MythEclipse/attack-defense-platform
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: make challenge toggle actually work end-to-end (5 root-cause bugs)

Browse Source 
Found by testing a real enable/disable cycle (art, fjb, gift-card):

1. compose_gen always swapped build->image, so a never-built challenge
   produced 'pull access denied for services-<name>'. Now it only reuses
   the image when it exists locally, otherwise keeps build: so
   'docker compose up --build' builds it.
2. Canonical templates use 'build: context: .' (written for the shared
   services/ tree). In the per-team compose that resolves to the team dir
   which has no Dockerfile -> 'failed to read dockerfile'. The renderer
   now rewrites the main service's context to ./<name>.
3. Teams created before the XVI/XVII import had no xvi/xvii subpackages
   under their local challenges/ dir, so the regenerated receiver main.py
   crash-looped on import. gen_receiver_main now mirrors ALL shared
   checkers (native + xvi + xvii) into every team receiver on each sync.
4. systemd Environment= keys can't contain hyphens, so
   CHALLENGE_PORT_GIFT-CARD was silently dropped. Keys are now
   normalized to underscores on both the writer and reader side.
5. Several checkers called 'docker exec' with no timeout; against a
   container with accumulated chall.py zombies that blocks forever and
   stalls the whole SLA loop. Added mandatory timeouts (Phew, Sheesh,
   Carbeat, Poke, Warmup).

Also: enabling a challenge now copies its source tree into each team's
services/ dir (team dirs only held challenges enabled at create_team
time), and the XVII checkers were rewritten to be protocol-aware
(gift-card/gift-voucher are socat TCP, not HTTP) with strict timeouts.
This commit is contained in:
MythEclipse
2026-09-25 15:36:09 +08:00
parent c6fd9ec268
commit d4c741926d
10 changed files with 176 additions and 106 deletions
Download Patch File Download Diff File Expand all files Collapse all files
receiver/challenges/Carbeat.py
+2 -1
View File
@@ -26,8 +26,9 @@ class Carbeat(Challenge):
def _read_container_flag(self) -> str:
# timeout is mandatory: docker exec can block forever on a saturated container
out = subprocess.run(["docker", "exec", self._CONTAINER, "cat", "/flag.txt"],
capture_output=True, text=True)
capture_output=True, text=True, timeout=30)
if out.returncode != 0 or not out.stdout.strip():
raise FileNotFoundError("Flag not found in container (/flag.txt)")
return out.stdout.strip()
receiver/challenges/Phew.py
+8 -2
View File
@@ -14,8 +14,14 @@ class Phew(Challenge):
_HEX_RE = re.compile(r'^[0-9a-fA-F]+$')
def _read_container_flag(self) -> str:
out = subprocess.run(["docker", "exec", self._CONTAINER, "cat", "/flag.txt"],
capture_output=True, text=True)
# NB: a timeout is mandatory here. `docker exec` against a container
# whose process table is saturated (accumulated chall.py zombies) can
# block forever and take the whole SLA check loop down with it.
try:
out = subprocess.run(["docker", "exec", self._CONTAINER, "cat", "/flag.txt"],
capture_output=True, text=True, timeout=30)
except subprocess.TimeoutExpired:
raise TimeoutError("docker exec cat /flag.txt timed out (container overloaded?)")
if out.returncode != 0 or not out.stdout.strip():
raise FileNotFoundError("Flag not found in container (/flag.txt)")
return out.stdout.strip()
receiver/challenges/Poke.py
+2 -1
View File
@@ -52,7 +52,8 @@ class Poke(Challenge):
container_flag = subprocess.run(
["docker", "exec", "poke_container", "cat", "/flag.txt"],
capture_output=True,
text=True
text=True,
timeout=30
).stdout.strip()
assert host_flag == container_flag, 'Flag mismatch between host and container'
receiver/challenges/Sheesh.py
+2 -1
View File
@@ -15,9 +15,10 @@ class Sheesh(Challenge):
_HEX_RE = re.compile(r'^[0-9a-fA-F]+$')
def _read_container_flag(self) -> str:
# timeout is mandatory: docker exec can block forever on a saturated container
out = subprocess.run(
["docker", "exec", self._CONTAINER, "cat", "/flag.txt"],
capture_output=True, text=True
capture_output=True, text=True, timeout=30
)
if out.returncode != 0 or not out.stdout.strip():
raise FileNotFoundError("Flag not found in container (/flag.txt)")
receiver/challenges/Warmup.py
+1 -1
View File
@@ -32,7 +32,7 @@ class Warmup(Challenge):
host_flag = f.read().strip()
container_flag = subprocess.run([
"docker", "exec", os.environ.get("CHALLENGE_CONTAINER_WARMUP", "warmup_container"), "cat", "/flag.txt"
], capture_output=True, text=True).stdout.strip()
], capture_output=True, text=True, timeout=30).stdout.strip()
assert host_flag == container_flag, 'Flag mismatch between host and container'
self.logger.info('Check passed for warmup')
receiver/challenges/xvii/checkers.py
+72 -88
View File
@@ -1,10 +1,17 @@
"""SLA checkers for GEMASTIK XVII challenges (imported from
github.com/vidner/gemastik-xvii-final — no upstream receiver was provided).
Each checker validates liveness + flag presence in the container. Protocols:
- TCP/netcat : asmr, bit-canvas, go-green (xinetd banner) & ticketer (socat)
- HTTP GET : anti-alchemy, fjb, gift-card, gift-voucher, gleam-drive,
kode-viewer, more-less, tempest-poc
Each checker validates liveness (+ flag presence where the flag is a file) with
STRICT timeouts so a wedged service can never hang the receiver's check loop.
Protocol classes:
- WEB : HTTP GET on the challenge port
- TCP : socat/xinetd line service — connect and expect a prompt/banner
- WEB+FLAG: WEB plus the flag must be mounted inside the container
Env-var convention: systemd Environment= keys are normalized to underscores
(CHALLENGE_PORT_GIFT_CARD for the challenge "gift-card"), so the lookup helper
does the same normalization.
"""
import os
import socket
@@ -15,6 +22,16 @@ import requests
from .Challenge import Challenge
def _key(name: str) -> str:
return name.upper().replace("-", "_")
def _container(challenge: str) -> str:
return os.environ.get(
f"CHALLENGE_CONTAINER_{_key(challenge)}", f"{challenge}_container"
)
def _docker_exec(container: str, *args, timeout: int = 10):
try:
return subprocess.run(["docker", "exec", container, *args],
@@ -24,35 +41,54 @@ def _docker_exec(container: str, *args, timeout: int = 10):
def _flag_in_container(container: str, path: str = "/flag.txt") -> bool:
r = _docker_exec(container, "sh", "-c", f"test -f {path} && cat {path} || echo MISSING")
return bool(r and "MISSING" not in (r.stdout or "") and r.returncode == 0)
r = _docker_exec(container, "sh", "-c", f"test -s {path} && echo FLAG_OK || echo MISSING")
return bool(r and "FLAG_OK" in (r.stdout or ""))
def _tcp_banner(port: int, timeout: float = 4.0, expect: bytes = None) -> bool:
def _web_alive(port: int, timeout: float = 5.0) -> bool:
"""Any HTTP response (even 4xx/5xx) proves the listener is up."""
try:
s = socket.create_connection(("127.0.0.1", port), timeout=timeout)
s.settimeout(timeout)
data = s.recv(256)
s.close()
if expect:
return expect.lower() in data.lower()
return len(data) > 0
r = requests.get(f"http://127.0.0.1:{port}/", timeout=timeout, allow_redirects=False)
return r.status_code < 600
except requests.exceptions.RequestException:
return False
except Exception:
return False
def _tcp_alive(port: int, timeout: float = 5.0, send: bytes = None) -> bool:
"""Connect to a line service and read a prompt/banner (or survive silence).
Some socat services wait for input before greeting, so a successful connect
with no data is also treated as alive; a refused connection is not.
"""
try:
s = socket.create_connection(("127.0.0.1", port), timeout=timeout)
except Exception:
return False
try:
s.settimeout(timeout)
if send:
s.sendall(send)
try:
data = s.recv(256)
except socket.timeout:
# connected but silent — service is accepting connections
return True
return True if data is not None else True
finally:
try:
s.close()
except Exception:
pass
class AntiAlchemy(Challenge):
flag_location = "flags/anti-alchemy.txt"
history_location = "history/anti-alchemy.txt"
def check(self):
try:
url = f"http://localhost:{self.port}/"
r = requests.get(url, timeout=6)
assert r.status_code in (200, 302, 500) or len(r.text) > 0
return _flag_in_container(os.environ.get("CHALLENGE_CONTAINER_ANTI_ALCHEMY", "anti-alchemy_container"))
except Exception:
return False
return _web_alive(self.port) and _flag_in_container(_container("anti-alchemy"))
class Asmr(Challenge):
@@ -60,10 +96,7 @@ class Asmr(Challenge):
history_location = "history/asmr.txt"
def check(self):
try:
return _tcp_banner(self.port, expect=None)
except Exception:
return False
return _tcp_alive(self.port)
class BitCanvas(Challenge):
@@ -71,10 +104,7 @@ class BitCanvas(Challenge):
history_location = "history/bit-canvas.txt"
def check(self):
try:
return _tcp_banner(self.port, expect=None)
except Exception:
return False
return _tcp_alive(self.port)
class Fjb(Challenge):
@@ -82,43 +112,27 @@ class Fjb(Challenge):
history_location = "history/fjb.txt"
def check(self):
try:
url = f"http://localhost:{self.port}/"
r = requests.get(url, timeout=6)
assert r.status_code < 500
return _flag_in_container(os.environ.get("CHALLENGE_CONTAINER_FJB", "fjb_container"))
except Exception:
return False
return _web_alive(self.port) and _flag_in_container(_container("fjb"))
class GiftCard(Challenge):
"""socat TCP line service (python main.py on :5000), NOT http."""
flag_location = "flags/gift-card.txt"
history_location = "history/gift-card.txt"
def check(self):
try:
url = f"http://localhost:{self.port}/"
r = requests.get(url, timeout=6)
assert r.status_code < 500
return _flag_in_container(os.environ.get("CHALLENGE_CONTAINER_GIFT_CARD", "gift-card_container"),
"/ctf/gift-card/flag.txt")
except Exception:
return False
return _tcp_alive(self.port, send=b"1\n") and _flag_in_container(
_container("gift-card"), "/ctf/gift-card/flag.txt")
class GiftVoucher(Challenge):
"""socat TCP line service, NOT http."""
flag_location = "flags/gift-voucher.txt"
history_location = "history/gift-voucher.txt"
def check(self):
try:
url = f"http://localhost:{self.port}/"
r = requests.get(url, timeout=6)
assert r.status_code < 500
return _flag_in_container(os.environ.get("CHALLENGE_CONTAINER_GIFT_VOUCHER", "gift-voucher_container"),
"/ctf/gift-voucher/flag.txt")
except Exception:
return False
return _tcp_alive(self.port, send=b"1\n") and _flag_in_container(
_container("gift-voucher"), "/ctf/gift-voucher/flag.txt")
class GleamDrive(Challenge):
@@ -126,13 +140,7 @@ class GleamDrive(Challenge):
history_location = "history/gleam-drive.txt"
def check(self):
try:
url = f"http://localhost:{self.port}/"
r = requests.get(url, timeout=6)
assert r.status_code < 500
return _flag_in_container(os.environ.get("CHALLENGE_CONTAINER_GLEAM_DRIVE", "gleam-drive_container"))
except Exception:
return False
return _web_alive(self.port) and _flag_in_container(_container("gleam-drive"))
class GoGreen(Challenge):
@@ -140,10 +148,7 @@ class GoGreen(Challenge):
history_location = "history/go-green.txt"
def check(self):
try:
return _tcp_banner(self.port, expect=None)
except Exception:
return False
return _tcp_alive(self.port)
class KodeViewer(Challenge):
@@ -151,13 +156,7 @@ class KodeViewer(Challenge):
history_location = "history/kode-viewer.txt"
def check(self):
try:
url = f"http://localhost:{self.port}/"
r = requests.get(url, timeout=6)
assert r.status_code < 500
return _flag_in_container(os.environ.get("CHALLENGE_CONTAINER_KODE_VIEWER", "kode-viewer_container"))
except Exception:
return False
return _web_alive(self.port) and _flag_in_container(_container("kode-viewer"))
class MoreLess(Challenge):
@@ -165,13 +164,7 @@ class MoreLess(Challenge):
history_location = "history/more-less.txt"
def check(self):
try:
url = f"http://localhost:{self.port}/"
r = requests.get(url, timeout=6)
assert r.status_code < 500
return _flag_in_container(os.environ.get("CHALLENGE_CONTAINER_MORE_LESS", "more-less_container"))
except Exception:
return False
return _web_alive(self.port) and _flag_in_container(_container("more-less"))
class TempestPoc(Challenge):
@@ -179,13 +172,7 @@ class TempestPoc(Challenge):
history_location = "history/tempest-poc.txt"
def check(self):
try:
url = f"http://localhost:{self.port}/"
r = requests.get(url, timeout=6)
assert r.status_code < 500
return _flag_in_container(os.environ.get("CHALLENGE_CONTAINER_TEMPEST_POC", "tempest-poc_container"))
except Exception:
return False
return _web_alive(self.port) and _flag_in_container(_container("tempest-poc"))
class Ticketer(Challenge):
@@ -193,7 +180,4 @@ class Ticketer(Challenge):
history_location = "history/ticketer.txt"
def check(self):
try:
return _tcp_banner(self.port, expect=None)
except Exception:
return False
return _tcp_alive(self.port)