attack-defense-platform

109 Commits 1 Branch 0 Tags

2 Commits

Include renames

Author	SHA1	Message	Date
Cyrene	ae50acfe40	fix(ssh): per-challenge SSH login + phew buffering/leak/timeout Passwords failed on 10/16 challenges while state.json looked correct: - only the 6 native GEMASTIK XVIII images provision 'ctfuser'; every imported XVI/XVII image does 'echo root:${PASSWORD} \| chpasswd' and logs in as root. set_ssh_passwords() hardcoded ctfuser, so chpasswd set a password on an account nobody uses -> 'Permission denied' everywhere. Registry gains a per-challenge 'ssh_user'; chpasswd now targets the real login (and ctfuser/ctf when present) and reports failures loudly. - phew checker: chall.py block-buffers stdout through the docker exec pipe (PYTHONUNBUFFERED now set) and leaks chall.py inside the container on timeout (26 orphans, container saturated) -> reaps the whole exec process group. Startup does a fresh Pailier keygen (~12 s) so crypto reads need _CRYPTO_TIMEOUT, not the 5 s prompt default. Adds panel/verify_ssh_creds.py (proves the state->container binding from inside via a real login), audit_ssh_users.sh, reset_runtime.sh.	2026-09-26 14:40:10 +08:00
MythEclipse	c6fd9ec268	feat: challenge registry-driven platform + XVI/XVII imports + admin toggle + domain rename - Rename repo/domain: attack-defense-platform / attackdefense.imrnes.team (all refs replaced) - challenge_registry.json: single source of truth (28 challs across gemastik18/xvi/xvii) - teams.py: registry-driven CHALLENGES, set_challenge_enabled, sync_challenge_runtime (apply enable/disable to live teams: build/up or stop/remove + receiver restart) - compose_gen.py: render per-team compose from canonical per-challenge templates (image reuse, per-team ports 30xxx, flag mounts, passwords) - gen_canonical_composes.py: canonical docker-compose.yml for all services - import_new_challenges.py: import XVI/XVII services + EOL base image fixes (debian:buster→bookworm, node:14→20, python:3.7-slim→3.11) - receiver: xvi package (10 checkers) + xvii package (12 generic checkers), Challenge base reads PASSWORD_<team_port> from env; gen_receiver_main.py generates per-team main.py from registry - main.py: /api/challenges returns full registry; PATCH /api/challenges/<name> toggles enabled + applies to live teams - index.html: 🏗️ Challenge Manager tab (toggle per challenge, grouped by set) - SLA bonus now dynamic (all enabled challenges, not hardcoded 6)	2026-09-25 14:04:33 +08:00

Author

SHA1

Message

Date

Cyrene

ae50acfe40

fix(ssh): per-challenge SSH login + phew buffering/leak/timeout

Passwords failed on 10/16 challenges while state.json looked correct:
- only the 6 native GEMASTIK XVIII images provision 'ctfuser'; every imported
  XVI/XVII image does 'echo root:${PASSWORD} | chpasswd' and logs in as root.
  set_ssh_passwords() hardcoded ctfuser, so chpasswd set a password on an
  account nobody uses -> 'Permission denied' everywhere.
  Registry gains a per-challenge 'ssh_user'; chpasswd now targets the real
  login (and ctfuser/ctf when present) and reports failures loudly.
- phew checker: chall.py block-buffers stdout through the docker exec pipe
  (PYTHONUNBUFFERED now set) and leaks chall.py inside the container on
  timeout (26 orphans, container saturated) -> reaps the whole exec process
  group. Startup does a fresh Pailier keygen (~12 s) so crypto reads need
  _CRYPTO_TIMEOUT, not the 5 s prompt default.

Adds panel/verify_ssh_creds.py (proves the state->container binding from
inside via a real login), audit_ssh_users.sh, reset_runtime.sh.

2026-09-26 14:40:10 +08:00

MythEclipse

c6fd9ec268

feat: challenge registry-driven platform + XVI/XVII imports + admin toggle + domain rename

- Rename repo/domain: attack-defense-platform / attackdefense.imrnes.team (all refs replaced)
- challenge_registry.json: single source of truth (28 challs across gemastik18/xvi/xvii)
- teams.py: registry-driven CHALLENGES, set_challenge_enabled, sync_challenge_runtime
  (apply enable/disable to live teams: build/up or stop/remove + receiver restart)
- compose_gen.py: render per-team compose from canonical per-challenge templates
  (image reuse, per-team ports 30xxx, flag mounts, passwords)
- gen_canonical_composes.py: canonical docker-compose.yml for all services
- import_new_challenges.py: import XVI/XVII services + EOL base image fixes
  (debian:buster→bookworm, node:14→20, python:3.7-slim→3.11)
- receiver: xvi package (10 checkers) + xvii package (12 generic checkers),
  Challenge base reads PASSWORD_<team_port> from env; gen_receiver_main.py
  generates per-team main.py from registry
- main.py: /api/challenges returns full registry; PATCH /api/challenges/<name>
  toggles enabled + applies to live teams
- index.html: 🏗️ Challenge Manager tab (toggle per challenge, grouped by set)
- SLA bonus now dynamic (all enabled challenges, not hardcoded 6)

2026-09-25 14:04:33 +08:00