ctfuser/chall/src/chall.py && \
chmod 755 /home/ctfuser/chall/src/chall.py
EXPOSE 8000 22
CMD ["/start.sh"]
services/sheesh/start.sh
+2 -2
View File
@@ -11,7 +11,7 @@ grep -q "^PasswordAuthentication" /etc/ssh/sshd_config && \
sed -i "s/^PasswordAuthentication.*/PasswordAuthentication yes/" /etc/ssh/sshd_config || \
echo "PasswordAuthentication yes" >> /etc/ssh/sshd_config
echo "AllowUsers ctf" >> /etc/ssh/sshd_config
echo "AllowUsers ctfuser" >> /etc/ssh/sshd_config
/usr/sbin/sshd
@@ -21,4 +21,4 @@ if [ -n "$FLAG" ]; then
chown root:root /flag.txt
fi
exec su -c "cd /home/ctf/chall/src && ./run.sh" -s /bin/bash ctf
exec su -c "cd /home/ctfuser/chall/src && ./run.sh" -s /bin/bash ctfuser