fix(ssh): per-challenge SSH login + phew buffering/leak/timeout
Passwords failed on 10/16 challenges while state.json looked correct:
- only the 6 native GEMASTIK XVIII images provision 'ctfuser'; every imported
XVI/XVII image does 'echo root:${PASSWORD} | chpasswd' and logs in as root.
set_ssh_passwords() hardcoded ctfuser, so chpasswd set a password on an
account nobody uses -> 'Permission denied' everywhere.
Registry gains a per-challenge 'ssh_user'; chpasswd now targets the real
login (and ctfuser/ctf when present) and reports failures loudly.
- phew checker: chall.py block-buffers stdout through the docker exec pipe
(PYTHONUNBUFFERED now set) and leaks chall.py inside the container on
timeout (26 orphans, container saturated) -> reaps the whole exec process
group. Startup does a fresh Pailier keygen (~12 s) so crypto reads need
_CRYPTO_TIMEOUT, not the 5 s prompt default.
Adds panel/verify_ssh_creds.py (proves the state->container binding from
inside via a real login), audit_ssh_users.sh, reset_runtime.sh.
This commit is contained in:
Cyrene
+288
-200
@@ -1,200 +1,288 @@
|
||||
from .Challenge import Challenge
|
||||
|
||||
import subprocess
|
||||
import time
|
||||
import re
|
||||
import os
|
||||
|
||||
class Phew(Challenge):
|
||||
flag_location = 'flags/phew.txt'
|
||||
history_location = 'history/phew.txt'
|
||||
|
||||
_CONTAINER = os.environ.get("CHALLENGE_CONTAINER_PHEW", "phew_container")
|
||||
_SERVICE_CMD = ["docker", "exec", "-i", _CONTAINER, "python3", "/home/ctfuser/chall/src/chall.py"]
|
||||
_HEX_RE = re.compile(r'^[0-9a-fA-F]+$')
|
||||
|
||||
def _read_container_flag(self) -> str:
|
||||
# NB: a timeout is mandatory here. `docker exec` against a container
|
||||
# whose process table is saturated (accumulated chall.py zombies) can
|
||||
# block forever and take the whole SLA check loop down with it.
|
||||
try:
|
||||
out = subprocess.run(["docker", "exec", self._CONTAINER, "cat", "/flag.txt"],
|
||||
capture_output=True, text=True, timeout=30)
|
||||
except subprocess.TimeoutExpired:
|
||||
raise TimeoutError("docker exec cat /flag.txt timed out (container overloaded?)")
|
||||
if out.returncode != 0 or not out.stdout.strip():
|
||||
raise FileNotFoundError("Flag not found in container (/flag.txt)")
|
||||
return out.stdout.strip()
|
||||
|
||||
def _spawn(self):
|
||||
return subprocess.Popen(
|
||||
self._SERVICE_CMD,
|
||||
stdin=subprocess.PIPE,
|
||||
stdout=subprocess.PIPE,
|
||||
stderr=subprocess.STDOUT,
|
||||
text=True,
|
||||
bufsize=0,
|
||||
)
|
||||
|
||||
def _read_until(self, proc, token, timeout=5.0, max_bytes=1_000_000):
|
||||
start = time.time()
|
||||
buf = []
|
||||
r = proc.stdout.read
|
||||
while True:
|
||||
if time.time() - start > timeout:
|
||||
tail = ''.join(buf)[-500:]
|
||||
raise TimeoutError(f"Timeout waiting for '{token}'. Got so far:\n{tail}")
|
||||
ch = r(1)
|
||||
if ch == "" and proc.poll() is not None:
|
||||
raise RuntimeError(f"Process ended while waiting for '{token}'. Output:\n{''.join(buf)}")
|
||||
buf.append(ch)
|
||||
if len(buf) > max_bytes:
|
||||
raise RuntimeError("Exceeded max read size")
|
||||
if token in "".join(buf):
|
||||
return "".join(buf)
|
||||
|
||||
def _send_line(self, proc, s: str):
|
||||
proc.stdin.write(s + "\n")
|
||||
proc.stdin.flush()
|
||||
|
||||
def _expect_hex_field(self, text: str, label: str) -> str:
|
||||
m = re.search(rf"{re.escape(label)}\s*:\s*([0-9a-fA-F]+)", text)
|
||||
assert m, f"Missing '{label}' in output. Tail:\n{text[-400:]}"
|
||||
hx = m.group(1)
|
||||
assert self._HEX_RE.match(hx), f"{label} is not hex"
|
||||
return hx
|
||||
|
||||
def distribute(self, flag):
|
||||
try:
|
||||
os.makedirs(os.path.dirname(self.flag_location), exist_ok=True)
|
||||
with open(self.flag_location, 'w') as f:
|
||||
f.write(flag)
|
||||
|
||||
os.makedirs(os.path.dirname(self.history_location), exist_ok=True)
|
||||
with open(self.history_location, 'a') as f:
|
||||
f.write(flag + '\n')
|
||||
|
||||
self.logger.info(f'Flag {flag} written to {self.flag_location}')
|
||||
return True
|
||||
except Exception as e:
|
||||
self.logger.error(f'Could not write flag to {self.flag_location}: {e}')
|
||||
return False
|
||||
|
||||
def check(self):
|
||||
try:
|
||||
# parity check
|
||||
with open(self.flag_location, 'r') as f:
|
||||
host_flag = f.read().strip()
|
||||
container_flag = self._read_container_flag()
|
||||
assert host_flag == container_flag, 'Flag mismatch between host and container'
|
||||
self.logger.info('[ok] flag parity (phew)')
|
||||
|
||||
def run_encrypt_once(pt_hex: str) -> str:
|
||||
proc = self._spawn()
|
||||
try:
|
||||
self._read_until(proc, "> ", timeout=10.0)
|
||||
self._send_line(proc, "1")
|
||||
self._read_until(proc, "pt (hex)", timeout=3.0)
|
||||
self._read_until(proc, "> ", timeout=3.0)
|
||||
self._send_line(proc, pt_hex)
|
||||
out = self._read_until(proc, "> ", timeout=5.0)
|
||||
ct_hex = self._expect_hex_field(out, "ct")
|
||||
self._send_line(proc, "9")
|
||||
try:
|
||||
proc.wait(timeout=2.0)
|
||||
except subprocess.TimeoutExpired:
|
||||
proc.kill()
|
||||
raise AssertionError("Program did not exit after exit command (encrypt)")
|
||||
return ct_hex
|
||||
finally:
|
||||
if proc.poll() is None:
|
||||
proc.kill()
|
||||
|
||||
def run_decrypt_once(ct_hex: str) -> str:
|
||||
proc = self._spawn()
|
||||
try:
|
||||
self._read_until(proc, "> ", timeout=10.0)
|
||||
self._send_line(proc, "3")
|
||||
self._read_until(proc, "ct (hex)", timeout=3.0)
|
||||
self._read_until(proc, "> ", timeout=3.0)
|
||||
self._send_line(proc, ct_hex)
|
||||
out = self._read_until(proc, "> ", timeout=5.0)
|
||||
pt_hex = self._expect_hex_field(out, "pt")
|
||||
self._send_line(proc, "9")
|
||||
try:
|
||||
proc.wait(timeout=2.0)
|
||||
except subprocess.TimeoutExpired:
|
||||
proc.kill()
|
||||
raise AssertionError("Program did not exit after exit command (decrypt)")
|
||||
return pt_hex
|
||||
finally:
|
||||
if proc.poll() is None:
|
||||
proc.kill()
|
||||
|
||||
def run_keyct_once() -> str:
|
||||
proc = self._spawn()
|
||||
try:
|
||||
self._read_until(proc, "> ", timeout=10.0)
|
||||
self._send_line(proc, "4")
|
||||
out = self._read_until(proc, "> ", timeout=5.0)
|
||||
ct_hex = self._expect_hex_field(out, "ct")
|
||||
self._send_line(proc, "9")
|
||||
try:
|
||||
proc.wait(timeout=2.0)
|
||||
except subprocess.TimeoutExpired:
|
||||
proc.kill()
|
||||
raise AssertionError("Program did not exit after exit command (keyct)")
|
||||
return ct_hex
|
||||
finally:
|
||||
if proc.poll() is None:
|
||||
proc.kill()
|
||||
|
||||
def run_bingo_reject_wrong_key():
|
||||
wrong_key_hex = "00" * 66
|
||||
proc = self._spawn()
|
||||
try:
|
||||
self._read_until(proc, "> ", timeout=10.0)
|
||||
self._send_line(proc, "2")
|
||||
self._read_until(proc, "key (hex)", timeout=3.0)
|
||||
self._read_until(proc, "> ", timeout=3.0)
|
||||
self._send_line(proc, wrong_key_hex)
|
||||
out = self._read_until(proc, "> ", timeout=5.0)
|
||||
assert "nope" in out.lower(), f"bingo did not reject wrong key; got:\n{out[-300:]}"
|
||||
self._send_line(proc, "9")
|
||||
try:
|
||||
proc.wait(timeout=2.0)
|
||||
except subprocess.TimeoutExpired:
|
||||
proc.kill()
|
||||
raise AssertionError("Program did not exit after exit command (bingo)")
|
||||
finally:
|
||||
if proc.poll() is None:
|
||||
proc.kill()
|
||||
|
||||
ct1 = run_encrypt_once("414243444546")
|
||||
assert ct1 and self._HEX_RE.match(ct1), "encrypt(1) did not return hex"
|
||||
self.logger.info("[ok] encrypt produced hex")
|
||||
|
||||
pt_back = run_decrypt_once(ct1)
|
||||
assert pt_back.strip() != "", "decrypt returned empty output"
|
||||
assert self._HEX_RE.match(pt_back), "decrypt(3) did not return hex"
|
||||
self.logger.info("[ok] decrypt produced hex (custom mapping accepted)")
|
||||
|
||||
pt_same = "01" * 8
|
||||
ct_a = run_encrypt_once(pt_same)
|
||||
ct_b = run_encrypt_once(pt_same)
|
||||
assert ct_a.lower() != ct_b.lower(), "Encryption appears deterministic for same plaintext"
|
||||
self.logger.info("[ok] encrypt randomness")
|
||||
|
||||
k1 = run_keyct_once()
|
||||
k2 = run_keyct_once()
|
||||
assert k1.lower() != k2.lower(), "key? ciphertexts reused randomness"
|
||||
self.logger.info("[ok] key? randomness")
|
||||
|
||||
# run_bingo_reject_wrong_key()
|
||||
# self.logger.info("[ok] bingo rejects wrong key")
|
||||
|
||||
return True
|
||||
|
||||
except Exception as e:
|
||||
self.logger.error(f'Could not check phew: {e}')
|
||||
return False
|
||||
from .Challenge import Challenge
|
||||
|
||||
import select
|
||||
import subprocess
|
||||
import time
|
||||
import re
|
||||
import os
|
||||
|
||||
|
||||
def _has_data(proc) -> bool:
|
||||
"""True if the child's pipe still holds buffered output."""
|
||||
import fcntl
|
||||
try:
|
||||
fd = proc.stdout.fileno()
|
||||
fl = fcntl.fcntl(fd, fcntl.F_GETFL)
|
||||
fcntl.fcntl(fd, fcntl.F_SETFL, fl | os.O_NONBLOCK)
|
||||
data = proc.stdout.read()
|
||||
if data:
|
||||
return True
|
||||
return False
|
||||
except Exception:
|
||||
return False
|
||||
|
||||
|
||||
class Phew(Challenge):
|
||||
flag_location = 'flags/phew.txt'
|
||||
history_location = 'history/phew.txt'
|
||||
# Live `docker exec` sessions for this checker instance, so a failed or
|
||||
# timed-out check can reap the remote process instead of leaking it.
|
||||
_children = []
|
||||
|
||||
_CONTAINER = os.environ.get("CHALLENGE_CONTAINER_PHEW", "phew_container")
|
||||
# PYTHONUNBUFFERED is mandatory: chall.py prints its menu to stdout, and the
|
||||
# checker reads that pipe interactively. Python block-buffers stdout when it
|
||||
# is not a tty, so without it the child never flushes the "1. encrypt ... > "
|
||||
# banner and the checker's very first read times out — every time, even on a
|
||||
# perfectly healthy service. `python3 -u` would do the same thing.
|
||||
_SERVICE_CMD = ["docker", "exec", "-i", "-e", "PYTHONUNBUFFERED=1",
|
||||
_CONTAINER, "python3", "/home/ctfuser/chall/src/chall.py"]
|
||||
_HEX_RE = re.compile(r'^[0-9a-fA-F]+$')
|
||||
# chall.py generates a fresh Pailier keypair (os.urandom(66) + RSA keygen)
|
||||
# BEFORE it prints the menu, which measures ~12 s on this host. The first
|
||||
# read must outlast that or the check fails on a healthy service. Later
|
||||
# exchanges reuse the same key, so they can stay short.
|
||||
_BOOT_TIMEOUT = 45.0
|
||||
# Budget for a single cipher operation. Encrypting the raw 528-bit key
|
||||
# (menu option 4) is measurably slower than encrypting a small plaintext,
|
||||
# and a saturated host makes even the small ones slower — 5 s was too tight
|
||||
# and produced a false DOWN.
|
||||
_CRYPTO_TIMEOUT = 30.0
|
||||
|
||||
def _read_container_flag(self) -> str:
|
||||
# NB: a timeout is mandatory here. `docker exec` against a container
|
||||
# whose process table is saturated (accumulated chall.py zombies) can
|
||||
# block forever and take the whole SLA check loop down with it.
|
||||
try:
|
||||
out = subprocess.run(["docker", "exec", self._CONTAINER, "cat", "/flag.txt"],
|
||||
capture_output=True, text=True, timeout=30)
|
||||
except subprocess.TimeoutExpired:
|
||||
raise TimeoutError("docker exec cat /flag.txt timed out (container overloaded?)")
|
||||
if out.returncode != 0 or not out.stdout.strip():
|
||||
raise FileNotFoundError("Flag not found in container (/flag.txt)")
|
||||
return out.stdout.strip()
|
||||
|
||||
def _spawn(self):
|
||||
proc = subprocess.Popen(
|
||||
self._SERVICE_CMD,
|
||||
stdin=subprocess.PIPE,
|
||||
stdout=subprocess.PIPE,
|
||||
stderr=subprocess.STDOUT,
|
||||
text=True,
|
||||
bufsize=0,
|
||||
)
|
||||
self._children.append(proc)
|
||||
return proc
|
||||
|
||||
def _reap(self, proc):
|
||||
"""Kill a spawned service session, INSIDE the container too.
|
||||
|
||||
proc.kill() only kills the local `docker exec` CLIENT. The chall.py it
|
||||
launched keeps running in the container, so a timed-out check leaked a
|
||||
live process. After a few failures the container had 26 concurrent
|
||||
chall.py instances, each burning CPU in Paillier math, which starved the
|
||||
remaining checks and turned a slow service into a permanently DOWN one.
|
||||
Reaping must therefore also pkill the remote process.
|
||||
"""
|
||||
if proc.poll() is None:
|
||||
try:
|
||||
proc.kill()
|
||||
proc.wait(timeout=5)
|
||||
except Exception:
|
||||
pass
|
||||
try:
|
||||
subprocess.run(["docker", "exec", self._CONTAINER, "sh", "-c",
|
||||
"pkill -f chall.py 2>/dev/null || true"],
|
||||
capture_output=True, timeout=20)
|
||||
except Exception:
|
||||
pass
|
||||
if proc in self._children:
|
||||
self._children.remove(proc)
|
||||
|
||||
def _reap_all(self):
|
||||
for p in list(self._children):
|
||||
self._reap(p)
|
||||
|
||||
def _read_until(self, proc, token, timeout=5.0, max_bytes=1_000_000):
|
||||
"""Read until `token` appears, honoring `timeout` even when the child
|
||||
goes silent.
|
||||
|
||||
The previous implementation used a blocking `stdout.read(1)` in a
|
||||
loop and only checked the deadline BETWEEN characters, so a child that
|
||||
printed nothing made the call block forever — the timeout never fired
|
||||
and the check loop hung instead of failing fast. select() makes the
|
||||
deadline authoritative.
|
||||
"""
|
||||
start = time.time()
|
||||
buf = []
|
||||
deadline = start + timeout
|
||||
while True:
|
||||
if time.time() > deadline:
|
||||
tail = ''.join(buf)[-500:]
|
||||
raise TimeoutError(f"Timeout waiting for '{token}'. Got so far:\n{tail}")
|
||||
remaining = deadline - time.time()
|
||||
ready, _, _ = select.select([proc.stdout], [], [], min(remaining, 1.0))
|
||||
if not ready:
|
||||
if proc.poll() is not None and not _has_data(proc):
|
||||
raise RuntimeError(
|
||||
f"Process ended while waiting for '{token}'. Output:\n{''.join(buf)}")
|
||||
continue
|
||||
ch = proc.stdout.read(1)
|
||||
if ch == "":
|
||||
raise RuntimeError(
|
||||
f"Process ended while waiting for '{token}'. Output:\n{''.join(buf)}")
|
||||
buf.append(ch)
|
||||
if len(buf) > max_bytes:
|
||||
raise RuntimeError("Exceeded max read size")
|
||||
if token in "".join(buf):
|
||||
return "".join(buf)
|
||||
|
||||
def _send_line(self, proc, s: str):
|
||||
proc.stdin.write(s + "\n")
|
||||
proc.stdin.flush()
|
||||
|
||||
def _expect_hex_field(self, text: str, label: str) -> str:
|
||||
m = re.search(rf"{re.escape(label)}\s*:\s*([0-9a-fA-F]+)", text)
|
||||
assert m, f"Missing '{label}' in output. Tail:\n{text[-400:]}"
|
||||
hx = m.group(1)
|
||||
assert self._HEX_RE.match(hx), f"{label} is not hex"
|
||||
return hx
|
||||
|
||||
def distribute(self, flag):
|
||||
try:
|
||||
os.makedirs(os.path.dirname(self.flag_location), exist_ok=True)
|
||||
with open(self.flag_location, 'w') as f:
|
||||
f.write(flag)
|
||||
|
||||
os.makedirs(os.path.dirname(self.history_location), exist_ok=True)
|
||||
with open(self.history_location, 'a') as f:
|
||||
f.write(flag + '\n')
|
||||
|
||||
self.logger.info(f'Flag {flag} written to {self.flag_location}')
|
||||
return True
|
||||
except Exception as e:
|
||||
self.logger.error(f'Could not write flag to {self.flag_location}: {e}')
|
||||
return False
|
||||
|
||||
def check(self):
|
||||
try:
|
||||
# parity check
|
||||
with open(self.flag_location, 'r') as f:
|
||||
host_flag = f.read().strip()
|
||||
container_flag = self._read_container_flag()
|
||||
assert host_flag == container_flag, 'Flag mismatch between host and container'
|
||||
self.logger.info('[ok] flag parity (phew)')
|
||||
|
||||
def run_encrypt_once(pt_hex: str) -> str:
|
||||
proc = self._spawn()
|
||||
try:
|
||||
self._read_until(proc, "> ", timeout=self._BOOT_TIMEOUT)
|
||||
self._send_line(proc, "1")
|
||||
self._read_until(proc, "pt (hex)", timeout=3.0)
|
||||
self._read_until(proc, "> ", timeout=3.0)
|
||||
self._send_line(proc, pt_hex)
|
||||
out = self._read_until(proc, "> ", timeout=self._CRYPTO_TIMEOUT)
|
||||
ct_hex = self._expect_hex_field(out, "ct")
|
||||
self._send_line(proc, "9")
|
||||
try:
|
||||
proc.wait(timeout=2.0)
|
||||
except subprocess.TimeoutExpired:
|
||||
proc.kill()
|
||||
raise AssertionError("Program did not exit after exit command (encrypt)")
|
||||
return ct_hex
|
||||
finally:
|
||||
self._reap(proc)
|
||||
|
||||
def run_decrypt_once(ct_hex: str) -> str:
|
||||
proc = self._spawn()
|
||||
try:
|
||||
self._read_until(proc, "> ", timeout=self._BOOT_TIMEOUT)
|
||||
self._send_line(proc, "3")
|
||||
self._read_until(proc, "ct (hex)", timeout=3.0)
|
||||
self._read_until(proc, "> ", timeout=3.0)
|
||||
self._send_line(proc, ct_hex)
|
||||
out = self._read_until(proc, "> ", timeout=self._CRYPTO_TIMEOUT)
|
||||
pt_hex = self._expect_hex_field(out, "pt")
|
||||
self._send_line(proc, "9")
|
||||
try:
|
||||
proc.wait(timeout=2.0)
|
||||
except subprocess.TimeoutExpired:
|
||||
proc.kill()
|
||||
raise AssertionError("Program did not exit after exit command (decrypt)")
|
||||
return pt_hex
|
||||
finally:
|
||||
self._reap(proc)
|
||||
|
||||
def run_keyct_once() -> str:
|
||||
proc = self._spawn()
|
||||
try:
|
||||
self._read_until(proc, "> ", timeout=self._BOOT_TIMEOUT)
|
||||
self._send_line(proc, "4")
|
||||
# Option 4 runs `cipher.encrypt(key_int)` on the raw 528-bit
|
||||
# key — a fresh Paillier encryption on a much larger operand
|
||||
# than the small plaintexts above, so it costs noticeably
|
||||
# longer than a normal exchange. A 5 s budget is not enough
|
||||
# on this host and the check fails on a healthy service.
|
||||
out = self._read_until(proc, "> ", timeout=self._CRYPTO_TIMEOUT)
|
||||
ct_hex = self._expect_hex_field(out, "ct")
|
||||
self._send_line(proc, "9")
|
||||
try:
|
||||
proc.wait(timeout=2.0)
|
||||
except subprocess.TimeoutExpired:
|
||||
proc.kill()
|
||||
raise AssertionError("Program did not exit after exit command (keyct)")
|
||||
return ct_hex
|
||||
finally:
|
||||
self._reap(proc)
|
||||
|
||||
def run_bingo_reject_wrong_key():
|
||||
wrong_key_hex = "00" * 66
|
||||
proc = self._spawn()
|
||||
try:
|
||||
self._read_until(proc, "> ", timeout=self._BOOT_TIMEOUT)
|
||||
self._send_line(proc, "2")
|
||||
self._read_until(proc, "key (hex)", timeout=3.0)
|
||||
self._read_until(proc, "> ", timeout=3.0)
|
||||
self._send_line(proc, wrong_key_hex)
|
||||
out = self._read_until(proc, "> ", timeout=self._CRYPTO_TIMEOUT)
|
||||
assert "nope" in out.lower(), f"bingo did not reject wrong key; got:\n{out[-300:]}"
|
||||
self._send_line(proc, "9")
|
||||
try:
|
||||
proc.wait(timeout=2.0)
|
||||
except subprocess.TimeoutExpired:
|
||||
proc.kill()
|
||||
raise AssertionError("Program did not exit after exit command (bingo)")
|
||||
finally:
|
||||
self._reap(proc)
|
||||
|
||||
ct1 = run_encrypt_once("414243444546")
|
||||
assert ct1 and self._HEX_RE.match(ct1), "encrypt(1) did not return hex"
|
||||
self.logger.info("[ok] encrypt produced hex")
|
||||
|
||||
pt_back = run_decrypt_once(ct1)
|
||||
assert pt_back.strip() != "", "decrypt returned empty output"
|
||||
assert self._HEX_RE.match(pt_back), "decrypt(3) did not return hex"
|
||||
self.logger.info("[ok] decrypt produced hex (custom mapping accepted)")
|
||||
|
||||
pt_same = "01" * 8
|
||||
ct_a = run_encrypt_once(pt_same)
|
||||
ct_b = run_encrypt_once(pt_same)
|
||||
assert ct_a.lower() != ct_b.lower(), "Encryption appears deterministic for same plaintext"
|
||||
self.logger.info("[ok] encrypt randomness")
|
||||
|
||||
k1 = run_keyct_once()
|
||||
k2 = run_keyct_once()
|
||||
assert k1.lower() != k2.lower(), "key? ciphertexts reused randomness"
|
||||
self.logger.info("[ok] key? randomness")
|
||||
|
||||
# run_bingo_reject_wrong_key()
|
||||
# self.logger.info("[ok] bingo rejects wrong key")
|
||||
|
||||
return True
|
||||
|
||||
except Exception as e:
|
||||
self.logger.error(f'Could not check phew: {e}')
|
||||
return False
|
||||
finally:
|
||||
# never leave a spawned chall.py behind, whatever happened above
|
||||
self._reap_all()
|
||||
|
||||
Reference in New Issue
Block a user