MythEclipse/attack-defense-platform
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
main
attack-defense-platform/teams/challenge_registry.json
T
Cyrene ae50acfe40 fix(ssh): per-challenge SSH login + phew buffering/leak/timeout 
Passwords failed on 10/16 challenges while state.json looked correct:
- only the 6 native GEMASTIK XVIII images provision 'ctfuser'; every imported
  XVI/XVII image does 'echo root:${PASSWORD} | chpasswd' and logs in as root.
  set_ssh_passwords() hardcoded ctfuser, so chpasswd set a password on an
  account nobody uses -> 'Permission denied' everywhere.
  Registry gains a per-challenge 'ssh_user'; chpasswd now targets the real
  login (and ctfuser/ctf when present) and reports failures loudly.
- phew checker: chall.py block-buffers stdout through the docker exec pipe
  (PYTHONUNBUFFERED now set) and leaks chall.py inside the container on
  timeout (26 orphans, container saturated) -> reaps the whole exec process
  group. Startup does a fresh Pailier keygen (~12 s) so crypto reads need
  _CRYPTO_TIMEOUT, not the 5 s prompt default.

Adds panel/verify_ssh_creds.py (proves the state->container binding from
inside via a real login), audit_ssh_users.sh, reset_runtime.sh.
2026-09-26 14:40:10 +08:00

358 lines
8.4 KiB
JSON
Raw Permalink Blame History

{
"sets": {
"gemastik18": {
"label": "GEMASTIK XVIII",
"repo": "github.com/rayhanhanaputra/gemastik18-final",
"note": "Game aktif saat ini"
},
"xvi": {
"label": "GEMASTIK XVI",
"repo": "github.com/vidner/gemastik-xvi-final",
"note": "Distributed \u2014 toggle untuk aktifkan"
},
"xvii": {
"label": "GEMASTIK XVII",
"repo": "github.com/vidner/gemastik-xvii-final",
"note": "Distributed \u2014 toggle untuk aktifkan"
}
},
"challenges": [
{
"name": "blogpost",
"set": "gemastik18",
"category": "web",
"desc": "Flask blog with exiftool + SSTI",
"chall_offset": 0,
"ssh_offset": 22,
"enabled": true,
"service_dir": "blogpost",
"org_port": 10000,
"ssh_user": "ctfuser"
},
{
"name": "carbeat",
"set": "gemastik18",
"category": "pwn",
"desc": "Binary exploitation menu",
"chall_offset": 1,
"ssh_offset": 23,
"enabled": true,
"service_dir": "carbeat",
"org_port": 11000,
"ssh_user": "ctfuser"
},
{
"name": "cdn",
"set": "gemastik18",
"category": "web",
"desc": "CDN/image proxy SSTI",
"chall_offset": 2,
"ssh_offset": 24,
"enabled": true,
"service_dir": "cdn",
"org_port": 12000,
"ssh_user": "ctfuser"
},
{
"name": "phew",
"set": "gemastik18",
"category": "crypto",
"desc": "Paillier crypto oracle",
"chall_offset": 3,
"ssh_offset": 25,
"enabled": true,
"service_dir": "phew",
"org_port": 13000,
"ssh_user": "ctfuser"
},
{
"name": "sheesh",
"set": "gemastik18",
"category": "crypto",
"desc": "AES padding oracle",
"chall_offset": 4,
"ssh_offset": 26,
"enabled": true,
"service_dir": "sheesh",
"org_port": 14000,
"ssh_user": "ctfuser"
},
{
"name": "warmup",
"set": "gemastik18",
"category": "warmup",
"desc": "Go file viewer (path traversal)",
"chall_offset": 5,
"ssh_offset": 27,
"enabled": true,
"service_dir": "warmup",
"org_port": 15000,
"ssh_user": "ctfuser"
},
{
"name": "art",
"set": "xvi",
"category": "web",
"desc": "Ruby ASCII art renderer",
"chall_offset": 10,
"ssh_offset": 110,
"enabled": true,
"service_dir": "art",
"org_port": 10000,
"ssh_user": "root"
},
{
"name": "xl",
"set": "xvi",
"category": "web",
"desc": "Node XL spreadsheets app",
"chall_offset": 11,
"ssh_offset": 111,
"enabled": true,
"service_dir": "xl",
"org_port": 11000,
"ssh_user": "root"
},
{
"name": "gemas-notes",
"set": "xvi",
"category": "web",
"desc": "Note service + MySQL + validation (multi-container)",
"chall_offset": 12,
"ssh_offset": 112,
"enabled": false,
"service_dir": "gemas-notes",
"org_port": 12000,
"ssh_user": "root"
},
{
"name": "pasta",
"set": "xvi",
"category": "web",
"desc": "Pasta pastebin (FTP-ish? web)",
"chall_offset": 13,
"ssh_offset": 113,
"enabled": false,
"service_dir": "pasta",
"org_port": 13000,
"ssh_user": "root"
},
{
"name": "burvesigner",
"set": "xvi",
"category": "crypto",
"desc": "Burve-style signature oracle",
"chall_offset": 14,
"ssh_offset": 114,
"enabled": false,
"service_dir": "burvesigner",
"org_port": 14000,
"ssh_user": "root"
},
{
"name": "hirnfick",
"set": "xvi",
"category": "pwn",
"desc": "Brainfuck-ish binary",
"chall_offset": 15,
"ssh_offset": 115,
"enabled": false,
"service_dir": "hirnfick",
"org_port": 15000,
"ssh_user": "root"
},
{
"name": "gemas-fetcher",
"set": "xvi",
"category": "web",
"desc": "URL fetcher + MongoDB (multi-container)",
"chall_offset": 16,
"ssh_offset": 116,
"enabled": false,
"service_dir": "gemas-fetcher",
"org_port": 16000,
"ssh_user": "root"
},
{
"name": "s3",
"set": "xvi",
"category": "web",
"desc": "S3-ish service",
"chall_offset": 20,
"ssh_offset": 120,
"enabled": true,
"service_dir": "s3",
"org_port": 20000,
"ssh_user": "root"
},
{
"name": "crawlback",
"set": "xvi",
"category": "web",
"desc": "PHP crawlback SSRF",
"chall_offset": 21,
"ssh_offset": 121,
"enabled": false,
"service_dir": "crawlback",
"org_port": 21000,
"ssh_user": "root"
},
{
"name": "back-to-basic",
"set": "xvi",
"category": "warmup",
"desc": "Warmup binary (warmup)",
"chall_offset": 22,
"ssh_offset": 122,
"enabled": false,
"service_dir": "back-to-basic",
"org_port": 22000,
"ssh_user": "root"
},
{
"name": "anti-alchemy",
"set": "xvii",
"category": "web",
"desc": "Alchemy flask app (web)",
"chall_offset": 30,
"ssh_offset": 130,
"enabled": true,
"service_dir": "anti-alchemy",
"org_port": 11000,
"ssh_user": "root"
},
{
"name": "asmr",
"set": "xvii",
"category": "pwn",
"desc": "ASMR pwn (ubuntu 24.04)",
"chall_offset": 31,
"ssh_offset": 131,
"enabled": false,
"service_dir": "asmr",
"org_port": 15000,
"ssh_user": "root"
},
{
"name": "bit-canvas",
"set": "xvii",
"category": "pwn",
"desc": "C xinetd pwn",
"chall_offset": 32,
"ssh_offset": 132,
"enabled": true,
"service_dir": "bit-canvas",
"org_port": 20000,
"ssh_user": "root"
},
{
"name": "fjb",
"set": "xvii",
"category": "web-pwn",
"desc": "Node web+pwn",
"chall_offset": 33,
"ssh_offset": 133,
"enabled": false,
"service_dir": "fjb",
"org_port": 17000,
"ssh_user": "root"
},
{
"name": "gift-card",
"set": "xvii",
"category": "crypto",
"desc": "Crypto gift card",
"chall_offset": 34,
"ssh_offset": 134,
"enabled": true,
"service_dir": "gift-card",
"org_port": 21000,
"ssh_user": "root"
},
{
"name": "gift-voucher",
"set": "xvii",
"category": "crypto",
"desc": "Crypto gift voucher",
"chall_offset": 35,
"ssh_offset": 135,
"enabled": true,
"service_dir": "gift-voucher",
"org_port": 16000,
"ssh_user": "root"
},
{
"name": "gleam-drive",
"set": "xvii",
"category": "web-crypto",
"desc": "Gleam drive web-crypto",
"chall_offset": 36,
"ssh_offset": 136,
"enabled": true,
"service_dir": "gleam-drive",
"org_port": 12000,
"scheme": "https",
"ssh_user": "root"
},
{
"name": "go-green",
"set": "xvii",
"category": "rev",
"desc": "Go reverse engineering (xinetd)",
"chall_offset": 37,
"ssh_offset": 137,
"enabled": false,
"service_dir": "go-green",
"org_port": 20000,
"ssh_user": "root"
},
{
"name": "kode-viewer",
"set": "xvii",
"category": "web",
"desc": "Node kode viewer + redis (multi-container)",
"chall_offset": 38,
"ssh_offset": 138,
"enabled": false,
"service_dir": "kode-viewer",
"org_port": 10000,
"ssh_user": "root"
},
{
"name": "more-less",
"set": "xvii",
"category": "web",
"desc": "Python more/less web",
"chall_offset": 39,
"ssh_offset": 139,
"enabled": true,
"service_dir": "more-less",
"org_port": 22000,
"ssh_user": "root"
},
{
"name": "tempest-poc",
"set": "xvii",
"category": "web",
"desc": "Tempest POC (backend + frontend)",
"chall_offset": 40,
"ssh_offset": 140,
"enabled": false,
"service_dir": "tempest-poc",
"org_port": 14080,
"ssh_user": "root"
},
{
"name": "ticketer",
"set": "xvii",
"category": "crypto",
"desc": "Ticketer crypto oracle (socat)",
"chall_offset": 41,
"ssh_offset": 141,
"enabled": true,
"service_dir": "ticketer",
"org_port": 14000,
"ssh_user": "root"
}
]
}
Reference in New Issue View Git Blame Copy Permalink