try checker

This commit is contained in:
rafliher committed 2025-10-25 14:48:20 +07:00
1 parent 41a170543b
commit 0d216d77eb
10 files changed
+85 -108

No files matched your search

@@ -15,7 +15,7 @@ from PIL import Image # pillow for tiny PNG generation
from .Challenge import Challenge from .Challenge import Challenge
class WebAppSLA(Challenge): class Blogspot(Challenge):
""" """
SLA checker for the provided Flask challenge app. SLA checker for the provided Flask challenge app.
@@ -26,8 +26,8 @@ class WebAppSLA(Challenge):
- Login flow at /login, register at /register - Login flow at /login, register at /register
- Create post at /create, view post at /post/<id>, uploads at /uploads/<file> - Create post at /create, view post at /post/<id>, uploads at /uploads/<file>
""" """
flag_location = 'flags/webapp.txt' # Host copy (used by your orchestrator) flag_location = 'flags/blogspot.txt' # Host copy (used by your orchestrator)
history_location = 'history/webapp.txt' history_location = 'history/blogspot.txt'
container_flag_path = '/flag.txt' container_flag_path = '/flag.txt'
container_name = 'blogpost_container' # <-- set to your actual container name container_name = 'blogpost_container' # <-- set to your actual container name
@@ -12,7 +12,7 @@ from PIL import Image
from .Challenge import Challenge from .Challenge import Challenge
class WebAppSLA(Challenge): class CDN(Challenge):
""" """
SLA checker for the Flask app. SLA checker for the Flask app.
@@ -23,8 +23,8 @@ class WebAppSLA(Challenge):
""" """
# Paths & infra knobs # Paths & infra knobs
flag_location = 'flags/webapp.txt' # host copy (written by your orchestrator) flag_location = 'flags/cdn.txt' # host copy (written by your orchestrator)
history_location = 'history/webapp.txt' history_location = 'history/cdn.txt'
container_flag_path = '/flag.txt' container_flag_path = '/flag.txt'
container_name = 'chal_app' # adjust if your container name differs container_name = 'chal_app' # adjust if your container name differs
@@ -34,6 +34,25 @@ class WebAppSLA(Challenge):
'Date Created', 'Date Created',
) )
# --- Flag distribution hook (optional, mirrors your example) ---
def distribute(self, flag: str) -> bool:
"""
Writes/records the current flag on the host. Your infra may separately
mount/copy it into the container; this class *also* verifies existence
inside the container during .check().
"""
self._make_logger()
try:
with open(self.flag_location, 'w') as f:
f.write(flag)
with open(self.history_location, 'a') as f:
f.write(flag + '\n')
self.logger.info(f"Flag '{flag}' written to {self.flag_location}")
return True
except Exception as e:
self.logger.error(f"Failed writing host flag: {e}")
return False
def _make_logger(self): def _make_logger(self):
if not hasattr(self, 'logger') or self.logger is None: if not hasattr(self, 'logger') or self.logger is None:
self.logger = logging.getLogger(self.__class__.__name__) self.logger = logging.getLogger(self.__class__.__name__)
-1
View File
@@ -4,7 +4,6 @@ import string
from config import get_settings from config import get_settings
class Challenge(object): class Challenge(object):
name = __name__ name = __name__
settings = get_settings() settings = get_settings()
@@ -5,7 +5,7 @@ import time
import re import re
import os import os
class PailierBingo(Challenge): class Phew(Challenge):
flag_location = 'flags/phew.txt' flag_location = 'flags/phew.txt'
history_location = 'history/phew.txt' history_location = 'history/phew.txt'
File renamed without changes.
-88
View File
@@ -1,88 +0,0 @@
from .Challenge import Challenge
import io
import requests
import random
import subprocess
import requests
import re
class Wanderer(Challenge):
flag_location = 'flags/wanderer.txt'
history_location = 'history/wanderer.txt'
def distribute(self, flag):
try:
with open(self.flag_location, 'w') as f:
f.write(flag)
with open(self.history_location, 'a') as f:
f.write(flag + '\n')
self.logger.info(f'Flag {flag} written to {self.flag_location}')
return True
except Exception as e:
self.logger.error(f'Could not write flag to {self.flag_location}: {e}')
return False
def check(self):
try:
session = requests.Session()
# Step 1: Check Register
register_url = f'http://localhost:{self.port}/index.php?module=user&action=register'
registration_data = {'username': 'adminwreckitchecker','password': 'adminwreckitchecker'}
response = session.post(register_url, data=registration_data)
assert "username already exists" in response.text or "Registration Success" in response.text or response.status_code == 200 , 'Function Register Failed'
# Step 2: Check Login
login_url = f'http://localhost:{self.port}/index.php?module=user&action=login'
login_data = {'username': 'adminwreckitchecker', 'password': 'adminwreckitchecker'}
response = session.post(login_url, data=login_data)
assert "Login Success" in response.text or response.status_code == 200, 'Login function failed'
# Step 3: Check UUID Not hidden
view_page_url = f'http://localhost:{self.port}/index.php?module=page&action=viewPage'
response = session.get(view_page_url)
uuid_pattern = re.compile(r'[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}')
found_uuids = uuid_pattern.findall(response.text)
assert found_uuids, 'UUID not found'
# Step 4: Check create sample page
sample_page_url = f'http://localhost:{self.port}/index.php?module=page&action=samplePage'
response = session.get(sample_page_url)
assert "Create Success" in response.text or response.status_code == 200, 'Create Sample Failed'
# Step 5: Check Edit HTML Functionality
edit_url_html = f'http://localhost:{self.port}/index.php?module=user&action=edit&type=html'
response = session.get(edit_url_html)
assert response.status_code == 200, 'Edit html page not accessible'
# Step 6: Check Edit JS Functionality
edit_url_js = f'http://localhost:{self.port}/index.php?module=user&action=edit&type=js'
response = session.get(edit_url_js)
assert response.status_code == 200, 'Edit js page not accessible'
# Step 7: Check Edit CSS Functionality
edit_url_css = f'http://localhost:{self.port}/index.php?module=user&action=edit&type=css'
response = session.get(edit_url_css)
assert response.status_code == 200, 'Edit css page not accessible'
# Step 8: Check flag
with open(self.flag_location, 'r') as f:
host_flag = f.read().strip()
container_flag = subprocess.run(
["docker", "exec", "wanderer_container", "cat", "/flag.txt"],
capture_output=True,
text=True
).stdout.strip()
assert host_flag == container_flag, 'Flag mismatch between host and container'
self.logger.info('Check passed for wanderer')
return True
except Exception as e:
self.logger.error(f'Could not check wanderer: {e}')
return False
+41
View File
@@ -0,0 +1,41 @@
from .Challenge import Challenge
import io
import requests
import random
import subprocess
class Warmup(Challenge):
flag_location = 'flags/warmup.txt'
history_location = 'history/warmup.txt'
def distribute(self, flag):
try:
with open(self.flag_location, 'w') as f:
f.write(flag)
with open(self.history_location, 'a') as f:
f.write(flag + '\n')
self.logger.info(f'Flag {flag} written to {self.flag_location}')
return True
except Exception as e:
self.logger.error(f'Could not write flag to {self.flag_location}: {e}')
return False
def check(self):
try:
url = f'http://localhost:{self.port}/'
r = requests.get(url, timeout=5)
assert "Simple file viewing application" in r.text.lower(), 'Warmup app not available'
with open(self.flag_location, 'r') as f:
host_flag = f.read().strip()
container_flag = subprocess.run([
"docker", "exec", "warmup_container", "cat", "/flag.txt"
], capture_output=True, text=True).stdout.strip()
assert host_flag == container_flag, 'Flag mismatch between host and container'
self.logger.info('Check passed for warmup')
return True
except Exception as e:
self.logger.error(f'Could not check warmup: {e}')
return False
+12 -4
View File
@@ -3,8 +3,12 @@ from pydantic import BaseModel
from fastapi.security import HTTPBasic, HTTPBasicCredentials from fastapi.security import HTTPBasic, HTTPBasicCredentials
from config import get_settings from config import get_settings
from challenges.Poke import Poke from challenges.Blogspot import Blogspot
from challenges.Blinkpdf import BlinkPDF from challenges.Carbeat import Carbeat
from challenges.CDN import CDN
from challenges.Phew import Phew
from challenges.Sheesh import Sheesh
from challenges.Warmup import Warmup
import os import os
@@ -13,8 +17,12 @@ security = HTTPBasic()
settings = get_settings() settings = get_settings()
challenges = { challenges = {
"blogpost": Poke(10000), "blogpost": Blogspot(10000),
"cdn": BlinkPDF(11000), "carbeat": Carbeat(11000),
"cdn": CDN(12000),
"phew": Phew(13000),
"sheesh": Sheesh(14000),
"warmup": Warmup(15000),
} }
class Flag(BaseModel): class Flag(BaseModel):
-2
View File
@@ -1,5 +1,3 @@
version: '3.1'
services: services:
# --- blogpost --- # --- blogpost ---
blogpost: blogpost:
+6 -6
View File
@@ -35,12 +35,12 @@ def main():
os.chdir(os.path.join(cwd, 'services')) os.chdir(os.path.join(cwd, 'services'))
os.system(f'docker compose -f docker-compose.yml up --build -d {args.challenges}') os.system(f'docker compose -f docker-compose.yml up --build -d {args.challenges}')
# os.chdir(os.path.join(cwd, 'receiver')) os.chdir(os.path.join(cwd, 'receiver'))
# os.system('apt-get install -y gcc python3-dev libgmp3-dev libssl-dev libffi-dev build-essential python3-venv') os.system('apt-get install -y gcc python3-dev libgmp3-dev libssl-dev libffi-dev build-essential python3-venv')
# os.system('python3 -m venv .') os.system('python3 -m venv .')
# os.system('sudo ./bin/activate') os.system('sudo ./bin/activate')
# os.system('sudo ./bin/python3 -m pip install -r requirements.txt') os.system('sudo ./bin/python3 -m pip install -r requirements.txt')
# os.system('sudo ./bin/python3 -m uvicorn main:app --reload --host 0.0.0.0 --port 80') os.system('sudo ./bin/python3 -m uvicorn main:app --reload --host 0.0.0.0 --port 80')
if __name__ == '__main__': if __name__ == '__main__':
main() main()