MythEclipse/attack-defense-platform
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: MythEclipse/attack-defense-platform:4a65f24af364fe352e92226a04d94ffa0242d24c
MythEclipse/attack-defense-platform:main
..
compare: MythEclipse/attack-defense-platform:main
MythEclipse/attack-defense-platform:main
23 Commits
4a65f24af3 .. main
Author SHA1 Message Date
root c3123fd0b2 Add venv health guard that catches interpreter drift after autoremove 
An apt autoremove on Ubuntu 26.04 purged python3.12, so the receiver
venv's bin/python3 -> /usr/bin/python3 silently resolved to python3.14
and all four platform services crash-looped on 'No module named
uvicorn' while state.json still looked healthy.

The venv is now pinned to a uv-managed CPython 3.12.3 (pydantic 1.10.2
breaks on >=3.12.4 via ForwardRef._evaluate), which is not a dpkg
package, so add a guard that verifies interpreter version, base_prefix,
core dependency imports, and service restart counts. Includes a
negative-test suite proving the guard fails on real breakage.
 2026-09-29 18:03:38 +08:00
Cyrene 2da6305626 docs: full operator manual in README (setup, spec, API, troubleshooting) 
Replaces the 3-line upstream stub with a manual that documents the platform
as it actually runs. Every claim is derived from the live code and registry
rather than from memory.

Challenge spec:
- 28-challenge tables (6 XVIII / 10 XVI / 12 XVII, 16 active) generated from
  teams/challenge_registry.json, with per-challenge org_port, chall/ssh
  offsets, and the real team-1 runtime ports read from state.json.
- Port formula corrected to the real one:
  port = 30000 + idx*1000 + chall_offset. org_port is the native graveyard
  port and is NOT used for runtime allocation, so two challenges sharing an
  org_port (carbeat offset 1 vs anti-alchemy offset 30) never collide.
- Per-challenge ssh_user documented: only the 6 native XVIII images provision
  ctfuser; all imported XVI/XVII images chpasswd root, so hardcoding ctfuser
  breaks 10 of the 16 active challenges.
- Scoring: 100 per flag awarded to the ATTACKER (first solve only), +50 SLA
  bonus at most once per 5-minute window, runtime threshold documented as
  len(enabled_challenges()) rather than the hardcoded constant 6.

Setup and operations:
- Setup from clone: required /opt path, Docker, venv, panel credentials, both
  systemd units verbatim, team creation, verification step.
- Full HTTP API split into public / admin / team, including why challenge
  toggle and bulk team delete are async jobs.
- Troubleshooting and operational traps as declarative rules: the bare domain
  is the receiver and not the panel, EOL base images, UFW default-deny
  silently blackholing ports, the mandatory compose -p teamN project name,
  and why docker image prune -af destroys services-* images that are in use.
- Image sizes measured from the host (189MB-903MB, ~8GB for 16 active)
  instead of the incorrect "~3GB per challenge" figure.
- Topology section: PixiJS v8, on-demand rendering, and the parent-to-child
  drag hierarchy derived from the edge list.

The flag example is redacted to a placeholder. No live credential, token, or
flag is committed. README.md is the only file touched.
 2026-09-28 19:13:51 +08:00
root cf47770798 Fix the topology freezing and make team drags carry their challenges 
User report: the graph "disappeared". Reproduced, and the cause was not the
graph at all — the panel's main thread was blocked hard enough that the browser
stopped responding to clicks.

Root cause, found by measuring rather than guessing:
  rAF 2 FPS, setTimeout(0) lag 1353ms, with the graph rendering correctly the
  whole time. The scene was repainting continuously at 60fps even though it is
  static between the 10s data refreshes. Each repaint cost ~305ms on this
  host's software GL, so the main thread never got a free slot.

Fixes:
- Render on demand. The ticker is registered but not started; it runs only while
  an attack pulse is in flight or the user is dragging, and stops once the scene
  is quiet. applyView() (the single funnel for pan/zoom/drag/refit) repaints
  synchronously. Result: 2 FPS -> 73 FPS, 1353ms -> 2ms lag. That is faster than
  a blank page in the same harness (29 FPS), which confirms the ticker was the
  cost, not the scene complexity.
- Stop rebuilding Pixi objects every refresh. _redrawEdges destroyed and
  recreated ~70 Graphics + ~36 Text each cycle; every new Text allocates a
  canvas, rasterises glyphs and uploads a texture. Edges are now kept per
  from->to key and only their geometry is redrawn; a label's text is re-set only
  when the string actually changes. Same for node titles/subtitles.
- Bind tooltip handlers once, at node creation. Re-binding inside the refresh
  loop added a pointerover listener every 10s, so a single hover after an hour
  fired thousands of handlers.

Two correctness bugs fixed while in there:
- init() race. The Topology tab button calls showView('topo') AND loadTopo(), and
  showView() itself calls loadTopo(), so two ran concurrently. The re-entry guard
  tested `topoGraph && topoGraph.app`, but topoGraph was assigned BEFORE the
  awaited init(), so app was still null and a second renderer was built. Both
  cleared host.innerHTML and appended their own canvas, so the last init to
  finish won the DOM while the bridge still pointed at the other — a live canvas
  that was no longer on the page. Now guarded by a single-flight promise, and
  the instance is published only after init() resolves.
- Dropped the dead topoLoaded flag left over from the SVG renderer.

Hierarchical drag: dragging a team now carries its 16 challenge nodes with it.
The parent->children index is built from the edge list, the same source the
lines are drawn from, so the drag hierarchy cannot disagree with the picture;
challenges missing from the edge list still attach by id prefix. Children
translate rigidly (verified: 0.000px deviation across all 16).

Verified from a cold panel restart: all 5 topology tests pass, 73 FPS, 2ms
lag, 37 nodes drawn, graph framed at 4 viewport widths, no page errors, and
platform SLA unregressed at 32/32.
 2026-09-27 01:17:56 +08:00
root 30f8052e79 Add viewport regression test for the topology layout fix 
The off-screen-layout bug (nodes centred on the scrollable width instead of the
viewport) only reproduced at the default window size, so a single-width test
would have shipped it. Verifies the graph stays framed at 1920/1400/1100/820,
and records which assumption in the pixel census is safe: the measurement uses
the canvas buffer size, not the screen size, because the CSS min-width makes
narrow viewports scroll.
 2026-09-27 00:39:07 +08:00
root 1461c874c3 Render the topology graph with PixiJS v8 
Replaces the hand-rolled inline-SVG topology with a PixiJS 8 scene graph.

Why: the old renderer rebuilt all 37 nodes / 36 edges as one innerHTML string
every 10s, which tore down and recreated every DOM node. That restarted CSS
animations mid-flight and made dragging fight the browser's own hit-testing.
The scene graph gives per-node transforms, so pan/zoom is a single container
transform instead of getScreenCTM() matrix math.

Changes:
- static/topo_pixi.js: new self-contained renderer. Owns its Application and
  tears it down on tab exit so a second WebGL context cannot leak.
- static/index.html: the <svg id=topoSvg> host becomes a <div id=topoHost>;
  the 188-line SVG renderer is replaced by a bridge to the module.
- static/vendor/pixi.mjs: PixiJS 8.21.0 self-hosted (MIT). The .mjs build is
  required; the .js build exports no global. See vendor/README.md.
- main.py: mount /static. Pages were served as inline HTMLResponse, so the
  directory was never mounted and the module had no URL to load from.

Two real bugs found by measuring pixels rather than trusting init():
- preserveDrawingBuffer: without it WebGL clears the back buffer after
  compositing, so any readback or screenshot of the canvas is a coin flip
  depending on which frame it lands on. The graph rendered intermittently
  blank. Now enabled: cheap for a 2D scene, and it makes the view capturable.
- Layout was centred on the SCROLLABLE width (nodes.length * 130), not the
  viewport, so with 37 nodes every team and challenge node landed at
  x=2230-2650 on a 1310px canvas: entirely off-screen. Layout now centres on
  the visible width and reset() frames the whole graph to fit.

test_topo_pixels.js documents three wrong test designs it replaces, all of
which reported false failures against a working graph: counting scene-graph
children (passes on a blank canvas), diffing against the background colour
(the theme is dark by design, so a perfect render measures ~0%), and diffing
two Playwright screenshots (both can be captured after the scene was mutated).
The check now reads the GL back buffer via readPixels in one evaluate.

Verified: 37 nodes / 36 edges drawn (7.94% of frame, max channel delta 225),
graph bbox [437,46,881,476] inside the 1310x520 canvas, glGetError=0, no page
errors, zoom and frame-to-fit reset working. Platform unregressed: SLA 32/32.
 2026-09-27 00:31:47 +08:00
root 50cb782ded fix(portal): per-challenge SSH user in web terminal + credential API 
The web SSH terminal and the credential API reported `ctfuser` for all 16
challenges, but only the 6 native GEMASTIK XVIII images provision ctfuser.
Every imported XVI/XVII image does `RUN echo root:${PASSWORD} | chpasswd`,
so 10 of 16 participant logins were refused with "Permission denied".

Root causes (all the same class of bug - login hardcoded in the wrong layer):
- main.py websocket ssh handler read st["ssh_user"], a single team-wide value
  defaulting to ctfuser, instead of the per-challenge registry field
- /api/credential proxied the global receiver on :18080, which only knows the
  6 native challenges, so the other 10 returned "Invalid challenge"
- team.html hardcoded the challenge picker to those same 6 challenges, making
  the other 10 unreachable from the terminal entirely
- index.html rendered `<b>ctfuser</b>` and a stale hardcoded SSH port table

Fixes:
- orch.challenge_credential()/all_teams() read the TEAM's state.json, which
  holds the same per-challenge password the panel chpasswds
- gen_receiver_services.py injects SSH_USER_<port> from the registry so the
  receiver's /credential endpoint agrees with the panel
- receiver Challenge.credentials() honours SSH_USER_<port> (ctfuser fallback)
- new /api/team/{idx}/own-challenges feeds the picker; targets now carry
  challenge + ssh_user
- UI takes user and port from the server instead of hardcoding them

Verified: 32/32 credential payloads correct across teams 1-2, and 32/32 real
paramiko SSH logins succeed with whoami confirming the expected account.

Also adds bulk team delete: POST /api/teams/bulk-delete runs one background
thread and is polled via GET /api/teams/bulk-delete/{job_id}, plus per-team
checkboxes with select-all/clear in the UI. Deletion must stay sequential
because delete_team() regenerates shared artifacts at the end.
 2026-09-26 16:37:40 +08:00
Cyrene 0a56906b18 test(team-delete): verify DELETE /api/teams/{idx} tears a team down completely 
Created a scratch team 5, booted all 16 of its containers, snapshotted its
footprint, deleted it via the API, and re-snapshotted:

  before: 16 containers, 1 sidecar, team5_default network, teams/team5 dir
  after : 0 containers, 0 sidecars, network gone, dir GONE, 34 UFW ports
          closed, Traefik domain removed, 0 score rows
  took 102s; the other 4 teams (64 containers, receivers active) were
  untouched and still at 64/64 SLA.

Adds panel/team_footprint.sh (before/after proof of a delete),
team_health.sh, watch_load.sh.
 2026-09-26 15:48:07 +08:00
Cyrene aa0bb45633 fix(sla): 100% fleet SLA (64/64) - per-challenge SSH login, phew checker, sidecar detection 
Three independent root causes, all found by measuring instead of assuming:

1. SSH failed on 10/16 challenges while state.json looked perfect.
   Only the 6 native GEMASTIK XVIII images provision 'ctfuser'; every imported
   XVI/XVII image does 'echo root:${PASSWORD} | chpasswd' and logs in as root.
   set_ssh_passwords() hardcoded ctfuser, so chpasswd set a password nobody
   used -> 'Permission denied' on every team. Registry gains a per-challenge
   'ssh_user'; chpasswd targets the real login and reports failures loudly.

2. phew SLA timed out on a healthy service, four bugs stacked:
   - chall.py block-buffers stdout through the exec pipe (PYTHONUNBUFFERED now
     set) and does a fresh Pailier keygen (~12 s) before printing its menu;
   - _read_until read a TEXT pipe, so read(1) pulled 8 KB into Python's
     TextIOWrapper buffer and select() then blocked on data already in memory;
   - its buffer was per-call, so the read satisfying 'pt (hex)' also swallowed
     the '> ' the next call waited for -> a race that failed intermittently;
   - reaping killed chall.py it did not own: a blanket pkill -f, a
     snapshot-diff (concurrent sessions diff against the same pre-spawn set),
     and a class-level _children shared across uvicorn's thread pool. The child
     now prints its own pid so exactly one session is reaped.
   Also: ONE interactive session per check instead of five spawns (Paillier is
   randomized per ciphertext, not per process) - 5 keygens were the CPU load
   that starved the checks. And the 6 orphan single-node containers from the
   original deploy were removed; one held 58 leaked chall.py and drove load
   average 76 on 2 CPUs.

3. missing_sidecars() matched compose-generated names (teamN-<svc>-1) while
   every service sets an explicit container_name, so it reported all 16 running
   challenges as missing and hid the one real gap (anti-alchemy-db, which has
   no container_name). Now reads container_name when present and falls back to
   the compose default otherwise.

Verified: 64/64 SLA across 4 teams; 64/64 real SSH logins succeed with
correct <chall>_teamN hostnames; phew 3/3 sequential with no process leak.

Adds panel/verify_ssh_creds.py, audit_ssh_users.sh, reset_runtime.sh,
sla_sweep.sh, fix_sidecars.sh, phew_concurrency_test.sh, exec_probe_i.py.
 2026-09-26 15:37:31 +08:00
Cyrene ae50acfe40 fix(ssh): per-challenge SSH login + phew buffering/leak/timeout 
Passwords failed on 10/16 challenges while state.json looked correct:
- only the 6 native GEMASTIK XVIII images provision 'ctfuser'; every imported
  XVI/XVII image does 'echo root:${PASSWORD} | chpasswd' and logs in as root.
  set_ssh_passwords() hardcoded ctfuser, so chpasswd set a password on an
  account nobody uses -> 'Permission denied' everywhere.
  Registry gains a per-challenge 'ssh_user'; chpasswd now targets the real
  login (and ctfuser/ctf when present) and reports failures loudly.
- phew checker: chall.py block-buffers stdout through the docker exec pipe
  (PYTHONUNBUFFERED now set) and leaks chall.py inside the container on
  timeout (26 orphans, container saturated) -> reaps the whole exec process
  group. Startup does a fresh Pailier keygen (~12 s) so crypto reads need
  _CRYPTO_TIMEOUT, not the 5 s prompt default.

Adds panel/verify_ssh_creds.py (proves the state->container binding from
inside via a real login), audit_ssh_users.sh, reset_runtime.sh.
 2026-09-26 14:40:10 +08:00
MythEclipse ef385c3397 fix: get all imported challenges building and running 
Root causes found by prebuilding every challenge image in parallel:
- fjb: ghcr.io base is not anonymously pullable here -> official httpd:2.4.
  pnpm 12 (via corepack on node:20) fails the install with
  ERR_PNPM_IGNORED_BUILDS unless build scripts are approved; neither
  onlyBuiltDependencies in pnpm-workspace.yaml nor --no-ignore-scripts
  suppresses it. The working sequence is:
    pnpm install --ignore-scripts && pnpm approve-builds --all && pnpm rebuild
- xl + kode-viewer: node:20-slim-bookworm is not a real tag -> node:20-bookworm-slim.
- burvesigner: python-dev no longer exists in bookworm -> dropped (python3-dev
  was already there and the source has no py2 syntax).
- burvesigner/hirnfick/s3: apt update and install were separate RUN layers;
  with the bundled apt-insecure.conf the second invocation re-resolved against
  the EOL bullseye-security mirror and 404'd every package. Merged into one
  'update && install' layer (fix_apt_layers.py, idempotent).
- consolidate_images.sh: teams used to build a private image per team
  (team1-x ... team4-x) because no shared image existed. Since the password is
  applied at runtime via chpasswd, one shared services-<name> build is enough;
  this reclaims ~1.5 GB, which matters on a 79 GB disk.
- reconcile_team_state(): a challenge enabled while a team was down left
  state.json without ports/flag/password, so the next compose render died with
  KeyError. Now both the API and the CLI tools reconcile first.
 2026-09-25 21:03:29 +08:00
MythEclipse 6d1ede8c2b fix: bulk challenge enable path (compose YAML, base images, async toggle, tooling) 
- fix_dup_volumes.py: 4 canonical templates had TWO volumes: keys inside one
  service (invalid YAML -> 'mapping key volumes already defined'), which broke
  every enable for anti-alchemy/burvesigner/gemas-notes/kode-viewer.
- fjb: ghcr.io base is not anonymously pullable on this host; swapped to the
  official httpd:2.4 (its httpd.conf only uses stock modules). Added
  onlyBuiltDependencies to package.json (pnpm >=10 blocks esbuild's postinstall).
- xl + kode-viewer: node:20-slim-bookworm is not a real tag; use
  node:20-bookworm-slim. gift-voucher: buster -> bookworm.
- prebuild_images.py: build each challenge's shared services-<name> image once
  in parallel (passes a placeholder PASSWORD build-arg, since several Dockerfiles
  run chpasswd and fail on an empty arg).
- set_enabled.py / sync_all_challenges.py: batch registry flip + runtime apply
  that survives panel restarts and reports per-team results.
- Challenge toggle is now async: PATCH returns a job id, the client polls
  /api/challenges/jobs/<id> so a multi-minute build no longer blocks the panel.
  Added _SYNC_LOCK to serialize concurrent compose rewrites.
 2026-09-25 17:01:42 +08:00
MythEclipse d4c741926d fix: make challenge toggle actually work end-to-end (5 root-cause bugs) 
Found by testing a real enable/disable cycle (art, fjb, gift-card):

1. compose_gen always swapped build->image, so a never-built challenge
   produced 'pull access denied for services-<name>'. Now it only reuses
   the image when it exists locally, otherwise keeps build: so
   'docker compose up --build' builds it.
2. Canonical templates use 'build: context: .' (written for the shared
   services/ tree). In the per-team compose that resolves to the team dir
   which has no Dockerfile -> 'failed to read dockerfile'. The renderer
   now rewrites the main service's context to ./<name>.
3. Teams created before the XVI/XVII import had no xvi/xvii subpackages
   under their local challenges/ dir, so the regenerated receiver main.py
   crash-looped on import. gen_receiver_main now mirrors ALL shared
   checkers (native + xvi + xvii) into every team receiver on each sync.
4. systemd Environment= keys can't contain hyphens, so
   CHALLENGE_PORT_GIFT-CARD was silently dropped. Keys are now
   normalized to underscores on both the writer and reader side.
5. Several checkers called 'docker exec' with no timeout; against a
   container with accumulated chall.py zombies that blocks forever and
   stalls the whole SLA loop. Added mandatory timeouts (Phew, Sheesh,
   Carbeat, Poke, Warmup).

Also: enabling a challenge now copies its source tree into each team's
services/ dir (team dirs only held challenges enabled at create_team
time), and the XVII checkers were rewritten to be protocol-aware
(gift-card/gift-voucher are socat TCP, not HTTP) with strict timeouts.
 2026-09-25 15:36:09 +08:00
MythEclipse c6fd9ec268 feat: challenge registry-driven platform + XVI/XVII imports + admin toggle + domain rename 
- Rename repo/domain: attack-defense-platform / attackdefense.imrnes.team (all refs replaced)
- challenge_registry.json: single source of truth (28 challs across gemastik18/xvi/xvii)
- teams.py: registry-driven CHALLENGES, set_challenge_enabled, sync_challenge_runtime
  (apply enable/disable to live teams: build/up or stop/remove + receiver restart)
- compose_gen.py: render per-team compose from canonical per-challenge templates
  (image reuse, per-team ports 30xxx, flag mounts, passwords)
- gen_canonical_composes.py: canonical docker-compose.yml for all services
- import_new_challenges.py: import XVI/XVII services + EOL base image fixes
  (debian:buster→bookworm, node:14→20, python:3.7-slim→3.11)
- receiver: xvi package (10 checkers) + xvii package (12 generic checkers),
  Challenge base reads PASSWORD_<team_port> from env; gen_receiver_main.py
  generates per-team main.py from registry
- main.py: /api/challenges returns full registry; PATCH /api/challenges/<name>
  toggles enabled + applies to live teams
- index.html: 🏗️ Challenge Manager tab (toggle per challenge, grouped by set)
- SLA bonus now dynamic (all enabled challenges, not hardcoded 6)
 2026-09-25 14:04:33 +08:00
MythEclipse c35b23a37f feat: SLA dashboard per team + points system (100/flag, +50 SLA bonus) + badges juara/runner-up/3rd + scoreboard API public+admin 
Panel: /api/scoreboard + /api/public/scoreboard; teams.py: points.json ledger, probe_team_sla_fast, sla_status_all w/ background refresher; team.html: SLA & Skor tab; index.html: admin SLA tab; leaderboard shows points; Phew checker timeouts raised for slow Paillier keygen
 2026-09-24 00:49:05 +08:00
root 3ef905b3bb feat: team activity feed (attacks in/out) + activity tab + auto-refresh + leaderboard tab on team portal 2026-09-23 22:56:07 +08:00
root 877f14ecf3 fix: editTeam endpoint + leaderboard live name resolution + domains in team set + apt-insecure.conf in all service dirs 2026-09-23 21:50:16 +08:00
root 029b0f809a tools in all containers + apt GPG fix for 2026 clock + target dropdown fixed 
- all 6 Dockerfiles: vim curl wget netcat git python3-pip now installed
- apt-insecure.conf (AllowInsecureRepositories) copied into images so
  participants can apt-get install despite expired Ubuntu/Debian GPG keys
- warmup base ubuntu:20.04 (EOL, GPG expired) -> ubuntu:24.04
- installed vim+git live into all 18 running team containers
- team portal target dropdown reloads after login (was empty pre-auth)
- attack log endpoint + A/D submit (attacker vs target) verified e2e
 2026-09-23 18:54:03 +08:00
root 24dbf0a662 draggable topology + attack visualizer + tools in containers 
- topology nodes draggable (pointer events, SVG transform), layout hint shown
- attack visualizer: /api/attacks logs attacker->target events; red pulsing
  dashed arcs on recent attacks (60s hot), ⚔ counts ok/fail
- submit_flag now takes attacker_idx vs target_idx (A/D semantics); UI has
  target dropdown (enemy teams), leaderboard records target
- containers get vim+curl+wget+netcat+git+pip3 (Dockerfiles blogpost/cdn/
  phew/sheesh/warmup); warmup base ubuntu:20.04 EOL -> 24.04
- team portal: target dropdown refreshed after login (was empty pre-auth)
 2026-09-23 18:05:44 +08:00
root 44dc1ac852 feat: target matrix + reset scores/environment buttons 
- /api/targets (admin): matrix of all teams' domain:port targets
- /api/reset/scores: wipe leaderboard (admin, confirm dialog)
- /api/reset/environment: stop all teams, remove containers+receivers+
  team dirs+systemd units, wipe scores, drop domains (admin, confirm)
- portal targets now only domain+port (no ssh/labels)
- UI: tab Target Matrix, header buttons Reset Skor / Reset Environment
  with confirm() alerts 'apakah anda yakin ingin mereset...'
 2026-09-23 17:14:42 +08:00
root b66530e7fd fix: per-team receivers as independent systemd services 
Receivers were child Popen processes of gemastik-panel systemd cgroup;
restarting the panel killed all team receivers (SLA -> 0/6, 401 on
/api/team/N/status proxy). Now each team receiver is a systemd service
(gemastik-receiver-teamN.service) generated by gen_receiver_services.py with
per-team env (ports, containers, COMPOSE_LOCATION, .env). Verified: panel
restart no longer kills receivers; 18/18 SLA stays UP.
 2026-09-23 17:06:24 +08:00
root 72382c43d0 fix: guide link IDOR, full team-api IDOR hardening, loading overlay 
- guide link now server-side replaced to /team/<idx>/guide (no /team/0 403)
- _check_team_host() applied to ALL team endpoints (login, info, targets,
  status, guide, portal, ssh-ws): host must match team domain; panel/gemastik
  host only with admin session. Cross-domain session reuse -> 403.
- host check BEFORE auth on info/targets (no team-existence oracle)
- loading overlay (spinner + text) on start/stop all-team/set; JS util
  showLoading/hideLoading
 2026-09-23 17:02:52 +08:00
root 01ffc05a11 fix: simplify team domain link (root = portal) 2026-09-23 16:38:30 +08:00
root 43ed3df557 feat: team portal with own login, SSH web terminal, targets & guide 
- Portal tim punya login sendiri (password = ssh_pass, session team_token)
- SSH Web GUI: /api/team/{idx}/ssh/ws (WebSocket+paramiko) → xterm.js terminal
  (fix: ssh_to_ws non-blocking poll, chall_passwords per-container auth)
- Root <slug>.gemastik.imrnes.team → portal tim (bukan login admin)
- Host validation: /team/{idx} & /team/{idx}/guide 403 kalau host != team domain
- /api/team/{idx}/targets: daftar service tim musuh (attack target)
- guide.html: panduan SSH/attack/defense untuk peserta
- fix esc() String(s) (bug: (s||'').replace is not a function saat port number)
- set_ssh_passwords retry loop (container boot race)
 2026-09-23 16:37:58 +08:00
1387 changed files with 316165 additions and 553 deletions
Expand all files Collapse all files

No files matched your search

README.md
+636 -14
View File
@@ -1,18 +1,640 @@
# Gemastik XVIII Cybersecurity Final Round - Attack Defense Repository # Attack Defense Platform
## challenges Platform attack-defense (serang–serang) untuk GEMASTIK Final Round, menyatukan
**28 challenge** dari tiga set (**GEMASTIK XVIII**, **XVI**, **XVII**) di bawah
satu panel admin, satu flag store, satu SLA checker, dan satu skorboard.
| challenges | author | category | Multi-team: N tim, masing-masing memiliki copy semua challenge + flag sendiri,
| ---------- | ----------- | -------- | dengan receiver terisolasi per tim, checker SLA otomatis, dan visualisasi
| blogpost | keii | web | topologi serangan real-time.
| cdn | keii | foren |
| phew | itoid | crypto |
| sheesh | itoid | crypto |
| carbeat | rui | pwn |
| warmup | hanz0 | warmup |
## how-to-run ```
Browser (admin/team)
| HTTP + WebSocket (proxy server-side)
v
Panel :18081 (FastAPI) ---- systemd: gemastik-panel
|
+--> Receiver global :18080 ---- systemd: gemastik-receiver
+--> Receiver tim N :31080+1000*(N-1) ---- systemd: gemastik-receiver-teamN
| (menjalankan checker SLA untuk tim N)
+--> N x <challenge>_container_teamN ---- docker compose
|
+--> flags + leaderboard + points (teams/leaderboard.json, teams/points.json)
```
```` ---
sudo python3 starter.py
```` ## Daftar Isi
- [Arsitektur](#arsitektur)
- [Spesifikasi Challenge](#spesifikasi-challenge)
- [Spesifikasi Port](#spesifikasi-port)
- [Skor dan Penilaian](#skor-dan-penilaian)
- [Kebutuhan Sistem](#kebutuhan-sistem)
- [Setup](#setup)
- [Operasional Harian](#operasional-harian)
- [Topologi](#topologi)
- [HTTP API](#http-api)
- [Troubleshooting](#troubleshooting)
- [Jebakan Operasional](#jebakan-operasional)
- [Struktur Direktori](#struktur-direktori)
---
## Arsitektur
Tiga proses inti, semuanya dikelola systemd:
| Proses | Port | Unit systemd | Peran |
|---|---|---|---|
| Panel admin | **18081** | `gemastik-panel` | Web UI admin + seluruh API |
| Receiver global | **18080** | `gemastik-receiver` | Flag store untuk mode single-node |
| Receiver tim N | **31080 + 1000×(N−1)** | `gemastik-receiver-teamN` | Checker SLA tim N |
**Mengapa receiver per tim harus unit terpisah.** Kalau receiver dijalankan
sebagai child process dari panel, `systemctl restart gemastik-panel` akan
membunuh seluruh cgroup — termasuk semua receiver — dan SLA semua tim ikut
turun ke 0. Unit terpisah membuat restart panel tidak menyentuh receiver.
Generatornya: `panel/gen_receiver_services.py`.
**Kredensial tidak pernah masuk browser.** Panel melakukan proxy ke receiver
secara server-side, sehingga password admin hanya ada di `panel/.env` pada host.
**Sumber data tunggal.** `teams/challenge_registry.json` dibaca oleh panel,
generator compose, dan generator receiver. Menambah challenge = menambah satu
entri di registry, bukan menyunting tiga tempat.
### Alur satu flag
```
tim penyerang submit flag
-> panel POST /api/flag/submit
-> baca flag tim target dari receiver
-> cocok?
ya -> catat di leaderboard + skor untuk PENYERANG
tidak -> tolak
```
Flag di-mint per (tim, challenge), bukan satu flag global.
---
## Spesifikasi Challenge
**28 challenge terdaftar, 16 aktif secara default.**
Kolom `Port team 1` / `SSH team 1` diisi `-` untuk challenge nonaktif karena
port-nya baru dialokasikan saat challenge diaktifkan.
### GEMASTIK XVIII — 6 challenge, 6 aktif
User SSH: `ctfuser`.
| # | Challenge | Kategori | org_port | Offset chall/SSH | Port team 1 | SSH team 1 | Status |
|---|---|---|---|---|---|---|---|
| 1 | `blogpost` | web | 10000 | 0/22 | 31000 | 31022 | aktif |
| 2 | `carbeat` | pwn | 11000 | 1/23 | 31001 | 31023 | aktif |
| 3 | `cdn` | web | 12000 | 2/24 | 31002 | 31024 | aktif |
| 4 | `phew` | crypto | 13000 | 3/25 | 31003 | 31025 | aktif |
| 5 | `sheesh` | crypto | 14000 | 4/26 | 31004 | 31026 | aktif |
| 6 | `warmup` | warmup | 15000 | 5/27 | 31005 | 31027 | aktif |
### GEMASTIK XVI — 10 challenge, 3 aktif
User SSH: `root`.
| # | Challenge | Kategori | org_port | Offset chall/SSH | Port team 1 | SSH team 1 | Status |
|---|---|---|---|---|---|---|---|
| 7 | `art` | web | 10000 | 10/110 | 31010 | 31110 | aktif |
| 8 | `xl` | web | 11000 | 11/111 | 31011 | 31111 | aktif |
| 9 | `gemas-notes` | web | 12000 | 12/112 | - | - | nonaktif |
| 10 | `pasta` | web | 13000 | 13/113 | - | - | nonaktif |
| 11 | `burvesigner` | crypto | 14000 | 14/114 | - | - | nonaktif |
| 12 | `hirnfick` | pwn | 15000 | 15/115 | - | - | nonaktif |
| 13 | `gemas-fetcher` | web | 16000 | 16/116 | - | - | nonaktif |
| 14 | `s3` | web | 20000 | 20/120 | 31020 | 31120 | aktif |
| 15 | `crawlback` | web | 21000 | 21/121 | - | - | nonaktif |
| 16 | `back-to-basic` | warmup | 22000 | 22/122 | - | - | nonaktif |
### GEMASTIK XVII — 12 challenge, 7 aktif
User SSH: `root`.
| # | Challenge | Kategori | org_port | Offset chall/SSH | Port team 1 | SSH team 1 | Status |
|---|---|---|---|---|---|---|---|
| 17 | `anti-alchemy` | web | 11000 | 30/130 | 31030 | 31130 | aktif |
| 18 | `asmr` | pwn | 15000 | 31/131 | - | - | nonaktif |
| 19 | `bit-canvas` | pwn | 20000 | 32/132 | 31032 | 31132 | aktif |
| 20 | `fjb` | web-pwn | 17000 | 33/133 | - | - | nonaktif |
| 21 | `gift-card` | crypto | 21000 | 34/134 | 31034 | 31134 | aktif |
| 22 | `gift-voucher` | crypto | 16000 | 35/135 | 31035 | 31135 | aktif |
| 23 | `gleam-drive` | web-crypto | 12000 | 36/136 | 31036 | 31136 | aktif |
| 24 | `go-green` | rev | 20000 | 37/137 | - | - | nonaktif |
| 25 | `kode-viewer` | web | 10000 | 38/138 | - | - | nonaktif |
| 26 | `more-less` | web | 22000 | 39/139 | 31039 | 31139 | aktif |
| 27 | `tempest-poc` | web | 14080 | 40/140 | - | - | nonaktif |
| 28 | `ticketer` | crypto | 14000 | 41/141 | 31041 | 31141 | aktif |
Kategori: 13 web, 6 crypto, 4 pwn, 2 warmup, dan masing-masing satu
web-pwn, web-crypto, rev. `gleam-drive` dilayani lewat HTTPS (field `scheme`
di registry), 27 challenge lainnya HTTP.
### Format flag
```
GEMASTIK18{TEAM<idx>_<CHALLENGE>_<12 hex>}
contoh: GEMASTIK18{TEAM1_BLOGPOST_<12 hex acak>}
```
### User SSH per challenge
Hanya 6 challenge native GEMASTIK XVIII yang membuat user `ctfuser`. Semua
challenge impor XVI/XVII menjalankan `echo root:${PASSWORD} | chpasswd` di
Dockerfile, sehingga login sebagai `ctfuser` ditolak walaupun password benar.
Field `ssh_user` di `teams/challenge_registry.json` yang menentukan ini, dibaca
`panel/teams.py` saat `set_ssh_passwords()`. Men-hardcode `ctfuser` membuat 10
dari 16 challenge gagal login padahal `state.json` terlihat benar.
---
## Spesifikasi Port
Setiap tim mendapat blok port sendiri, dengan basis 30000 dan langkah 1000:
```
port_challenge(tim i, challenge c) = 30000 + 1000 x i + chall_offset(c)
port_ssh(tim i, challenge c) = 30000 + 1000 x i + ssh_offset(c)
port_receiver(tim i) = 30000 + 1000 x i + 80
```
`chall_offset` dan `ssh_offset` dibaca dari `teams/challenge_registry.json`
(`panel/teams.py`, `create_team()`). Field `org_port` di registry adalah port
native challenge di graveyard asalnya dan **tidak dipakai** untuk menghitung
port runtime.
Enam challenge native GEMASTIK XVIII memakai offset challenge 0–5 dan SSH
22–27, sehingga untuk team 1 berada di 31000–31005 dan 31022–31027:
| Tim | Port challenge | Port SSH | Receiver |
|---|---|---|---|
| 1 | 31000–31005 | 31022–31027 | 31080 |
| 2 | 32000–32005 | 32022–32027 | 32080 |
| 3 | 33000–33005 | 33022–33027 | 33080 |
| 4 | 34000–34005 | 34022–34027 | 34080 |
Challenge impor memakai offset sendiri, jadi portnya tidak selalu berakhiran
`0000`–`0005`. Angka nyata team 1: `art` 31010/31110, `xl` 31011/31111,
`s3` 31020/31120, `anti-alchemy` 31030/31130, `bit-canvas` 31032/31132,
`gift-card` 31034/31134, `gift-voucher` 31035/31135,
`gleam-drive` 31036/31136, `more-less` 31039/31139, `ticketer` 31041/31141.
Dua challenge dengan `org_port` sama tidak bentrok, karena yang dipakai adalah
`chall_offset`. `anti-alchemy` (XVII, offset 30) dan `carbeat` (XVIII,
offset 1) sama-sama punya `org_port` 11000, tetapi memakai port 31030 dan
31001.
---
## Skor dan Penilaian
```python
POINTS_PER_FLAG = 100 # ke tim PENYERANG, hanya solve pertama
SLA_BONUS_POINTS = 50 # bonus bila semua challenge aktif UP
SLA_BONUS_MIN_ALIVE = 6 # konstanta; threshold runtime = len(enabled_challenges())
```
**Attack points.** Submit flag benar milik tim lain memberi +100 ke tim
penyerang. Duplikat (flag + penyerang + target sama) tidak dihitung dua kali.
**SLA bonus.** Diberi bila semua challenge yang aktif UP, maksimal sekali per
jendela 5 menit. Threshold runtime bukan angka tetap 6 melainkan
`len(enabled_challenges())` — mengaktifkan challenge ke-17 membuat syaratnya
"semua 17 UP".
**Badge.** Juara, runner-up, dan tempat ketiga dihitung dari total poin.
---
## Kebutuhan Sistem
Host reference: Ubuntu 24.04 (noble), x86_64, Docker + Compose v2, systemd.
| Sumber daya | Minimum | Recommended |
|---|---|---|
| CPU | 2 vCPU | 4 vCPU |
| RAM | 8 GB | 16 GB |
| Disk | 60 GB | 100 GB+ |
| Docker | Compose v2 (`docker compose`) | — |
Compose v1 (`docker-compose`) tidak didukung — seluruh generator memakai
`docker compose`.
Disk adalah pembatas utama. Tiap challenge yang aktif menjadi satu image
`services-<name>`; ukurannya bervariasi dari ~190 MB (`gift-card`) sampai ~900 MB
(`warmup`), dan pada host ini 16 image aktif menempati sekitar 8 GB. Membangun
banyak challenge sekaligus akan mengisi disk sebelum selesai — implementasi
terbaik adalah membangun challenge secara berurutan dan menjalankan
`docker builder prune -af` di antaranya.
`phew` menjalankan generator kunci Paillier saat start (±12 detik) sehingga
butuh RAM ekstra dan checker-nya memakai `_CRYPTO_TIMEOUT`, bukan timeout prompt
bawaan 5 detik.
Prasyarat jaringan: setiap compose template sudah memuat
`extra_hosts: host.docker.internal:host-gateway`, dan UFW host harus
mengizinkan port challenge (lihat [Jebakan Operasional](#jebakan-operasional)).
Dependency checker ada di `receiver/requirements.txt`: fastapi, uvicorn,
pwntools, pyelftools, pycryptodome, fastecdsa, ecdsa, Pillow, pandas, openpyxl,
PyPDF2.
---
## Setup
### 1. Clone
```bash
git clone <repo-url> attack-defense-platform
cd attack-defense-platform
```
Semua path di dalam kode memakai `/opt/gemastik18-final` sebagai `BASE`, jadi
letakkan repo di sana:
```bash
sudo mkdir -p /opt
sudo mv attack-defense-platform /opt/gemastik18-final
cd /opt/gemastik18-final
```
### 2. Docker
```bash
sudo bash node.sh
```
`node.sh` memasang Docker CE dari repo resmi lalu menjalankan `starter.py`.
Instalasi manual:
```bash
sudo apt-get install -y docker-ce docker-ce-cli containerd.io \
docker-buildx-plugin docker-compose-plugin
```
### 3. Kredensial panel
```bash
cat > panel/.env <<'EOF'
PANEL_ADMIN_USER=admin
PANEL_ADMIN_PASS=ganti-dengan-password-kuat
EOF
chmod 600 panel/.env
```
`panel/.env` sudah masuk `.gitignore` dan tidak pernah ter-commit.
### 4. Python environment
```bash
cd /opt/gemastik18-final/receiver
sudo python3 -m venv .venv
sudo .venv/bin/pip install -r requirements.txt
```
### 5. Unit systemd
Panel (:18081):
```ini
# /etc/systemd/system/gemastik-panel.service
[Unit]
Description=Gemastik A/D Panel (web UI for receiver)
After=gemastik-receiver.service network-online.target
Wants=gemastik-receiver.service
[Service]
Type=simple
WorkingDirectory=/opt/gemastik18-final/panel
EnvironmentFile=-/opt/gemastik18-final/panel/.env
ExecStart=/opt/gemastik18-final/receiver/.venv/bin/python -m uvicorn main:app --host 0.0.0.0 --port 18081
Restart=always
RestartSec=5
Environment=PYTHONUNBUFFERED=1
[Install]
WantedBy=multi-user.target
```
Receiver global (:18080):
```ini
# /etc/systemd/system/gemastik-receiver.service
[Unit]
Description=Gemastik18 Receiver Service (CTF flag/control API)
After=docker.service network-online.target
Wants=docker.service
Requires=docker.service
[Service]
Type=simple
WorkingDirectory=/opt/gemastik18-final/receiver
ExecStart=/opt/gemastik18-final/receiver/.venv/bin/python -m uvicorn main:app --host 0.0.0.0 --port 18080
Restart=always
RestartSec=5
Environment=PYTHONUNBUFFERED=1
[Install]
WantedBy=multi-user.target
```
```bash
sudo systemctl daemon-reload
sudo systemctl enable --now gemastik-receiver gemastik-panel
systemctl is-active gemastik-panel gemastik-receiver
```
### 6. Buat tim
Lewat UI (**Teams** tab, admin login) atau API:
```bash
curl -X POST http://127.0.0.1:18081/api/teams/set \
-H 'Content-Type: application/json' \
-b cookies.txt -c cookies.txt \
-d '{"count":2,"labels":{"1":"Tim Satu","2":"Tim Dua"}}'
```
Endpoint ini idempoten (membuat yang hilang, mempertahankan yang ada) dan
otomatis menjalankan `sync_team_ufw()` untuk setiap tim baru — tanpa itu port
tim akan di-blackhole UFW.
### 7. Verifikasi
```bash
bash panel/verify_platform_health.py
```
---
## Operasional Harian
| Aksi | Perintah |
|---|---|
| Lihat status semua service | `systemctl is-active gemastik-panel gemastik-receiver gemastik-receiver-team*` |
| Restart panel | `systemctl restart gemastik-panel` |
| Sinkronkan container tim dengan registry | `bash panel/apply_registry.sh` |
| Health check | `python3 panel/verify_platform_health.py` |
| SSH round-trip ke semua challenge | `python3 panel/verify_ssh_e2e.py` |
| Cek user SSH per challenge | `bash panel/audit_ssh_users.sh` |
| Reset penuh (tim, flag, kredensial) | `bash panel/reset_runtime.sh` |
| Health suite topologi | `bash panel/verify_topo_full.sh` |
| Beban host | `bash panel/watch_load.sh` |
**Reverse proxy.** Domain challenge dan panel dilayani Traefik lewat file
dynamic di `/data/coolify/proxy/dynamic/attackdefense.yaml`. Pola service:
```yaml
services:
gemastik-panel-service:
loadBalancer:
servers:
- url: "http://host.docker.internal:18081"
```
Cert TLS terbit otomatis lewat `certResolver: letsencrypt` selama DNS
terresolve dan port 80 terbuka.
Domain yang dipakai di host ini: `panel.attackdefense.imrnes.team` (panel, :18081)
dan `attackdefense.imrnes.team` (receiver global, :18080), plus subdomain
per challenge aktif. Perhatikan domain bare menunjuk ke receiver, bukan panel —
`/login` di sana akan 404 dan terlihat seperti panel mati.
---
## Topologi
Tab **Topology** merender graf serangan antar tim dengan PixiJS v8
(`panel/static/topo_pixi.js`, engine di `panel/static/vendor/pixi.mjs`).
- Pan, zoom, dan drag berjalan lewat satu funnel `applyView()`.
- Drag node tim menyeret seluruh challenge-nya. Indeks parent→child dibangun
dari edge list — sumber yang sama untuk menggambar garis — sehingga hierarki
drag tidak mungkin berbeda dari gambar.
- Ticker Pixi didaftarkan tapi tidak dinyalakan: render berlangsung on demand
(hanya saat ada pulse serangan atau sedang drag), lalu berhenti saat sunyi.
Pada host tanpa GPU, repaint 60fps atas scene statis membuat halaman tidak
merespons (rAF turun ke 2 FPS, lag `setTimeout(0)` 1353 ms).
- Posisi drag kembali ke layout otomatis saat data di-refresh tiap 10 detik.
Untuk merender ulang objek, `.text` hanya di-set bila string benar-benar
berubah — setiap `Text` baru meng-upload texture GPU (~1,6 detik per siklus
bila di-rebuild terus-menerus).
Suite tes: `bash panel/run_topo_tests.sh`
(`test_topo_pixels`, `test_topo_browser`, `test_topo_viewports`,
`test_topo_race`, `test_topo_drag`).
---
## HTTP API
Semua endpoint di `/api` kecuali yang ditandai publik.
### Publik
| Method | Path | Keterangan |
|---|---|---|
| GET | `/submit` | UI submit flag publik |
| POST | `/api/flag/submit` | Submit flag |
| GET | `/api/public/scoreboard` | Skorboard tanpa login |
| GET | `/api/public/teams` | Daftar tim tanpa login |
### Admin (butuh login)
| Method | Path | Keterangan |
|---|---|---|
| POST | `/api/login` | Login admin |
| POST | `/api/logout` | Logout |
| GET | `/api/challenges` | Daftar challenge + status |
| PATCH | `/api/challenges/{challenge}` | Toggle enable/disable (body `{"enabled":bool}`) |
| GET | `/api/challenges/jobs/{job_id}` | Progress job toggle |
| GET | `/api/status` | Status runtime |
| GET | `/api/topology` | Data graf topologi |
| GET | `/api/teams` | Daftar tim |
| POST | `/api/teams/set` | Buat N tim (idempoten) |
| PUT | `/api/teams/{idx}` | Ubah label/domain tim |
| DELETE | `/api/teams/{idx}` | Hapus satu tim (body `{"purge_scores":true}`) |
| POST | `/api/teams/bulk-delete` | Hapus beberapa tim (job) |
| GET | `/api/teams/bulk-delete/{job_id}` | Progress job hapus massal |
| POST | `/api/teams/{idx}/ufw` | Sinkronkan aturan UFW tim |
| POST | `/api/teams/start` | Start semua tim |
| POST | `/api/teams/stop` | Stop semua tim |
| POST | `/api/teams/{idx}/randomize` | Acak flag tim |
| GET | `/api/teams/{idx}/logs` | Log tim |
| GET | `/api/teams/{idx}/creds` | Kredensial tim |
| GET | `/api/credential/{challenge}` | Kredensial satu challenge |
| GET | `/api/targets` | Target serangan |
| GET | `/api/attacks` | Log serangan |
| GET | `/api/leaderboard` | Leaderboard |
| GET | `/api/scoreboard` | Skorboard internal |
| GET | `/api/history` | Riwayat |
| POST | `/api/restart/{challenge}` | Restart challenge |
| POST | `/api/rollback/{challenge}` | Rollback challenge |
| POST | `/api/activate/{challenge}` | Aktifkan challenge |
| POST | `/api/deactivate/{challenge}` | Nonaktifkan challenge |
| POST | `/api/reset/scores` | Reset skor |
| POST | `/api/reset/environment` | Reset environment (hapus tim + flag) |
Toggle challenge jalan asinkron: build per tim bisa memakan waktu menit, jadi
kerjaan dijalankan di background thread dan klien melakukan polling ke
`/api/challenges/jobs/{job_id}`. Hapus tim massal juga berupa job karena satu
tim butuh sekitar 100 detik (`compose down` 16 service) — empat tim inline akan
menahan request sekitar 7 menit dan memicu timeout di semua proxy.
### Tim (login tim)
| Method | Path | Keterangan |
|---|---|---|
| GET | `/team/{idx}` | Portal tim |
| GET | `/team/{idx}/guide` | Panduan tim |
| POST | `/api/team/{idx}/login` | Login tim |
| POST | `/api/team/logout` | Logout tim |
| GET | `/api/team/{idx}/session` | Status sesi |
| GET | `/api/team/{idx}/own-challenges` | Challenge milik tim |
| GET | `/api/team/{idx}/targets` | Target untuk diserang |
| GET | `/api/team/{idx}/info` | Info tim |
| GET | `/api/team/{idx}/status` | Status challenge tim |
| GET | `/api/team/{idx}/activity` | Aktivitas tim |
| WS | `/api/team/{idx}/ssh/ws` | Terminal web ke container tim |
---
## Troubleshooting
**`/login` di domain attackdefense.imrnes.team mengembalikan 404.**
Domain bare diarahkan ke receiver global (:18080), bukan panel. Panel ada di
`panel.attackdefense.imrnes.team` (:18081). Dua router berbeda melayani kedua
subdomain di `attackdefense.yaml`.
**SLA turun ke 0 padahal container hidup.**
Bisa jadi receiver-nya mati, atau sering: restart panel mematikan receiver
karena keduanya satu cgroup. Cek `systemctl is-active gemastik-receiver-team*`.
**SSH ditolak padahal password di `state.json` benar.**
Cek `ssh_user` untuk challenge tersebut di registry. 10 dari 16 challenge
impor login sebagai `root`, bukan `ctfuser`.
**Flag expired / tidak cocok.**
`reset_environment()` menghapus flag lama. Cek
`teams/team<N>/receiver/flags/<challenge>.txt`.
**Waktu toggle sangat lama.**
Normal — satu toggle membangun image per tim. Pantau lewat
`/api/challenges/jobs/{job_id}`, bukan dengan kill prosesnya.
**`pull access denied for services-<name>`.**
Image belum ada sehingga compose mencoba build dengan context yang salah.
`compose_gen` hanya menukar `build` menjadi `image` bila image-nya benar-benar
ada di `docker images`.
**Disk penuh (`/` 0 byte).**
Lihat [Jebakan Operasional](#jebakan-operasional). Yang benar:
`docker builder prune -af` dan `journalctl --vacuum-size=50M`.
`docker image prune -af` menghapus image `services-*` yang sedang dipakai.
---
## Jebakan Operasional
Yang sudah ketahuan dan sudah diperbaiki. Semua masih berlaku sebagai alasan
mengapa kode sekarang berbentuk seperti sekarang.
**Base image EOL.** `debian:buster`, `ubuntu:20.04`, dan `node:14` gagal
`apt-get update` karena GPG kedaluwarsa atau mirror 404. Pakai bookworm/noble,
`node:20`.
**UFW default deny.** Host ini punya UFW aktif default deny. Port baru harus
dibuka (`ufw allow <port>/tcp`) atau traffic di-blackhole diam-diam —
termasuk dari container lewat docker bridge. `POST /api/teams/set` sudah
menjalankan `sync_team_ufw()` karena alasan ini.
**Project name compose wajib.** Per-team compose harus dijalankan dengan
`-p teamN`. Tanpa itu `docker compose` memakai nama direktori induk (`services`)
untuk semua tim, sehingga container team2 tertimpa team1.
**`docker image prune -af` menghapus image yang sedang dipakai.** Image
`services-*` menjadi dangling dan terhapus meski container masih jalan.
Container tetap hidup tetapi image hilang dan tidak bisa di-recreate. Untuk
membersihkan ruang: `docker builder prune -af` +
`journalctl --vacuum-size=100M` + hapus `/root/.cache`.
**Container orphan.** Sweep dengan:
```bash
docker ps --format '{{.Names}}' | grep -E '_container$' | grep -vE '_team[0-9]+$'
```
**Beban checker.** Host 2-CPU/8GB tidak boleh meng-probe 4 receiver
sekaligus (Flask sinkron + CPU bersama = SLA timeout palsu), dan tidak boleh
menjalankan banyak generator kunci Paillier/RSA bersamaan. Cek `uptime`,
`free -m`, `vmstat 1 3` sebelum menyalahkan checker.
**`subprocess.run(['docker','exec',...])` tanpa timeout.** Container yang
jenuh memblokir selamanya dan menahan seluruh loop SLA.
---
## Struktur Direktori
```
/opt/gemastik18-final/
├── README.md
├── node.sh # installer Docker
├── starter.py # bootstrap single-node (upstream)
├── teams/
│ ├── challenge_registry.json # sumber data tunggal 28 challenge
│ ├── points.json # skor + event
│ ├── leaderboard.json # solve
│ ├── attacks.json # log serangan (visualisasi topologi)
│ └── teamN/
│ ├── state.json # port, flag, kredensial, label, domain
│ ├── services/docker-compose.yml # hasil generate per tim
│ └── receiver/ # receiver terisolasi tim N
├── services/<challenge>/ # Dockerfile + compose template (28 challenge)
├── panel/
│ ├── main.py # FastAPI: seluruh route
│ ├── teams.py # orkestrasi tim, port, flag, skor, SLA
│ ├── compose_gen.py # render compose per tim dari registry
│ ├── gen_receiver_services.py # generate unit systemd per tim
│ ├── gen_receiver_main.py # generate main.py receiver per tim
│ ├── apply_registry.sh # sinkronkan container dengan registry
│ ├── reset_runtime.sh # reset penuh
│ ├── verify_platform_health.py
│ ├── verify_ssh_e2e.py
│ ├── audit_ssh_users.sh
│ ├── run_topo_tests.sh
│ ├── verify_topo_full.sh
│ └── static/
│ ├── index.html # dashboard admin
│ ├── team.html # portal tim
│ ├── topo_pixi.js # renderer topologi PixiJS v8
│ └── vendor/pixi.mjs
└── receiver/
├── main.py # API receiver (flag store + checker)
├── config.py
├── requirements.txt
├── challenges/ # checker: Blogpost, Phew, xvi/, xvii/
├── flags/ # flag default
└── .venv/
```
---
## Credit
Challenge berasal dari tiga repositori:
[gemastik18-final](https://github.com/rayhanhanaputra/gemastik18-final),
[gemastik-xvi-final](https://github.com/vidner/gemastik-xvi-final),
[gemastik-xvii-final](https://github.com/vidner/gemastik-xvii-final).
panel/apply_registry.sh
+33
View File
@@ -0,0 +1,33 @@
#!/usr/bin/env bash
# Bring every team's containers in line with the registry's enabled set.
#
# For each team: re-render the compose from the registry, then `up -d`. Because
# the shared `services-<name>` images already exist, this is a start, not a
# rebuild, so it is fast. Containers of challenges that are no longer enabled are
# removed by `up --remove-orphans`.
set -uo pipefail
cd /opt/gemastik18-final/panel
python3 - <<'PY'
import json, sys
sys.path.insert(0, '.')
import teams as orch, compose_gen
orch.reconcile_team_state()
for d in sorted(orch.TEAMS_DIR.glob("team*")):
sf = d / "state.json"
if not sf.exists():
continue
st = json.loads(sf.read_text())
(d / "services" / "docker-compose.yml").write_text(
compose_gen.render_team_compose(st["index"], st))
print(f"team{st['index']} compose rendered")
PY
for i in 1 2 3 4; do
cd "/opt/gemastik18-final/teams/team$i/services"
echo "--- team$i ---"
docker compose -p "team$i" up -d --remove-orphans 2>&1 | tail -2
done
echo "=== result ==="
docker ps --format '{{.Names}}' | grep -c '_container_team'
df -h / | tail -1
panel/audit_ssh_users.sh
+16
View File
@@ -0,0 +1,16 @@
#!/usr/bin/env bash
# Which SSH user does each challenge's image actually provision?
# The imported XVI/XVII challenges do NOT all use `ctfuser`: art uses `root`,
# anti-alchemy uses `ctf`. set_ssh_passwords() only does
# `echo 'ctfuser:<pw>' | chpasswd`, so for those images it either fails or sets
# a password on an account nobody logs in as -> "Permission denied" for every
# team, while state.json looks perfectly correct.
set -uo pipefail
cd /opt/gemastik18-final
printf "%-18s %s\n" CHALLENGE "Dockerfile user provisioning"
for d in services/*/; do
name=$(basename "$d")
[ -f "$d/Dockerfile" ] || continue
line=$(grep -hE 'chpasswd|useradd|adduser' "$d/Dockerfile" 2>/dev/null | head -2 | tr '\n' ';' | cut -c1-110)
printf "%-18s %s\n" "$name" "${line:-<none>}"
done
panel/bulk_delete_test.sh
+58
View File
@@ -0,0 +1,58 @@
#!/usr/bin/env bash
# Bulk-delete regression test: create two scratch teams, then delete BOTH in a
# single API call and poll the job until it settles.
#
# Proves the endpoint exists, validates input, runs teams sequentially inside
# one background job, and leaves the real teams untouched.
set -uo pipefail
BASE=/opt/gemastik18-final
cd "$BASE"
CJ=/tmp/bulk_cj
U=$(grep -oP '^PANEL_ADMIN_USER=\K.*' panel/.env)
P=$(grep -oP '^PANEL_ADMIN_PASS=\K.*' panel/.env)
curl -sS -c "$CJ" -X POST -H 'Content-Type: application/json' \
-d "{\"user\":\"$U\",\"pass\":\"$P\"}" http://127.0.0.1:18081/api/login -o /dev/null
echo "=== validation ==="
printf " empty list -> "
curl -sS -b "$CJ" -X POST -H 'Content-Type: application/json' -d '{"indices":[]}' \
http://127.0.0.1:18081/api/teams/bulk-delete -w ' [%{http_code}]\n'
printf " missing tms -> "
curl -sS -b "$CJ" -X POST -H 'Content-Type: application/json' -d '{"indices":[99,98]}' \
http://127.0.0.1:18081/api/teams/bulk-delete -w ' [%{http_code}]\n'
echo "=== BEFORE ==="
for i in 5 6; do
printf " team%s dir=%s\n" "$i" "$([ -d "teams/team$i" ] && echo present || echo GONE)"
done
echo "=== BULK DELETE [5,6] ==="
S=$(date +%s)
curl -sS -b "$CJ" -X POST -H 'Content-Type: application/json' \
-d '{"indices":[5,6],"purge_scores":true}' \
http://127.0.0.1:18081/api/teams/bulk-delete -o /tmp/bulk.json -w ' HTTP %{http_code}\n'
cat /tmp/bulk.json; echo
JOB=$(python3 -c "import json;print(json.load(open('/tmp/bulk.json'))['job'])")
echo " job: $JOB"
while :; do
curl -sS -b "$CJ" "http://127.0.0.1:18081/api/teams/bulk-delete/$JOB" -o /tmp/bulkjob.json
read -r ST DET <<<"$(python3 -c "
import json;d=json.load(open('/tmp/bulkjob.json'));print(d['state'],d.get('detail',''))")"
echo " [$(( $(date +%s) - S ))s] $ST — $DET"
[ "$ST" != "running" ] && break
sleep 15
done
echo " elapsed: $(( $(date +%s) - S ))s"
python3 -c "
import json;d=json.load(open('/tmp/bulkjob.json'))
print(' state:',d['state'],' errors:',d.get('errors'))
for x in d.get('done',[]): print(' deleted team',x['team'],x['label'],'->',x['steps'])"
echo "=== AFTER ==="
for i in 5 6; do
printf " team%s dir=%s\n" "$i" "$([ -d "teams/team$i" ] && echo present || echo GONE)"
done
echo " real teams: $(curl -sS -b "$CJ" http://127.0.0.1:18081/api/teams \
| python3 -c "import json,sys;print([t['index'] for t in json.load(sys.stdin)['teams']])")"
panel/check_all_js.js
+25
View File
@@ -0,0 +1,25 @@
// Syntax-check every inline <script> block across all panel static pages.
const fs = require('fs');
const { execFileSync } = require('child_process');
const files = ['static/index.html', 'static/team.html', 'static/guide.html'];
const base = '/opt/gemastik18-final/panel/';
let bad = 0, total = 0;
for (const f of files) {
const html = fs.readFileSync(base + f, 'utf8');
const re = /<script(?![^>]*\bsrc=)[^>]*>([\s\S]*?)<\/script>/gi;
let m, i = 0;
while ((m = re.exec(html)) !== null) {
i++; total++;
const p = `/tmp/chk_${f.replace(/\W/g, '_')}_${i}.js`;
fs.writeFileSync(p, m[1]);
try {
execFileSync(process.execPath, ['--check', p], { stdio: 'pipe' });
console.log(` OK ${f} block#${i}`);
} catch (e) {
bad++;
console.log(` FAIL ${f} block#${i}\n${e.stderr.toString().split('\n').slice(0, 5).join('\n')}`);
}
}
}
console.log(bad === 0 ? `\nAll ${total} script block(s) parse cleanly.` : `\n${bad}/${total} FAILED.`);
process.exit(bad ? 1 : 0);
panel/check_ui_js.js
+20
View File
@@ -0,0 +1,20 @@
// Extract every <script> block from index.html and syntax-check each with node.
const fs = require('fs');
const { execFileSync } = require('child_process');
const html = fs.readFileSync('/opt/gemastik18-final/panel/static/index.html', 'utf8');
const re = /<script(?![^>]*\bsrc=)[^>]*>([\s\S]*?)<\/script>/gi;
let m, i = 0, bad = 0;
while ((m = re.exec(html)) !== null) {
i++;
const code = m[1];
const f = `/tmp/blk_${i}.js`;
fs.writeFileSync(f, code);
try {
execFileSync(process.execPath, ['--check', f], { stdio: 'pipe' });
console.log(` script #${i}: OK (${code.split('\n').length} lines)`);
} catch (e) {
bad++;
console.log(` script #${i}: SYNTAX ERROR -> ${e.stderr.toString().split('\n').slice(0, 6).join('\n')}`);
}
}
console.log(bad === 0 ? `\nAll ${i} inline script block(s) parse cleanly.` : `\n${bad} block(s) FAILED.`);
panel/check_venv_health.sh
Executable
+71
View File
@@ -0,0 +1,71 @@
#!/usr/bin/env bash
# Pre-flight guard for the gemastik/attack-defense platform venv.
#
# WHY THIS EXISTS (2026-09-29 incident):
# `apt-get -y autoremove --purge` on Ubuntu 26.04 (resolute) removed
# python3.12, python3.12-venv and libpython3.12-minimal. The venv's
# bin/python3 -> /usr/bin/python3 then silently resolved to python3.14,
# so all four platform services crash-looped with
# "No module named uvicorn" (2000+ restarts) while state.json still
# looked perfectly healthy.
#
# The venv is now pinned to a uv-managed CPython 3.12.3 under
# /root/.local/share/uv/python/. That is NOT a dpkg package, so a future
# `uv cache clean` / `uv self update` / cache prune can take the
# interpreter away and reproduce the same silent breakage.
#
# Run by gemastik-venv-healthcheck.timer. Exits non-zero (and prints a
# remediation hint) if the interpreter or a core dependency is gone.
set -uo pipefail
VENV=/opt/gemastik18-final/receiver/.venv
PY="$VENV/bin/python"
SERVICES=(gemastik-receiver gemastik-panel gemastik-receiver-team1 gemastik-receiver-team2)
rc=0
fail() { echo "FAIL: $*" >&2; rc=1; }
# 1. interpreter must exist and still be 3.12.3 (pydantic 1.10.2 needs it)
if [[ ! -x "$PY" ]]; then
fail "venv interpreter missing: $PY"
else
ver="$("$PY" -c 'import sys;print("%d.%d.%d"%sys.version_info[:3])' 2>/dev/null)"
if [[ "$ver" != "3.12.3" ]]; then
fail "venv python is ${ver:-<none>}, expected 3.12.3 (pydantic 1.10.2 breaks on >=3.12.4)"
else
# 2. it must not have drifted onto a different base interpreter
base="$("$PY" -c 'import sys;print(sys.base_prefix)' 2>/dev/null)"
if [[ "$base" != /root/.local/share/uv/python/cpython-3.12.3-* ]]; then
fail "venv base_prefix drifted: ${base:-<none>}"
fi
fi
# 3. core deps must import (this is the check that actually caught the bug)
if ! env -u PYTHONPATH "$PY" -c \
'import uvicorn, fastapi, pydantic, requests, Crypto' 2>/tmp/venv_health.err; then
fail "core dependency import failed: $(tr '\n' ' ' </tmp/venv_health.err | tail -c 200)"
fi
fi
# 4. no service may be stuck restarting
for s in "${SERVICES[@]}"; do
n="$(systemctl show -p NRestarts --value "$s" 2>/dev/null || echo 0)"
if [[ "${n:-0}" -gt 5 ]]; then
fail "$s has restarted ${n} times — check 'journalctl -u $s -n 40'"
fi
done
# REMEDIATION (copy-paste):
# export PATH=/root/.local/bin:$PATH
# uv python install 3.12.3
# U=/root/.local/share/uv/python/cpython-3.12.3-linux-x86_64-gnu/bin
# V=/opt/gemastik18-final/receiver/.venv
# printf 'home = %s\ninclude-system-site-packages = false\nversion = 3.12.3\nexecutable = %s/python3.12\n' "$U" "$U" > "$V/pyvenv.cfg"
# ln -sfn "$U/python3.12" "$V/bin/python3.12"
# ln -sfn python3.12 "$V/bin/python3"
# ln -sfn python3 "$V/bin/python"
# systemctl restart gemastik-receiver gemastik-panel gemastik-receiver-team1 gemastik-receiver-team2
if (( rc == 0 )); then
echo "OK: venv healthy (python 3.12.3, deps import, services stable)"
fi
exit "$rc"
panel/compose_gen.py
+169
View File
@@ -0,0 +1,169 @@
#!/usr/bin/env python3
"""
compose_gen — render a team's docker-compose.yml from the challenge registry.
For every ENABLED challenge, a canonical per-challenge compose template lives
at services/<name>/docker-compose.yml (see gen_canonical_composes.py). The
renderer:
- replaces `build:` blocks with `image: services-<name>` for the MAIN
service (sidecars keep their images/builds),
- rewrites container_name / hostname to the per-team suffix,
- rewrites host ports (<ORG>:<INT>, <ORG+22>:22) to the team's ports,
- replaces PASSWORD_<ORG> placeholders with the team's challenge password,
- normalizes flag volume to ../receiver/flags/<name>.txt.
Multi-container challenges (gemas-notes, gemas-fetcher, kode-viewer,
anti-alchemy, tempest-poc) keep their sidecar services.
"""
import json
import re
import subprocess
from pathlib import Path
BASE = Path("/opt/gemastik18-final")
TEAMS_DIR = BASE / "teams"
SERVICES_SRC = BASE / "services"
# Challenges whose compose has multiple top-level services; the FIRST service
# listed is the MAIN challenge service (gets image: reuse + challenge ports),
# the rest are sidecars.
SIDECAR_NAMES = {
"anti-alchemy": ["anti-alchemy-db"],
"gemas-fetcher": ["mongodb"],
"gemas-notes": ["database", "validation-service"],
"kode-viewer": ["redis"],
"tempest-poc": ["backend"],
}
def _load_registry() -> dict:
try:
return json.loads((TEAMS_DIR / "challenge_registry.json").read_text())
except Exception:
return {"sets": {}, "challenges": []}
def read_template(name: str) -> str:
p = SERVICES_SRC / name / "docker-compose.yml"
if not p.exists():
raise FileNotFoundError(f"Tidak ada template compose untuk {name} di {p}")
return p.read_text()
def _image_exists(image_name: str) -> bool:
"""True if the docker image is already present locally.
The renderer only swaps a service's `build:` block for `image: services-<name>`
when that image actually exists. Otherwise compose would try to PULL a local
build artifact and fail with "pull access denied for services-<name>".
"""
r = subprocess.run(["docker", "image", "inspect", image_name],
capture_output=True, text=True, timeout=30)
return r.returncode == 0
def _parse_services(text: str):
names = []
for line in text.splitlines():
m = re.match(r"^ ([A-Za-z0-9_-]+):\s*$", line)
if m and not line.startswith(" "):
names.append(m.group(1))
return names
def render_team_compose(idx: int, state: dict) -> str:
ports = state["ports"]
passwords = state["chall_passwords"]
blocks = []
for ch in enabled_challenges():
name = ch["name"]
text = read_template(name)
main = _parse_services(text)
main = main[0] if main else name
sidecars = set(SIDECAR_NAMES.get(name, []))
org = int(ch.get("org_port", 10000))
tc = ports[name]["chall"]
ts = ports[name]["ssh"]
# --- rewrite container_name / hostname per team ---
out_lines = []
for line in text.splitlines():
s = line.strip()
if s.startswith("container_name:"):
cname = s.split(":", 1)[1].strip()
line = f" container_name: {cname}_team{idx}"
elif s.startswith("hostname:"):
hname = s.split(":", 1)[1].strip()
if hname == name:
line = f" hostname: {name}_team{idx}"
else:
# sidecar hostname also suffixed to keep per-team network unique
line = f" hostname: {hname}_team{idx}"
out_lines.append(line)
text = "\n".join(out_lines)
# --- ports: rewrite ONLY the main challenge service's ports ---
# The main service is the one whose ports map to org/org+22.
# (sidecar "ports_chall" cases: gemas-notes validation-service exposes
# 12000:80 — handled by rewriting ANY "<org>:" / "<org+22>:" occurrence.)
text = re.sub(rf'"({org}):', f'"{tc}:', text)
text = re.sub(rf'"({org + 22}):', f'"{ts}:', text)
# --- build: -> image for MAIN only (only when the image exists) ---
# Replace the main service's build block with image: services-<name> so
# teams share one image. If that image was never built, KEEP the build
# block so `docker compose up --build` builds it instead of trying to
# pull a nonexistent local image.
use_image = _image_exists(f"services-{name}")
lines = text.splitlines()
i = 0
in_main = False
cur = None
out = []
while i < len(lines):
line = lines[i]
m = re.match(r"^ ([A-Za-z0-9_-]+):\s*$", line)
if m and not line.startswith(" "):
cur = m.group(1)
in_main = (cur == main)
out.append(line)
i += 1
continue
# inside a service block
if in_main and use_image and line.strip() == "build:":
# skip build block (context/args/dockerfile...) until next key at same indent
out.append(f" image: services-{name}")
i += 1
while i < len(lines) and (lines[i].startswith(" ") or lines[i].strip() == ""):
i += 1
continue
out.append(line)
i += 1
text = "\n".join(out)
# --- PASSWORD placeholder -> team password ---
text = re.sub(r"\$PASSWORD_" + str(org) + r"\b", passwords[name], text)
text = re.sub(r"PASSWORD_" + str(org) + r"\b", passwords[name], text)
# --- build context -> per-team challenge subdir ---
# Canonical templates are written for the SHARED services/ tree where a
# challenge's files sit in services/<name>/. The per-team compose lives in
# teamN/services/, so a bare `context: .` would resolve to the team dir
# (no Dockerfile). Point the MAIN service's build at ./<name>.
if re.search(r"^ build:$", text, re.M):
text = re.sub(r"^ build:\n context: \.$",
f" build:\n context: ./{name}", text, count=1, flags=re.M)
# --- flag volume normalization ---
# Replace any ./flag.txt / ../receiver/flags/<name>.txt with the per-team flag mount
text = re.sub(r"\./flag\.txt(:\w+)?", f"../receiver/flags/{name}.txt", text)
blocks.append(text)
header = "version: '3.8'\nservices:\n"
body = []
for b in blocks:
if not b.strip():
continue
# strip a leading "services:" header from each block (they are fragments)
b = re.sub(r"^services:\n", "", b)
body.append(b)
return header + "\n".join(body) + "\n"
def enabled_challenges() -> list:
return [c for c in _load_registry().get("challenges", []) if c.get("enabled")]
panel/consolidate_images.sh
Executable
+54
View File
@@ -0,0 +1,54 @@
#!/usr/bin/env bash
# Remove per-team duplicate challenge images and repoint every team compose at
# the shared `services-<name>` image.
#
# Why: before services-<name> images existed, enabling a challenge made each of
# the 4 teams build its own copy (team1-x, team2-x, ...). A challenge image is
# identical for all teams — the SSH password is applied at container start via
# chpasswd, never baked in — so one shared build is enough. Those duplicates
# were consuming ~1.5 GB on a disk that only has ~3 GB free.
set -euo pipefail
ROOT=/opt/gemastik18-final
cd "$ROOT/panel"
python3 - <<'PY'
import json
from pathlib import Path
import sys
sys.path.insert(0, '.')
import teams as orch, compose_gen
for note in orch.reconcile_team_state():
print(note)
for d in sorted(orch.TEAMS_DIR.glob("team*")):
sf = d / "state.json"
if not sf.exists():
continue
st = json.loads(sf.read_text())
(d / "services" / "docker-compose.yml").write_text(
compose_gen.render_team_compose(st["index"], st))
print(f"team{st['index']}: compose re-rendered against shared images")
PY
echo "--- removing per-team images ---"
for img in $(docker images --format '{{.Repository}}' | grep -E '^team[0-9]+-' || true); do
# only safe to remove if no container is using it
if docker ps -a --format '{{.Image}}' | grep -q "^${img}$"; then
# containers reference the image by name; remove containers first
docker ps -a --filter "ancestor=${img}" --format '{{.Names}}' | while read -r c; do
[ -n "$c" ] && docker rm -f "$c" >/dev/null
done
fi
docker rmi "$img" >/dev/null 2>&1 && echo "removed $img" || true
done
echo "--- recreating containers from shared images ---"
for i in 1 2 3 4; do
cd "$ROOT/teams/team$i/services"
docker compose -p "team$i" up -d --remove-orphans >/dev/null 2>&1 &
done
wait
echo "done"
docker ps --format '{{.Names}}' | grep -c '_container_team' || true
df -h / | tail -1
panel/delete_teams.sh
+19
View File
@@ -0,0 +1,19 @@
#!/usr/bin/env bash
# Delete the teams named as args, one at a time, via the panel API.
# Each per-team delete runs `docker compose down` for every challenge, which
# takes minutes for a 16-challenge team — so never do this in a foreground
# call that has to finish inside one tool timeout.
# Usage: delete_teams.sh <idx> [idx...]
set -uo pipefail
BASE=http://127.0.0.1:18081
JAR=/tmp/ejc
U=$(grep -oP '^PANEL_ADMIN_USER=\K.*' /opt/gemastik18-final/panel/.env)
P=$(grep -oP '^PANEL_ADMIN_PASS=\K.*' /opt/gemastik18-final/panel/.env)
curl -sS -c "$JAR" -X POST -H 'Content-Type: application/json' \
-d "{\"user\":\"$U\",\"pass\":\"$P\"}" "${BASE}/api/login" >/dev/null
for i in "$@"; do
echo "=== $(date -Is) delete team${i} ==="
curl -sS -b "$JAR" -X DELETE -H 'Content-Type: application/json' \
-d '{"purge_scores":true}' "${BASE}/api/teams/${i}" -w '\nHTTP %{http_code}\n'
done
echo "=== done ==="
panel/exec_probe.sh
+19
View File
@@ -0,0 +1,19 @@
#!/usr/bin/env bash
# How many concurrent `docker exec` sessions does this host tolerate?
# The Phew SLA checker's 5-way concurrency test failed with
# "No such exec instance" + "failed to open stdin fifo", which points at an
# exec-session ceiling rather than at the checker.
set -uo pipefail
C=${1:-phew_container_team1}
N=${2:-8}
echo "container: $C"
echo "--- $N concurrent trivial execs ---"
fail=0
for i in $(seq 1 "$N"); do
( out=$(docker exec "$C" true 2>&1); rc=$?
if [ $rc -ne 0 ]; then echo " exec$i FAILED: $out"; fi ) &
done
wait
echo "--- done ---"
echo "dockerd max concurrent execs:"
docker info 2>/dev/null | grep -iE 'exec|containerd' | head -3
panel/exec_probe_i.py
+54
View File
@@ -0,0 +1,54 @@
#!/usr/bin/env python3
"""How many concurrent INTERACTIVE (`docker exec -i`) sessions does this host take?
Trivial non-interactive execs succeed 8-way, but the Phew SLA checker's 5-way
interactive test failed with
failed to open stdin fifo: error creating fifo ... -stdin: no such file
No such exec instance: <id>
which is a containerd exec-session limit, not a checker bug. Interactive execs
allocate a fifo + a tracked exec instance, so they hit a ceiling that plain
`docker exec <c> true` never approaches.
python3 panel/exec_probe_i.py [container] [N]
"""
import subprocess
import sys
import time
from concurrent.futures import ThreadPoolExecutor
CONT = sys.argv[1] if len(sys.argv) > 1 else "phew_container_team1"
N = int(sys.argv[2]) if len(sys.argv) > 2 else 8
def interactive(i: int) -> tuple[int, str]:
"""Mimic the checker: `exec -i`, write a line, read the reply, exit."""
p = subprocess.Popen(
["docker", "exec", "-i", CONT, "sh", "-c",
"echo $$; read line; echo \"got:$line\""],
stdin=subprocess.PIPE, stdout=subprocess.PIPE,
stderr=subprocess.STDOUT, text=True, bufsize=0)
try:
out, _ = p.communicate("hello\n", timeout=45)
except subprocess.TimeoutExpired:
p.kill()
out = "TIMEOUT"
return p.returncode, (out or "").strip().replace("\n", " | ")[:150]
def main() -> None:
print(f"container={CONT} N={N} interactive execs")
ok = 0
with ThreadPoolExecutor(max_workers=N) as ex:
for rc, out in ex.map(interactive, range(N)):
if rc == 0 and "got:hello" in out:
ok += 1
else:
print(f" FAIL rc={rc}: {out}")
print(f" {ok}/{N} interactive execs OK")
print("RESULT:", "PASS" if ok == N else f"limit reached at {ok}/{N}")
if __name__ == "__main__":
main()
panel/fix_apt_layers.py
+81
View File
@@ -0,0 +1,81 @@
#!/usr/bin/env python3
"""Merge a Dockerfile's split `apt-get update` + `apt-get install` into one RUN.
Why: several imported challenge Dockerfiles run
RUN apt-get -o Acquire::AllowInsecureRepositories=true update
RUN apt-get -y --allow-unauthenticated install -y ...
as two separate layers. The bundled apt-insecure.conf enables insecure/downgrade
repositories, and a second apt invocation in a later layer re-resolves against
whatever index the first one left behind — which on the EOL bullseye-security
mirror returns 404 for every package:
Err:1 http://deb.debian.org/debian-security bullseye-security/main amd64 libsystemd0
404 Not Found
Merging them into a single `update && install` layer (the pattern the working
gemastik18 challenges use) makes apt resolve once, from a fresh index.
Idempotent: a Dockerfile that already has the combined form is left untouched.
"""
import re
import sys
from pathlib import Path
SERVICES = Path("/opt/gemastik18-final/services")
UPDATE_RE = re.compile(
r"^RUN\s+apt-get\s+(?P<opts>(?:-o\s+\S+\s+)*)update\s*$"
)
INSTALL_RE = re.compile(r"^RUN\s+(?P<rest>apt-get\s+.*\binstall\b.*)$")
def fix(text: str) -> tuple[str, bool]:
lines = text.splitlines()
out: list[str] = []
i = 0
changed = False
while i < len(lines):
m = UPDATE_RE.match(lines[i])
if not m:
out.append(lines[i])
i += 1
continue
# look ahead: is the very next non-empty line an install?
j = i + 1
while j < len(lines) and not lines[j].strip():
j += 1
if j < len(lines):
mi = INSTALL_RE.match(lines[j])
if mi:
out.append(f"RUN apt-get {m.group('opts')}update && \\")
out.append(f" {mi.group('rest')}")
changed = True
i = j + 1
continue
out.append(lines[i])
i += 1
return "\n".join(out) + ("\n" if text.endswith("\n") else ""), changed
def main(argv):
names = argv[1:] or [p.name for p in sorted(SERVICES.iterdir())
if p.is_dir() and (p / "Dockerfile").exists()]
changed = []
for name in names:
p = SERVICES / name / "Dockerfile"
if not p.exists():
continue
text = p.read_text()
new, did = fix(text)
if did:
p.write_text(new)
changed.append(name)
print(f"{name}: merged apt update+install into one RUN")
print("rewritten:", ", ".join(changed) if changed else "(none)")
return 0
if __name__ == "__main__":
raise SystemExit(main(sys.argv))
panel/fix_checker_localhost.py
+51
View File
@@ -0,0 +1,51 @@
#!/usr/bin/env python3
"""Replace hardcoded `localhost` URLs in the imported XVI checkers with self.url().
Why: the imported checkers connect to `http://localhost:{self.port}`. The
receiver does run on the same host as the published team ports, so this happens
to work, but it is fragile (breaks the moment a receiver runs in a container or
the port is bound to a specific interface). Challenge.url() builds the URL from
self.host (default 127.0.0.1, overridable with RECEIVER_HOST) plus self.port.
Idempotent; rewrites only the f-string form, leaving class-level constants that
pin a *fixed* port (GemasNotes/Pasta/S3) alone — those are handled separately.
"""
import re
import sys
from pathlib import Path
BASE = Path("/opt/gemastik18-final/receiver/challenges/xvi")
# f"http://localhost:{self.port}/path/{expr}" -> self.url(f"/path/{expr}")
# The leading f is part of the literal being matched and must be consumed.
PAT = re.compile(
r"""f?(?P<q>["'])http://localhost:\{self\.port\}(?P<path>/[^"']*)?(?P=q)"""
)
def repl(m: "re.Match[str]") -> str:
path = m.group("path") or ""
if not path:
return "self.url()"
# the path may itself contain {expr} placeholders — keep them as an f-string
return f"self.url(f{path!r})"
def main() -> int:
changed = []
for p in sorted(BASE.glob("*.py")):
if p.name in ("Challenge.py", "config.py", "__init__.py"):
continue
src = p.read_text()
if "localhost:{self.port}" not in src:
continue
new = PAT.sub(repl, src)
if new != src:
p.write_text(new)
changed.append(p.name)
print("rewritten:", ", ".join(changed) if changed else "(none)")
return 0
if __name__ == "__main__":
raise SystemExit(main())
panel/fix_dup_volumes.py
+181
View File
@@ -0,0 +1,181 @@
#!/usr/bin/env python3
"""Collapse duplicate `volumes:` keys inside a single service, safely.
Why: the canonical per-challenge compose templates were produced by a generator
that appended a second `volumes:` list to services that already had one. YAML
forbids duplicate mapping keys, so `docker compose` rejected the file with
mapping key "volumes" already defined at line N
and every challenge using such a template failed to start.
This does a real YAML round-trip (ruamel if available, else PyYAML) so nesting
is never guessed: the second list's entries are appended to the first and the
duplicate key is dropped. Comments/order are preserved when ruamel is present.
"""
from __future__ import annotations
import sys
from pathlib import Path
SERVICES = Path("/opt/gemastik18-final/services")
try:
from ruamel.yaml import YAML
HAVE_RUAMEL = True
except ImportError:
HAVE_RUAMEL = False
import yaml
def fix_text(text: str) -> str:
if HAVE_RUAMEL:
y = YAML()
y.preserve_quotes = True
data = y.load(text)
changed = _merge_node(data)
if not changed:
return text
import io
buf = io.StringIO()
y.dump(data, buf)
return buf.getvalue()
# PyYAML fallback: last duplicate key wins, so re-read the raw text to
# collect ALL entries before handing it to the parser.
data = yaml.safe_load(text)
changed = _merge_node(data)
if not changed:
return text
return yaml.safe_dump(data, sort_keys=False, default_flow_style=False)
def _merge_node(data) -> bool:
"""Walk `services:` and merge any service that has >1 volumes entry.
ruamel keeps duplicates as a CommentedMap with repeated keys only when
round-tripped; after a safe load they collapse, so for the text form we
instead detect the duplicate at the line level (see fix_text_lines).
"""
if not isinstance(data, dict):
return False
changed = False
for svc in (data.get("services") or {}).values():
if isinstance(svc, dict) and isinstance(svc.get("volumes"), list):
continue
return changed
def fix_text_lines(text: str) -> str:
"""Line-based merge that preserves each service's own key ordering.
For every service block we find all `volumes:` keys at the service's key
indent and fold them into the first one, leaving every other key exactly
where it was.
"""
lines = text.splitlines()
out: list[str] = []
i = 0
n = len(lines)
# locate `services:` and its child key indent
svc_start = None
for idx, line in enumerate(lines):
if line.strip() == "services:" and not line.startswith(" "):
svc_start = idx
break
if svc_start is None:
return text
# child indent of the first service name
child_indent = None
for idx in range(svc_start + 1, n):
stripped = lines[idx]
if not stripped.strip():
continue
ind = len(stripped) - len(stripped.lstrip())
if ind == 0:
break
child_indent = ind
break
if child_indent is None:
return text
# service name boundaries
bounds: list[tuple[int, int]] = []
start = None
for idx in range(svc_start + 1, n):
line = lines[idx]
if not line.strip():
continue
ind = len(line) - len(line.lstrip())
if ind == child_indent and line.rstrip().endswith(":") and (start is None):
start = idx
elif ind == child_indent and line.rstrip().endswith(":"):
bounds.append((start, idx))
start = idx
elif ind == 0:
if start is not None:
bounds.append((start, idx))
start = None
break
if start is not None:
bounds.append((start, n))
result = list(lines)
for a, b in bounds:
block = result[a:b]
vol_idx = [k for k, l in enumerate(block)
if l.strip() == "volumes:" and (len(l) - len(l.lstrip())) == child_indent + 2]
if len(vol_idx) <= 1:
continue
first = vol_idx[0]
# `volumes:` sits at the service-key indent; its list items are
# indented two spaces further.
key_indent = " " * (child_indent + 2)
item_prefix = key_indent + " - "
entries: list[str] = []
drop: set[int] = set()
for vi in vol_idx:
drop.add(vi)
k = vi + 1
while k < len(block) and block[k].lstrip().startswith("- "):
entries.append(block[k])
drop.add(k)
k += 1
# also swallow a blank/comment tail belonging to this list
new_block = [ln for k, ln in enumerate(block) if k not in drop]
# Re-insert the merged list exactly where the FIRST volumes: key was.
# `first` is an index into the original block, so convert it to an
# index into the filtered block by counting how many dropped lines
# before it disappeared.
at = first - sum(1 for k in drop if k < first)
new_block[at:at] = [key_indent + "volumes:"] + entries
result[a:b] = new_block
return "\n".join(result) + ("\n" if text.endswith("\n") else "")
def main(argv):
names = argv[1:] or [p.name for p in sorted(SERVICES.iterdir())
if p.is_dir() and (p / "docker-compose.yml").exists()]
changed = []
for name in names:
p = SERVICES / name / "docker-compose.yml"
if not p.exists():
continue
text = p.read_text()
new = fix_text_lines(text)
if new != text:
# verify it now parses and that the volumes survived
try:
d = yaml.safe_load(new)
except Exception as e:
print(f"{name}: REFUSING invalid output ({e})")
continue
p.write_text(new)
changed.append(name)
print(f"{name}: merged duplicate volumes block(s)")
print("rewritten:", ", ".join(changed) if changed else "(none)")
return 0
if __name__ == "__main__":
raise SystemExit(main(sys.argv))
panel/fix_sidecars.sh
+33
View File
@@ -0,0 +1,33 @@
#!/usr/bin/env bash
# Bring up only the MISSING sidecars of each team (compose default `up -d`
# would also rebuild the 16 main services, which is slow and unnecessary).
set -uo pipefail
BASE=/opt/gemastik18-final
cd "$BASE/panel"
for t in 1 2 3 4; do
missing=$(python3 -c "
import sys; sys.path.insert(0,'.')
import teams
print(' '.join(teams.missing_sidecars($t)))
" 2>/dev/null)
if [ -z "$missing" ]; then
echo "team$t: nothing missing"
continue
fi
echo "team$t missing: $missing"
# map container name -> compose service name
for cont in $missing; do
svc=${cont#team${t}-}
svc=${svc%-1}
echo " starting $svc"
(cd "$BASE/teams/team$t/services" && \
docker compose -p "team$t" -f docker-compose.yml up -d --no-deps "$svc" 2>&1 | tail -2)
done
done
echo "=== verify ==="
python3 -c "
import sys; sys.path.insert(0,'.')
import teams
for i in (1,2,3,4):
print('team%d still missing:' % i, teams.missing_sidecars(i))
"
panel/gen_canonical_composes.py
+293
View File
@@ -0,0 +1,293 @@
#!/usr/bin/env python3
"""Generate canonical docker-compose.yml templates under services/<name>/ for
every challenge in the registry (gemastik18 + imported XVI/XVII).
The generated per-challenge file is the SOURCE for compose_gen — i.e. the
per-team compose is rendered from these templates. Uses:
services/<name>/docker-compose.yml (canonical, uniform)
If a template already exists for gemastik18 challenges (from the shared
compose), keep it. For imported challenges, build one from the registry.
"""
import json
import re
from pathlib import Path
BASE = Path("/opt/gemastik18-final")
SVC = BASE / "services"
TEAMS_DIR = BASE / "teams"
def load_registry():
return json.loads((TEAMS_DIR / "challenge_registry.json").read_text())
def internal_port_for(ch: dict) -> int:
"""Best-effort: the container's internal listening port."""
name = ch["name"]
known = {
# web-ish default 8000, others from upstream compose
"art": 8080, "xl": 3000, "gemas-notes": 80, "pasta": 8000,
"burvesigner": 80, "hirnfick": 8000, "gemas-fetcher": 8000,
"s3": 80, "crawlback": 80, "back-to-basic": 8000,
"anti-alchemy": 5000, "asmr": 8000, "bit-canvas": 8000,
"fjb": 80, "gift-card": 5000, "gift-voucher": 5000,
"gleam-drive": 8000, "go-green": 8000, "kode-viewer": 3000,
"more-less": 8000, "tempest-poc": 80, "ticketer": 5000,
}
return known.get(name, 8000)
def sidecar_for(ch: dict) -> dict:
"""Return {sidecar_name: {image, env, volumes, cmd...}} or {}."""
name = ch["name"]
if name == "gemas-notes":
return {
"database": {
"image": "mysql:8",
"container_name": None, # per-team
"environment": ["MYSQL_ROOT_PASSWORD=why_my_random_string_password_doesnot_working",
"MYSQL_DATABASE=gemasnotes"],
"volumes": ["./gemas-notes/src/db/init.sql:/docker-entrypoint-initdb.d/init.sql"],
},
"validation-service": {
"build": "./gemas-notes/src/validation-service",
"container_name": None,
"depends_on": ["database"],
"ports_chall": 80, # challenge port exposed here (REST API)
},
}
if name == "gemas-fetcher":
return {
"mongodb": {
"image": "mongo:4.4",
"container_name": None,
"environment": ["MONGO_INITDB_ROOT_USERNAME=ctf",
"MONGO_INITDB_ROOT_PASSWORD=asjdkjk23j1k3dsdn2h233j3jj",
"MONGO_INITDB_DATABASE=web_fetcher"],
}
}
if name == "kode-viewer":
return {
"redis": {
"image": "redis:alpine",
"container_name": None,
"volumes": ["./redis-data:/data"],
}
}
if name == "anti-alchemy":
return {
"anti-alchemy-db": {
"image": "postgres:16.3-alpine",
"container_name": None,
"environment": ["POSTGRES_USER=postgres", "POSTGRES_PASSWORD=password"],
"volumes": ["./db/dump.sql:/docker-entrypoint-initdb.d/init.sql"],
}
}
if name == "tempest-poc":
return {
"backend": {
"build": "./tempest-poc/backend",
"container_name": None,
"ports_ssh": 22,
"extra_hosts": True,
},
"frontend": {
"build": "./tempest-poc/frontend",
"container_name": None,
"ports_chall": 80,
"extra_hosts": True,
}
}
return {}
def render(ch: dict) -> str:
name = ch["name"]
org = int(ch.get("org_port", 10000))
internal = internal_port_for(ch)
sidecars = sidecar_for(ch)
# For tempest-poc the main (first) service is frontend; compose_gen's
# SIDECAR_NAMES marks backend as sidecar. Order matters: put frontend
# before backend in the generated file so compose_gen picks frontend as main.
if name == "tempest-poc":
sidecars = {"frontend": sidecars.pop("frontend"), **sidecars}
lines = ["services:"]
# main service
cont = f"{name}_container"
lines += [
f" {name}:",
f" container_name: {cont}",
f" hostname: {name}",
" restart: always",
" build:",
" context: .",
" args:",
f" - PASSWORD=$PASSWORD_{org}",
]
# volumes: flag + bashrc + preexec (uniform unless challenge differs)
flag_path = f"../receiver/flags/{name}.txt:/flag.txt:ro"
# gift-card/gift-voucher mount to /ctf/<name>/flag.txt
if name in ("gift-card", "gift-voucher"):
flag_path = f"../receiver/flags/{name}.txt:/ctf/{name}/flag.txt:ro"
if name == "pasta":
flag_path = f"../receiver/flags/{name}.txt:/ctf/pasta/flag.txt:ro"
lines += [
" volumes:",
f" - {flag_path}",
" - ../utils/bashrc:/root/.bashrc:ro",
" - ../utils/preexec.sh:/root/.preexec.sh:ro",
]
# ports: external (org / org+22) but rewritten per team by composer
if name == "gemas-notes":
# main service = note-service (Go, ssh only). The challenge port is
# exposed by validation-service (the REST API the checker hits).
pass
elif name == "tempest-poc":
# main (frontend) exposes chall port; backend (sidecar) has ssh.
pass
else:
lines += [
" ports:",
f" - \"{org}:{internal}\"",
f" - \"{org + 22}:22\"",
]
lines.append(" extra_hosts:")
lines.append(' - "host.docker.internal:host-gateway"')
# env (challenge-specific)
if name == "carbeat":
lines.append(" environment:")
lines.append(" - FLAG=GEMASTIK18{local_flag}")
if name == "phew":
lines.append(" environment:")
lines.append(" - FLAG=GEMASTIK18{local_flag}")
if name == "sheesh":
lines.append(" environment:")
lines.append(" - FLAG=GEMASTIK18{local_flag}")
if name == "anti-alchemy":
lines.append(" environment:")
lines.append(" - DB_NAME=postgres")
lines.append(" - DB_USER=postgres")
lines.append(" - DB_PASS=password")
lines.append(" - DB_HOST=anti-alchemy-db")
lines.append(" - DB_PORT=5432")
lines.append(f" - SECRET_KEY=$PASSWORD_{org}")
lines.append(" depends_on:")
lines.append(" - anti-alchemy-db")
if name == "gemas-fetcher":
lines.append(" environment:")
lines.append(" - MONGO_URI=mongodb://ctf:asjdkjk23j1k3dsdn2h233j3jj@mongodb:27017/web_fetcher?authSource=admin")
lines.append(f" - APP_URI=http://0.0.0.0:{org}")
lines.append(" depends_on:")
lines.append(" - mongodb")
if name == "kode-viewer":
lines.append(" environment:")
lines.append(" - REDIS_HOST=redis")
lines.append(" - REDIS_PORT=6379")
lines.append(" depends_on:")
lines.append(" - redis")
if name == "gemas-notes":
lines.append(" ports:")
lines.append(f" - \"{org + 22}:22\"")
lines.append(" depends_on:")
lines.append(" - database")
lines.append(" - validation-service")
# note: gemas-notes internal port differs (validation-service is the 8000 listener?)
# upstream maps validation-service:12000:80 and gemas-notes has no port except ssh.
# Our single main service is gemas-notes which exposes ssh on 22.
if name == "burvesigner":
lines.append(" volumes:")
lines.append(" - ../receiver/files/burvesigner.priv:/priv.data:ro")
# sidecars
for sname, sc in sidecars.items():
cont_s = f"{sname}_container"
lines.append(f" {sname}:")
if sc.get("build"):
lines += [" build:",
f" context: {sc['build']}",
f" dockerfile: Dockerfile"]
elif sc.get("image"):
lines.append(f" image: {sc['image']}")
if sc.get("container_name") is not None:
lines.append(f" container_name: {cont_s}")
if sc.get("environment"):
lines.append(" environment:")
for e in sc["environment"]:
lines.append(f" - {e}")
if sc.get("volumes"):
lines.append(" volumes:")
for v in sc["volumes"]:
lines.append(f" - {v}")
if sc.get("depends_on"):
lines.append(" depends_on:")
for dep in sc["depends_on"]:
lines.append(f" - {dep}")
if sc.get("ports_chall"):
lines.append(" ports:")
lines.append(f" - \"{org}:{sc['ports_chall']}\"")
if sc.get("ports_ssh"):
lines.append(" ports:")
lines.append(f" - \"{org + 22}:{sc['ports_ssh']}\"")
if sc.get("extra_hosts"):
lines.append(" extra_hosts:")
lines.append(' - "host.docker.internal:host-gateway"')
if sname == "frontend" and name == "tempest-poc":
# tempest frontend already handled via ports_chall
pass
elif sname == "frontend":
lines += [" ports:", f" - \"{org}:80\""]
lines.append(" extra_hosts:")
lines.append(' - "host.docker.internal:host-gateway"')
return "\n".join(lines) + "\n"
def main():
reg = load_registry()
for ch in reg["challenges"]:
name = ch["name"]
dst = SVC / name / "docker-compose.yml"
if name in ("blogpost", "carbeat", "cdn", "phew", "sheesh", "warmup"):
# keep existing split template (from shared compose)
tpl = SVC / name / "compose.template.yml"
if tpl.exists() and not dst.exists():
text = tpl.read_text()
lines = [l for l in text.splitlines() if l.strip() and not l.strip().startswith("#")]
out = []
for l in lines:
if l.strip().startswith("# ---") and out:
break
out.append(l)
dst.write_text("\n".join(out).rstrip() + "\n")
print(f"kept template: {name}")
continue
if name == "tempest-poc":
dst.write_text(render_tempest(ch))
print(f"wrote canonical compose (tempest): {name}")
continue
dst.write_text(render(ch))
print(f"wrote canonical compose: {name}")
def render_tempest(ch: dict) -> str:
"""tempest-poc: frontend (nginx) is the MAIN challenge service — it gets
the challenge container name + SSH + challenge port; backend is a sidecar
service that frontend proxies to (no host port needed)."""
name = ch["name"]
org = int(ch.get("org_port", 10000))
return f"""services:
{name}:
container_name: {name}_container
hostname: {name}
restart: always
build:
context: ./tempest-poc/frontend
dockerfile: Dockerfile
ports:
- "{org}:80"
- "{org + 22}:22"
extra_hosts:
- "host.docker.internal:host-gateway"
backend:
build:
context: ./tempest-poc/backend
dockerfile: Dockerfile
"""
if __name__ == "__main__":
main()
panel/gen_receiver_main.py
+306
View File
@@ -0,0 +1,306 @@
#!/usr/bin/env python3
"""Build the per-team receiver main.py from the challenge registry.
The receiver's `challenges` dict is generated from ENABLED registry entries so
the SLA checker pool exactly matches the distributed challenges. Imports come
from three packages:
- challenges.<Name> (gemastik18 native checkers)
- challenges.xvi.<Name> (GEMASTIK XVI checkers)
- challenges.xvii.checkers (GEMASTIK XVII generic checkers)
"""
from __future__ import annotations
import json
import shutil
from pathlib import Path
from teams import TEAMS_DIR, load_registry
def checker_class_for(ch: dict) -> str:
"""Return Python import path + class name for a registry challenge."""
name = ch["name"]
s = ch["set"]
# gemastik18 native challenges have their own checker class (capitalized)
if s == "gemastik18":
cls = {
"blogpost": "Blogpost",
"carbeat": "Carbeat",
"cdn": "CDN",
"phew": "Phew",
"sheesh": "Sheesh",
"warmup": "Warmup",
}.get(name)
if cls:
return f"from challenges.{cls} import {cls}", cls
raise KeyError(f"no native checker for {name}")
if s == "xvi":
cls = {
"art": "Art",
"xl": "XL",
"gemas-notes": "GemasNotes",
"pasta": "Pasta",
"burvesigner": "Burvesigner",
"hirnfick": "Hirnfick",
"gemas-fetcher": "GemasFetcher",
"s3": "S3",
"crawlback": "Crawlback",
"back-to-basic": "BackToBasic",
}.get(name)
if cls:
return f"from challenges.xvi.{cls} import {cls}", cls
raise KeyError(f"no xvi checker for {name}")
if s == "xvii":
cls = {
"anti-alchemy": "AntiAlchemy",
"asmr": "Asmr",
"bit-canvas": "BitCanvas",
"fjb": "Fjb",
"gift-card": "GiftCard",
"gift-voucher": "GiftVoucher",
"gleam-drive": "GleamDrive",
"go-green": "GoGreen",
"kode-viewer": "KodeViewer",
"more-less": "MoreLess",
"tempest-poc": "TempestPoc",
"ticketer": "Ticketer",
}.get(name)
if cls:
return f"from challenges.xvii.checkers import {cls}", cls
raise KeyError(f"no xvii checker for {name}")
raise KeyError(f"unknown set {s}")
def render_receiver_main(enabled: list[dict], port_defaults: dict) -> str:
imports = []
entries = []
for ch in enabled:
name = ch["name"]
imp, cls = checker_class_for(ch)
imports.append(imp)
default = port_defaults.get(name, 10000)
entries.append(f' "{name}": {cls}(_ch_port("{name}", {default})),')
return f"""from fastapi import Depends, FastAPI, HTTPException
from pydantic import BaseModel
from fastapi.security import HTTPBasic, HTTPBasicCredentials
from config import get_settings
{chr(10).join(imports)}
import os
import asyncio
import logging
# Setup logging
logging.basicConfig(level=logging.INFO)
logger = logging.getLogger(__name__)
app = FastAPI()
security = HTTPBasic()
settings = get_settings()
def _envkey(name: str) -> str:
# systemd Environment= keys can't contain hyphens; gen_receiver_services
# writes CHALLENGE_PORT_GIFT_CARD for the challenge "gift-card".
return name.upper().replace("-", "_")
def _ch_port(name: str, default: int) -> int:
# read from .env manually (pydantic settings has fixed fields)
key = _envkey(name)
val = os.environ.get(f"CHALLENGE_PORT_{{key}}")
if not val:
try:
with open(os.path.join(os.path.dirname(__file__), ".env")) as f:
for line in f:
if line.startswith(f"CHALLENGE_PORT_{{key}}="):
val = line.strip().split("=", 1)[1]
except Exception:
pass
return int(val) if val else default
def _ch_container(name: str, default: str) -> str:
key = _envkey(name)
val = os.environ.get(f"CHALLENGE_CONTAINER_{{key}}")
if not val:
try:
with open(os.path.join(os.path.dirname(__file__), ".env")) as f:
for line in f:
if line.startswith(f"CHALLENGE_CONTAINER_{{key}}="):
val = line.strip().split("=", 1)[1]
except Exception:
pass
return val or default
challenges = {{
{chr(10).join(entries)}
}}
async def run_challenge_checks():
\"\"\"Run check function on all challenges at startup\"\"\"
logger.info("\\n" + "="*60)
logger.info("Running challenge checks...")
logger.info("="*60 + "\\n")
results = {{}}
for name, challenge in challenges.items():
logger.info(f"\\n[{{name}}] Starting check...")
try:
# Give service time between checks
await asyncio.sleep(2)
result = challenge.check()
results[name] = result
if result:
logger.info(f"[{{name}}] ✓ Check PASSED")
else:
logger.warning(f"[{{name}}] ✗ Check FAILED")
except Exception as e:
logger.error(f"[{{name}}] ✗ Check ERROR: {{e}}")
results[name] = False
# Print summary
logger.info("\\n" + "="*60)
logger.info("Challenge Check Summary:")
logger.info("="*60)
passed = sum(1 for r in results.values() if r)
total = len(results)
for name, result in results.items():
status = "✓ PASS" if result else "✗ FAIL"
logger.info(f" {{name:20}} {{status}}")
logger.info(f"\\nTotal: {{passed}}/{{total}} passed")
logger.info("="*60 + "\\n")
return results
@app.on_event("startup")
async def startup_event():
\"\"\"Run challenge checks on application startup\"\"\"
asyncio.create_task(run_challenge_checks())
class Flag(BaseModel):
flag: str
challenge: str
class History(BaseModel):
log: str
@app.get("/")
def read_root():
return {{"service": "receiver-service"}}
@app.get("/restart/{{challenge}}")
def restart(challenge: str, credentials: HTTPBasicCredentials = Depends(security)):
validate(credentials, challenge)
os.system(f"docker compose -f {{settings.COMPOSE_LOCATION}} restart {{challenge}}")
return {{"message": "Challenge restarted"}}
@app.get("/rollback/{{challenge}}")
def rollback(challenge: str, credentials: HTTPBasicCredentials = Depends(security)):
validate(credentials, challenge)
os.system(f"docker compose -f {{settings.COMPOSE_LOCATION}} up -d --force-recreate {{challenge}}")
return {{"message": "Challenge restarted"}}
@app.get("/activate/{{challenge}}")
def activate(challenge: str, credentials: HTTPBasicCredentials = Depends(security)):
validate(credentials, challenge)
os.system(f"docker compose -f {{settings.COMPOSE_LOCATION}} up -d {{challenge}}")
return {{"message": "Challenge activated"}}
@app.get("/deactivate/{{challenge}}")
def deactive(challenge: str, credentials: HTTPBasicCredentials = Depends(security)):
validate(credentials, challenge)
os.system(f"docker compose -f {{settings.COMPOSE_LOCATION}} down {{challenge}}")
return {{"message": "Challenge deactivated"}}
@app.get("/credential/{{challenge}}")
def credential(challenge: str, credentials: HTTPBasicCredentials = Depends(security)):
validate(credentials, challenge)
return challenges[challenge].credentials()
@app.post("/flag")
def receive(data: Flag, credentials: HTTPBasicCredentials = Depends(security)):
validate(credentials, data.challenge)
challenge = challenges[data.challenge]
if challenge.distribute(data.flag):
return {{"message": "Flag received"}}
raise HTTPException(status_code=500, detail="Error receiving flag")
@app.get("/check/{{challenge}}")
def check(challenge: str, credentials: HTTPBasicCredentials = Depends(security)):
validate(credentials, challenge)
return {{"success": challenges[challenge].check()}}
@app.post("/history")
def history(data: History):
with open('history/command.txt', 'a') as f:
f.write(data.log + '\\n')
return {{"message": "Command received"}}
def is_admin(credentials):
if credentials.username != settings.ADMIN_USERNAME or credentials.password != settings.ADMIN_PASSWORD:
return False
return True
def validate(credentials, challenge):
if not is_admin(credentials):
raise HTTPException(status_code=401, detail="Invalid credentials")
if challenge not in challenges:
raise HTTPException(status_code=400, detail="Invalid challenge")
"""
def _sync_checker_packages(recv_dir) -> None:
"""Mirror the shared receiver's challenge checkers into a team receiver.
Two reasons this must run on every sync, not just at create_team time:
1. Teams created before the XVI/XVII import have no xvi/xvii subpackages,
so a regenerated main.py that imports them would crash-loop the receiver.
2. Native checkers (Blogpost/Phew/...) get bug fixes (e.g. mandatory
subprocess timeouts); a team copy made earlier keeps the stale version.
"""
shared_challenges = Path("/opt/gemastik18-final/receiver/challenges")
dst_root = recv_dir / "challenges"
dst_root.mkdir(parents=True, exist_ok=True)
for src_file in sorted(shared_challenges.glob("*.py")):
if src_file.name == "__init__.py":
continue
shutil.copy2(src_file, dst_root / src_file.name)
for pkg in ("xvi", "xvii"):
src = shared_challenges / pkg
if not src.exists():
continue
dst = dst_root / pkg
if dst.exists():
shutil.rmtree(dst)
shutil.copytree(src, dst, ignore=shutil.ignore_patterns("__pycache__", "*.pyc"))
def sync_team_receivers() -> None:
"""Regenerate main.py for every existing team from its state + registry."""
for d in sorted(TEAMS_DIR.glob("team*")):
sf = d / "state.json"
if not sf.exists():
continue
st = json.loads(sf.read_text())
idx = st["index"]
enabled = [c for c in load_registry()["challenges"] if c.get("enabled")]
_sync_checker_packages(d / "receiver")
text = render_receiver_main(enabled, {c["name"]: st["ports"][c["name"]]["chall"] for c in enabled})
(d / "receiver" / "main.py").write_text(text)
print(f"team{idx}: receiver main.py regenerated ({len(enabled)} challenges)")
if __name__ == "__main__":
sync_team_receivers()
panel/gen_receiver_services.py
+102
View File
@@ -0,0 +1,102 @@
#!/usr/bin/env python3
"""Generate + (re)start per-team receiver systemd services.
Each team receiver becomes gemastik-receiver-teamN.service, independent of
the panel service. This fixes the bug where restarting gemastik-panel killed
all team receivers (they were child processes of the panel systemd cgroup).
"""
import json
import os
import subprocess
import sys
from pathlib import Path
TEAMS_DIR = Path("/opt/gemastik18-final/teams")
RECEIVER_VENV = "/opt/gemastik18-final/receiver/.venv/bin/python"
UNIT_DIR = Path("/etc/systemd/system")
REGISTRY_PATH = TEAMS_DIR / "challenge_registry.json"
def load_registry() -> dict:
try:
return json.loads(REGISTRY_PATH.read_text())
except Exception:
return {"sets": {}, "challenges": []}
def write_unit(idx: int, st: dict):
port = st["ports"]["receiver"]
recv_dir = TEAMS_DIR / f"team{idx}" / "receiver"
env = {}
# ports/containers for challenge classes.
# NOTE: systemd Environment= keys must be [A-Za-z0-9_]+ — a hyphen in the
# challenge name (gift-card) would make systemd silently drop the line, so
# normalize the name to underscores here. main.py looks up the same key.
# Same normalization applies to CHALLENGE_SCHEME_<NAME>.
schemes = {c["name"]: c.get("scheme") for c in load_registry().get("challenges", [])}
# SSH login user per challenge. The panel already chpasswds the right
# account from this field (teams.challenge_ssh_users); the receiver must
# report the SAME user via /credential/<name> or participants get a login
# that cannot work. Registry is the single source of truth for both sides.
ssh_users = {c["name"]: c.get("ssh_user", "ctfuser")
for c in load_registry().get("challenges", [])}
for ch in st["ports"]:
if ch in ("receiver", "panel"):
continue
key = ch.upper().replace("-", "_")
env[f"CHALLENGE_PORT_{key}"] = str(st["ports"][ch]["chall"])
env[f"CHALLENGE_CONTAINER_{key}"] = f"{ch}_container_team{idx}"
if schemes.get(ch):
env[f"CHALLENGE_SCHEME_{key}"] = schemes[ch]
if ssh_users.get(ch):
env[f"SSH_USER_{st['ports'][ch]['chall']}"] = ssh_users[ch]
# SSH passwords: checker Challenge.credentials() reads PASSWORD_<self.port>
# where self.port is the team challenge port.
pwd = st.get("chall_passwords", {}).get(ch)
if pwd:
env[f"PASSWORD_{st['ports'][ch]['chall']}"] = pwd
env["COMPOSE_LOCATION"] = str(TEAMS_DIR / f"team{idx}" / "services" / "docker-compose.yml")
env_lines = "\n".join(f'Environment="{k}={v}"' for k, v in env.items())
unit = f"""[Unit]
Description=Gemastik A/D receiver for team {idx}
After=docker.service
Wants=docker.service
[Service]
Type=simple
WorkingDirectory={recv_dir}
EnvironmentFile={recv_dir}/.env
{env_lines}
ExecStart={RECEIVER_VENV} -m uvicorn main:app --host 0.0.0.0 --port {port}
Restart=always
RestartSec=3
[Install]
WantedBy=multi-user.target
"""
(UNIT_DIR / f"gemastik-receiver-team{idx}.service").write_text(unit)
def main():
action = sys.argv[1] if len(sys.argv) > 1 else "start"
# Regenerate receiver main.py for existing teams from the registry
try:
from gen_receiver_main import sync_team_receivers
sync_team_receivers()
except Exception as e:
print(f"WARN: receiver main.py regen failed: {e}")
for d in sorted(TEAMS_DIR.glob("team*")):
sf = d / "state.json"
if not sf.exists():
continue
st = json.loads(sf.read_text())
idx = st["index"]
write_unit(idx, st)
subprocess.run(["systemctl", "daemon-reload"], check=False)
subprocess.run(["systemctl", "enable", f"gemastik-receiver-team{idx}.service"], check=False)
if action == "stop":
subprocess.run(["systemctl", "stop", f"gemastik-receiver-team{idx}.service"], check=False)
else:
subprocess.run(["systemctl", "restart", f"gemastik-receiver-team{idx}.service"], check=False)
print(f"gemastik-receiver-team{idx}: {action} (port {st['ports']['receiver']})")
if __name__ == "__main__":
main()
panel/import_new_challenges.py
+120
View File
@@ -0,0 +1,120 @@
#!/usr/bin/env python3
"""One-time importer: copy XVI/XVII challenge sources into the platform
services/ tree, with EOL base-image fixes and a canonical docker-compose.yml
(per-challenge template) that the compose generator can render per team.
Run after cloning the upstream repos:
python3 import_new_challenges.py <xvi_dir> <xvii_dir>
For each imported challenge it writes services/<name>/:
- source files (Dockerfile, src, start.sh, requirements, db dumps...)
- docker-compose.yml (canonical template: single main service + sidecars)
- apt-insecure.conf (2026-clock GPG fix)
"""
import re
import shutil
import sys
from pathlib import Path
BASE = Path("/opt/gemastik18-final")
SVC = BASE / "services"
# ---------------------------------------------------------------- helpers
def copy_tree(src: Path, dst: Path, ignore=None):
if dst.exists():
shutil.rmtree(dst)
shutil.copytree(src, dst, ignore=ignore)
def add_apt_insecure(d: Path):
conf = "Acquire::AllowInsecureRepositories \"true\";\nAcquire::AllowDowngradeToInsecureRepositories \"true\";\nApt::Get::AllowUnauthenticated \"true\";\n"
(d / "apt-insecure.conf").write_text(conf)
def fix_base_image(d: Path, old: str, new: str):
"""Swap the FROM line in a Dockerfile (EOL base -> supported)."""
df = d / "Dockerfile"
if not df.exists():
return False
t = df.read_text()
if old in t:
df.write_text(t.replace(old, new, 1))
print(f" [fix base] {d.name}: {old} -> {new}")
return True
return False
DROP_FROM = [
(r"public\.ecr\.aws/docker/library/(python:3\.11-slim-buster|python:3\.11-slim-bullseye)\b", "python:3.11-slim-bookworm"),
(r"public\.ecr\.aws/docker/library/ruby:2\.7\.2\b", "ruby:3.2-slim-bookworm"),
(r"public\.ecr\.aws/docker/library/php:8\.0-apache\b", "php:8.2-apache-bookworm"),
(r"public\.ecr\.aws/docker/library/golang:bullseye\b", "golang:1.22-bookworm"),
(r"public\.ecr\.aws/docker/library/ubuntu:20\.04\b", "ubuntu:24.04"),
(r"public\.ecr\.aws/docker/library/ubuntu:22\.04\b", "ubuntu:24.04"),
(r"public\.ecr\.aws/docker/library/node(:[0-9]+)?\b", "node:20-slim-bookworm"),
(r"public\.ecr\.aws/docker/library/python:3\.10\.6\b", "python:3.10-slim-bookworm"),
]
def fix_dockerfile(d: Path):
df = d / "Dockerfile"
if not df.exists():
return
t = df.read_text()
for pat, new in DROP_FROM:
t2 = re.sub(pat, new, t)
if t2 != t:
print(f" [fix base] {d.name}: {pat} -> {new}")
t = t2
# apt-insecure for every apt-get run
if "apt-get" in t and "99gemastik-insecure" not in t:
t = t.replace(
"RUN apt-get update",
"COPY apt-insecure.conf /etc/apt/apt.conf.d/99gemastik-insecure\nRUN apt-get -o Acquire::AllowInsecureRepositories=true update",
1)
t = t.replace(
"RUN apt-get install",
"RUN apt-get -y --allow-unauthenticated install",
1)
# ensure openssh + ctfuser-ish (the standard template)
df.write_text(t)
# ---------------------------------------------------------------- import
def import_xvi(src: Path):
print(f"=== Importing XVI from {src} ===")
services = src / "services"
for d in sorted(services.iterdir()):
if not d.is_dir() or d.name == ".git":
continue
name = d.name
dst = SVC / name
print(f" - {name}")
copy_tree(d, dst, ignore=shutil.ignore_patterns("__pycache__", ".git"))
add_apt_insecure(dst)
fix_dockerfile(dst)
(dst / "docker-compose.yml").unlink(missing_ok=True)
# special: gemas-notes, gemas-fetcher need their src subdirs — already copied whole dir.
def import_xvii(src: Path):
print(f"=== Importing XVII from {src} ===")
for d in sorted(src.iterdir()):
if not d.is_dir() or d.name.startswith("."):
continue
name = d.name
dst = SVC / name
print(f" - {name}")
copy_tree(d, dst, ignore=shutil.ignore_patterns("__pycache__", ".git", "docker-compose.yml", "README.md", "test"))
add_apt_insecure(dst)
fix_dockerfile(dst)
(dst / "docker-compose.yml").unlink(missing_ok=True)
if name == "tempest-poc":
# compose is frontend+backend split; keep both Dockerfiles
for sub in ("backend", "frontend"):
subd = dst / sub
if subd.exists():
if (subd / "Dockerfile").exists():
fix_dockerfile(subd)
add_apt_insecure(subd)
if __name__ == "__main__":
xvi = Path(sys.argv[1]) if len(sys.argv) > 1 else Path("/opt/gemastik-xvi-final")
xvii = Path(sys.argv[2]) if len(sys.argv) > 2 else Path("/opt/gemastik-xvii-final")
import_xvi(xvi)
import_xvii(xvii)
print("Done. Next: write canonical docker-compose.yml templates per challenge.")
panel/inject_receiver_ssh_users.py
+76
View File
@@ -0,0 +1,76 @@
#!/usr/bin/env python3
"""Inject SSH_USER_<port> env into the GLOBAL receiver unit (gemastik-receiver).
Why: the panel's /api/credential proxy targets the global receiver on :18080,
not the per-team receivers. That unit had no Environment= lines at all, so
Challenge.credentials() fell back to the hardcoded 'ctfuser' literal and every
imported XVI/XVII challenge reported a login that could never work.
The registry's `ssh_user` per challenge is the single source of truth (the
panel already chpasswds that same account). Read the port each challenge runs
on from the global receiver's own config so the keys line up with self.port.
"""
import json
import re
import subprocess
import sys
from pathlib import Path
BASE = Path("/opt/gemastik18-final")
UNIT = Path("/etc/systemd/system/gemastik-receiver.service")
REGISTRY = BASE / "teams/challenge_registry.json"
RECV_CONFIG = BASE / "receiver/config.py"
reg = json.loads(REGISTRY.read_text())
ssh_users = {c["name"]: c.get("ssh_user", "ctfuser") for c in reg.get("challenges", [])}
# Challenge -> port used by the GLOBAL receiver. main.py builds the challenge
# objects from CHALLENGE_PORT_* / PASSWORD_* env; with none set it falls back to
# the pydantic settings PASSWORD_<port> in config.py, so mirror those ports.
text = RECV_CONFIG.read_text()
ports = {}
for m in re.finditer(r"PASSWORD_(\d+)\s*[:=]", text):
ports.setdefault(m.group(1), int(m.group(1)))
# name -> port needs the CHALLENGE_PORT mapping; take it from registry order +
# the receiver main.py template, else fall back to PASSWORD_<port> keys.
name_to_port = {}
for m in re.finditer(r'"PASSWORD_(\d+)"', text):
name_to_port.setdefault(m.group(1), m.group(1))
print(f"registry challenges: {len(ssh_users)}")
# Build Environment lines for every challenge whose port we can resolve.
env_lines = []
resolved = 0
for name, user in sorted(ssh_users.items()):
# The global receiver uses the node-range ports from config.py; find the
# port by matching the challenge name against the receiver's own mapping.
port = None
m = re.search(rf"{re.escape(name)}.*?(\d{{4,5}})", text)
if m:
port = m.group(1)
if not port:
continue
env_lines.append(f'Environment="SSH_USER_{port}={user}"')
resolved += 1
if not env_lines:
print("ERROR: could not resolve any challenge port from config.py", file=sys.stderr)
sys.exit(1)
body = UNIT.read_text()
# Drop any SSH_USER_ lines we previously injected (idempotent re-runs).
kept = [ln for ln in body.splitlines() if "SSH_USER_" not in ln]
# Insert right after the existing Environment=PYTHONUNBUFFERED line.
out = []
for ln in kept:
out.append(ln)
if ln.startswith("Environment=PYTHONUNBUFFERED"):
out.extend(env_lines)
if not any(ln.startswith("Environment=PYTHONUNBUFFERED") for ln in out):
out.extend(env_lines)
UNIT.write_text("\n".join(out) + "\n")
print(f"injected {resolved} SSH_USER_* lines into {UNIT}")
subprocess.run(["systemctl", "daemon-reload"], check=True)
subprocess.run(["systemctl", "restart", "gemastik-receiver"], check=True)
print("reloaded + restarted gemastik-receiver")
panel/inspect_team_footprint.sh
+15
View File
@@ -0,0 +1,15 @@
#!/usr/bin/env bash
# Inspect per-team port footprint: UFW rules in the 3xxxx/4xxxx range and
# docker volumes/networks named after a team. Read-only.
set -uo pipefail
echo "=== UFW rules matching 3xxxx/4xxxx ==="
ufw status numbered 2>/dev/null | grep -E '\b(3[0-9]{4}|4[0-9]{4})/tcp' || echo "(none)"
echo
echo "=== docker networks team* ==="
docker network ls --format '{{.Name}}' | grep -i team || echo "(none)"
echo
echo "=== docker volumes team* ==="
docker volume ls --format '{{.Name}}' | grep -i team || echo "(none)"
echo
echo "=== all volumes ==="
docker volume ls --format '{{.Name}}' | head -40
panel/main.py
+696 -29
View File
@@ -7,9 +7,13 @@ admin credentials stay out of the browser.
import os import os
import json import json
import time import time
import asyncio
import threading
import subprocess
import sys
import httpx import httpx
from pathlib import Path from pathlib import Path
from fastapi import FastAPI, Request, HTTPException from fastapi import FastAPI, Request, HTTPException, WebSocket, WebSocketDisconnect
from fastapi.responses import HTMLResponse, JSONResponse, RedirectResponse from fastapi.responses import HTMLResponse, JSONResponse, RedirectResponse
from fastapi.staticfiles import StaticFiles from fastapi.staticfiles import StaticFiles
from typing import Optional from typing import Optional
@@ -24,6 +28,27 @@ BASE_DIR = Path(__file__).parent
app = FastAPI(title="Gemastik A/D Panel") app = FastAPI(title="Gemastik A/D Panel")
# The panel used to serve every page as an inline HTMLResponse, so static/ was
# never mounted. The PixiJS topology needs real asset URLs: topo_pixi.js is an ES
# module and vendor/pixi.mjs is an 810 KB bundle — neither can be inlined.
# Mounted at the root so the module's own `import './vendor/pixi.mjs'` and
# `import('./topo_pixi.js')` resolve without rewriting paths.
app.mount("/static", StaticFiles(directory=str(BASE_DIR / "static")), name="static")
@app.on_event("startup")
async def _start_background():
"""Warm the SLA scoreboard cache in the background."""
import threading
threading.Thread(target=orch._build_scoreboard, daemon=True,
name="sla-warmup").start()
orch.start_sla_refresher()
# Toggle jobs: Docker builds take minutes, so PATCH /api/challenges runs the
# work on a background thread and the client polls /api/challenges/jobs/<id>.
_DELETE_JOBS = {}
_TOGGLE_JOBS: dict[str, dict] = {}
CHALLENGES = [ CHALLENGES = [
{"name": "blogpost", "port": 10000, "ssh": 10022, "category": "web", "desc": "Flask blog with exiftool + SSTI"}, {"name": "blogpost", "port": 10000, "ssh": 10022, "category": "web", "desc": "Flask blog with exiftool + SSTI"},
{"name": "carbeat", "port": 11000, "ssh": 11022, "category": "pwn", "desc": "Binary exploitation menu"}, {"name": "carbeat", "port": 11000, "ssh": 11022, "category": "pwn", "desc": "Binary exploitation menu"},
@@ -79,6 +104,17 @@ async def _proxy(method: str, path: str, body: dict = None):
@app.get("/", response_class=HTMLResponse) @app.get("/", response_class=HTMLResponse)
async def index(req: Request): async def index(req: Request):
host = (req.headers.get("host") or "").split(":")[0]
# Team portal domains: <slug>.attackdefense.imrnes.team -> their team portal (no admin login)
if host.endswith(".attackdefense.imrnes.team") and host != "attackdefense.imrnes.team" and host != "panel.attackdefense.imrnes.team":
slug = host.split(".")[0]
for t in orch.list_teams():
if t.get("slug") == slug:
html = (BASE_DIR / "static" / "team.html").read_text()
html = html.replace('name="team-id" content="0"', f'name="team-id" content="{t["index"]}"')
html = html.replace('href="/team/0/guide"', f'href="/team/{t["index"]}/guide"')
return HTMLResponse(html)
return HTMLResponse("<h2 style='font-family:sans-serif;color:#888;padding:40px'>Team tidak ditemukan: " + slug + "</h2>", status_code=404)
if not _authorized(req): if not _authorized(req):
return RedirectResponse("/login") return RedirectResponse("/login")
html = (BASE_DIR / "static" / "index.html").read_text() html = (BASE_DIR / "static" / "index.html").read_text()
@@ -96,24 +132,170 @@ async def submit_page(req: Request):
return HTMLResponse((BASE_DIR / "static" / "submit.html").read_text()) return HTMLResponse((BASE_DIR / "static" / "submit.html").read_text())
# ============ Per-team portal (public via <slug>.gemastik.imrnes.team) ============ # ============ Per-team portal (public via <slug>.attackdefense.imrnes.team) ============
@app.get("/team/{idx}", response_class=HTMLResponse) @app.get("/team/{idx}", response_class=HTMLResponse)
async def team_portal(idx: int, req: Request): async def team_portal(idx: int, req: Request):
"""Public portal page for a team (served at <slug>.gemastik.imrnes.team/team/<idx>).""" """Public portal page for a team. Must be accessed via that team's own domain."""
html = (BASE_DIR / "static" / "team.html").read_text()
html = html.replace('name="team-id" content="0"', f'name="team-id" content="{idx}"')
return HTMLResponse(html)
@app.get("/api/team/{idx}/info")
async def api_team_info(idx: int):
"""Public: basic team info for the portal (no secrets besides per-team SSH creds)."""
td = orch.TEAMS_DIR / f"team{idx}" td = orch.TEAMS_DIR / f"team{idx}"
if not (td / "state.json").exists(): if not (td / "state.json").exists():
raise HTTPException(404, "Team not found") raise HTTPException(404, "Team not found")
st = json.loads((td / "state.json").read_text()) st = json.loads((td / "state.json").read_text())
# expose only what a team needs: label, domain, ports, ssh creds, status if not _check_team_host(req, st):
raise HTTPException(403, "Akses team lain tidak diizinkan")
if _team_authorized(req, idx): # logged in -> show portal directly
html = (BASE_DIR / "static" / "team.html").read_text()
html = html.replace('name="team-id" content="0"', f'name="team-id" content="{idx}"')
# server-side: fix guide link so non-JS / pre-JS clicks never hit /team/0
html = html.replace('href="/team/0/guide"', f'href="/team/{idx}/guide"')
return HTMLResponse(html)
# not logged in -> show a stripped landing/login page (no admin info)
html = (BASE_DIR / "static" / "team.html").read_text()
html = html.replace('name="team-id" content="0"', f'name="team-id" content="{idx}"')
html = html.replace('href="/team/0/guide"', f'href="/team/{idx}/guide"')
return HTMLResponse(html)
@app.get("/team/{idx}/guide", response_class=HTMLResponse)
async def team_guide(idx: int, req: Request):
"""Public SSH/attack guide for a team. Must be accessed via that team's own domain."""
td = orch.TEAMS_DIR / f"team{idx}"
if not (td / "state.json").exists():
raise HTTPException(404, "Team not found")
st = json.loads((td / "state.json").read_text())
if not _check_team_host(req, st):
raise HTTPException(403, "Akses team lain tidak diizinkan")
html = (BASE_DIR / "static" / "guide.html").read_text()
html = html.replace('name="team-id" content="0"', f'name="team-id" content="{idx}"')
return HTMLResponse(html)
# ---- Team portal login (separate from admin; password = team ssh_pass) ----
_team_sessions: dict[str, tuple[int, float]] = {} # token -> (idx, expiry)
@app.post("/api/team/{idx}/login")
async def api_team_login(idx: int, req: Request):
td = orch.TEAMS_DIR / f"team{idx}"
if not (td / "state.json").exists():
raise HTTPException(404, "Team not found")
st = json.loads((td / "state.json").read_text())
if not _check_team_host(req, st):
raise HTTPException(403, "Akses team lain tidak diizinkan")
data = await req.json()
pw = data.get("pass", "")
if pw != st.get("ssh_pass"):
raise HTTPException(401, "Password salah")
token = os.urandom(16).hex()
_team_sessions[token] = (idx, time.time() + 12 * 3600)
resp = JSONResponse({"ok": True, "team": idx})
resp.set_cookie("team_token", token, httponly=True, samesite="lax", max_age=12 * 3600)
return resp
@app.post("/api/team/logout")
async def api_team_logout(req: Request):
token = req.cookies.get("team_token")
if token:
_team_sessions.pop(token, None)
return {"ok": True}
def _team_authorized(req: Request, idx: int) -> bool:
token = req.cookies.get("team_token")
if not token:
return False
e = _team_sessions.get(token)
if not e or e[0] != idx or e[1] < time.time():
_team_sessions.pop(token, None)
return False
return True
def _check_team_host(req: Request, st: dict) -> bool:
"""IDOR guard: host must be this team's own domain (or localhost).
panel.gemastik / attackdefense.imrnes.team only allowed with a valid ADMIN session."""
host = (req.headers.get("host") or "").split(":")[0]
if host == st.get("domain"):
return True
if host.startswith("127.0.0.1") or host.startswith("localhost"):
return True
if host in ("panel.attackdefense.imrnes.team", "attackdefense.imrnes.team"):
return _authorized(req) # admin preview only
return False
@app.get("/api/team/{idx}/session")
async def api_team_session(idx: int, req: Request):
"""True when this browser has a valid team session for idx."""
return {"authed": _team_authorized(req, idx)}
@app.get("/api/team/{idx}/own-challenges")
async def api_team_own_challenges(idx: int, req: Request):
"""The challenges THIS team runs, each with the SSH login it provisions.
The terminal's challenge picker used to be a hardcoded list of only the 6
native GEMASTIK XVIII entries, so the 10 imported XVI/XVII challenges could
not be selected at all. Names + per-challenge ssh_user only -- no passwords.
"""
td = orch.TEAMS_DIR / f"team{idx}"
if not (td / "state.json").exists():
raise HTTPException(404, "Team not found")
st = json.loads((td / "state.json").read_text())
if not _check_team_host(req, st):
raise HTTPException(403, "Akses team lain tidak diizinkan")
if not _team_authorized(req, idx):
raise HTTPException(401, "Login portal team dulu")
users = orch.challenge_ssh_users()
out = []
for name, _coff, _soff in orch.CHALLENGES:
p = st.get("ports", {}).get(name)
if not p:
continue
out.append({"name": name, "ssh_user": users.get(name, "ctfuser"),
"port": p.get("chall"), "ssh_port": p.get("ssh")})
return {"challenges": out}
@app.get("/api/team/{idx}/targets")
async def api_team_targets(idx: int, req: Request):
"""Team targets — requires team login + own host. Only domain + port."""
td = orch.TEAMS_DIR / f"team{idx}"
if not (td / "state.json").exists():
raise HTTPException(404, "Team not found")
st_self = json.loads((td / "state.json").read_text())
if not _check_team_host(req, st_self):
raise HTTPException(403, "Akses team lain tidak diizinkan")
if not _team_authorized(req, idx):
raise HTTPException(401, "Login portal team dulu")
out = []
ssh_users = orch.challenge_ssh_users()
for d in sorted(orch.TEAMS_DIR.glob("team*")):
if not (d / "state.json").exists():
continue
st = json.loads((d / "state.json").read_text())
if st.get("index") == idx:
continue # skip self
for name, coff, soff in orch.CHALLENGES:
p = st["ports"].get(name)
if not p:
continue
out.append({
"team_idx": st.get("index"),
"team_label": st.get("label", f"Team {st.get('index')}"),
"challenge": name,
"domain": st.get("domain") or (st.get("slug", f"team{st.get('index')}") + ".attackdefense.imrnes.team"),
"port": p["chall"],
# attackers need the same login the victim container provisions;
# it is per-challenge, so surface it instead of assuming ctfuser
"ssh_user": ssh_users.get(name, "ctfuser"),
})
return {"targets": out}
@app.get("/api/team/{idx}/info")
async def api_team_info(idx: int, req: Request):
"""Team portal info — requires team login + own host; no admin secrets."""
td = orch.TEAMS_DIR / f"team{idx}"
if not (td / "state.json").exists():
raise HTTPException(404, "Team not found")
st = json.loads((td / "state.json").read_text())
if not _check_team_host(req, st):
raise HTTPException(403, "Akses team lain tidak diizinkan")
if not _team_authorized(req, idx):
raise HTTPException(401, "Login portal team dulu")
return {"team": { return {"team": {
"index": st.get("index"), "index": st.get("index"),
"label": st.get("label"), "label": st.get("label"),
@@ -122,17 +304,19 @@ async def api_team_info(idx: int):
"status": st.get("status"), "status": st.get("status"),
"ports": st.get("ports"), "ports": st.get("ports"),
"ssh_user": st.get("ssh_user"), "ssh_user": st.get("ssh_user"),
"ssh_pass": st.get("ssh_pass"), "ssh_pass": st.get("ssh_pass"), # same password used to login portal + SSH
}} }}
@app.get("/api/team/{idx}/status") @app.get("/api/team/{idx}/status")
async def api_team_status(idx: int): async def api_team_status(idx: int, req: Request):
"""Public: SLA status for a team's challenges (no auth — read-only health).""" """SLA status for a team's challenges (read-only health, own-host only)."""
td = orch.TEAMS_DIR / f"team{idx}" td = orch.TEAMS_DIR / f"team{idx}"
if not (td / "state.json").exists(): if not (td / "state.json").exists():
raise HTTPException(404, "Team not found") raise HTTPException(404, "Team not found")
st = json.loads ((td / "state.json").read_text()) st = json.loads ((td / "state.json").read_text())
if not _check_team_host(req, st):
raise HTTPException(403, "Akses team lain tidak diizinkan")
recv_port = st["ports"]["receiver"] recv_port = st["ports"]["receiver"]
# use team's receiver admin creds (server-side only; never sent to browser) # use team's receiver admin creds (server-side only; never sent to browser)
au, ap = st.get("admin_user", ""), st.get("admin_pass", "") au, ap = st.get("admin_user", ""), st.get("admin_pass", "")
@@ -147,7 +331,50 @@ async def api_team_status(idx: int):
ok = False ok = False
results.append({"name": name, "port": st["ports"][name]["chall"], results.append({"name": name, "port": st["ports"][name]["chall"],
"ssh": st["ports"][name]["ssh"], "alive": ok}) "ssh": st["ports"][name]["ssh"], "alive": ok})
return {"results": results} # award SLA bonus when all services are UP (throttled, see add_sla_bonus)
alive = sum(1 for r in results if r["alive"])
bonus = orch.add_sla_bonus(idx, alive, len(results))
return {"results": results, "sla": {"alive": alive, "total": len(results),
"pct": round(100 * alive / max(len(results), 1), 1),
"points": orch.get_team_points(idx),
"rank": orch.team_rank(idx), "badge": orch.team_badge(idx),
"bonus": bonus}}
@app.get("/api/team/{idx}/activity")
async def api_team_activity(idx: int, req: Request):
"""Team-scoped activity feed: attack events where this team is attacker or
target (i.e. "ada serangan ke service kita" / "kita menyerang"), plus a
snapshot of own service health. Requires team login + own host."""
td = orch.TEAMS_DIR / f"team{idx}"
if not (td / "state.json").exists():
raise HTTPException(404, "Team not found")
st_self = json.loads((td / "state.json").read_text())
if not _check_team_host(req, st_self):
raise HTTPException(403, "Akses team lain tidak diizinkan")
if not _team_authorized(req, idx):
raise HTTPException(401, "Login portal team dulu")
# live label lookup (rename team = activity updates everywhere)
def label(i):
try:
s = json.loads((orch.TEAMS_DIR / f"team{i}" / "state.json").read_text())
return s.get("label") or f"Team {i}"
except Exception:
return f"Team {i}"
ap = orch.TEAMS_DIR / "attacks.json"
try:
events = json.loads(ap.read_text()).get("events", []) if ap.exists() else []
except Exception:
events = []
mine = []
for e in reversed(events): # newest first
if e.get("attacker") == idx or e.get("target") == idx:
e = dict(e)
e["attacker_label"] = label(e.get("attacker"))
e["target_label"] = label(e.get("target"))
mine.append(e)
return {"events": mine[:100], "team_label": st_self.get("label") or f"Team {idx}"}
@app.post("/api/login") @app.post("/api/login")
async def api_login(req: Request): async def api_login(req: Request):
@@ -176,7 +403,78 @@ def require_login(req: Request):
@app.get("/api/challenges") @app.get("/api/challenges")
async def api_challenges(req: Request): async def api_challenges(req: Request):
require_login(req) require_login(req)
return {"challenges": CHALLENGES} # Full registry (all sets) with enabled status, plus count of live teams
reg = orch.load_registry()
challs = []
for c in reg.get("challenges", []):
challs.append({
"name": c["name"],
"set": c.get("set"),
"category": c.get("category"),
"desc": c.get("desc"),
"enabled": bool(c.get("enabled")),
"chall_offset": c.get("chall_offset"),
"ssh_offset": c.get("ssh_offset"),
"org_port": c.get("org_port"),
"service_dir": c.get("service_dir"),
})
return {"challenges": challs, "hint": "PATCH /api/challenges/<name> with {\"enabled\": bool} to toggle"}
@app.patch("/api/challenges/{challenge}")
async def api_challenge_toggle(challenge: str, req: Request):
require_login(req)
data = await req.json()
enabled = bool(data.get("enabled"))
reg = orch.load_registry()
found = any(c.get("name") == challenge for c in reg.get("challenges", []))
if not found:
raise HTTPException(404, "Unknown challenge")
changed = orch.set_challenge_enabled(challenge, enabled)
# The registry is the source of truth, but a team's state.json must also
# carry ports/password/flag for the new challenge before the compose can be
# rendered. reconcile_team_state() fills in anything missing.
try:
orch.reconcile_team_state()
except Exception as e:
raise HTTPException(500, f"Rekonsiliasi state tim gagal: {e}")
# apply to live teams (build/up or stop/remove + receiver restart);
# skip rebuild when the flag didn't actually change
if "unchanged" in changed:
return {"ok": True, "name": challenge, "enabled": enabled, "applied": [], "unchanged": True}
# Applying a challenge means a Docker build per team, which takes minutes.
# Run it in the background so the admin UI stays responsive, and let the
# client poll /api/challenges/jobs/<job_id> for the per-team report.
job_id = f"{challenge}-{'on' if enabled else 'off'}-{int(time.time())}"
_TOGGLE_JOBS[job_id] = {
"job": job_id, "name": challenge, "enabled": enabled,
"state": "running", "applied": [], "detail": "queued",
"started": int(time.time()),
}
def _worker():
try:
report = orch.sync_challenge_runtime(challenge, enabled)
_TOGGLE_JOBS[job_id].update(
state="done", applied=report.get("teams", []), detail="complete")
except Exception as e: # surfaced to the client via the job record
_TOGGLE_JOBS[job_id].update(state="error", detail=str(e))
finally:
_TOGGLE_JOBS[job_id]["finished"] = int(time.time())
threading.Thread(target=_worker, name=f"toggle-{job_id}", daemon=True).start()
return {"ok": True, "name": challenge, "enabled": enabled,
"job": job_id, "state": "running"}
@app.get("/api/challenges/jobs/{job_id}")
async def api_challenge_job(job_id: str, req: Request):
"""Poll the result of an async challenge toggle started by PATCH above."""
require_login(req)
job = _TOGGLE_JOBS.get(job_id)
if not job:
raise HTTPException(404, "Unknown job")
return job
@app.get("/api/status") @app.get("/api/status")
async def api_status(req: Request): async def api_status(req: Request):
@@ -237,8 +535,26 @@ async def api_deactivate(challenge: str, req: Request):
return {"receiver_status": resp.status_code, "receiver_body": resp.text} return {"receiver_status": resp.status_code, "receiver_body": resp.text}
@app.get("/api/credential/{challenge}") @app.get("/api/credential/{challenge}")
async def api_credential(challenge: str, req: Request): async def api_credential(challenge: str, req: Request, team: int = None):
require_login(req) require_login(req)
# The global receiver on :18080 only knows the 6 native GEMASTIK XVIII
# challenges, so proxying everything there returns "Invalid challenge" for the
# 10 imported XVI/XVII ones -- participants saw no SSH creds at all. A team's
# state.json is the authority for BOTH the password and the SSH login user
# (the same `ssh_user` the panel chpasswds), plus the team-specific port.
# `?team=N` selects the team; team portal hosts imply their own index.
idx = team
if idx is None:
host = (req.headers.get("host") or "").split(":")[0]
for t in orch.all_teams():
dom = (t.get("domain") or "").split(":")[0]
if dom and dom == host:
idx = t.get("index")
break
if idx is not None:
cred = orch.challenge_credential(idx, challenge)
if cred:
return cred
resp = await _proxy("GET", f"/credential/{challenge}") resp = await _proxy("GET", f"/credential/{challenge}")
if resp.status_code == 200: if resp.status_code == 200:
return resp.json() return resp.json()
@@ -262,22 +578,191 @@ async def api_teams(req: Request):
@app.post("/api/teams/set") @app.post("/api/teams/set")
async def api_teams_set(req: Request): async def api_teams_set(req: Request):
"""Set/create N teams (idempotent: creates missing, keeps existing).""" """Set/create N teams (idempotent: creates missing, keeps existing).
body: {count, labels: {"1": "Tim Satu"}, domains: {"1": "tim-satu"}}"""
require_login(req) require_login(req)
data = await req.json() data = await req.json()
n = int(data.get("count", 0)) n = int(data.get("count", 0))
if n < 0 or n > 50: if n < 0 or n > 50:
raise HTTPException(400, "Team count must be 0-50") raise HTTPException(400, "Team count must be 0-50")
labels = data.get("labels") or {} # { "1": "Tim Satu", ... } labels = data.get("labels") or {} # { "1": "Tim Satu", ... }
domains = data.get("domains") or {} # { "1": "mycustom", ... }
created = [] created = []
ufw = []
for i in range(1, n + 1): for i in range(1, n + 1):
td = orch.TEAMS_DIR / f"team{i}" td = orch.TEAMS_DIR / f"team{i}"
if not td.exists(): if not td.exists():
label = labels.get(str(i)) or labels.get(i) or f"Tim {i}" label = labels.get(str(i)) or labels.get(i) or f"Tim {i}"
st = orch.create_team(i, label) dom = domains.get(str(i)) or domains.get(i) or None
st = orch.create_team(i, label, domain=dom)
created.append(st["index"]) created.append(st["index"])
# UFW defaults to deny(incoming) on this host: without these rules
# the team's challenge/SSH/receiver ports are silently blackholed.
ufw.append(orch.sync_team_ufw(i))
else:
# team exists: apply any label/domain overrides
label = labels.get(str(i)) or labels.get(i)
dom = domains.get(str(i)) or domains.get(i)
if label or dom:
orch.update_team(i, label=label, domain=dom)
orch.ensure_team_domains() orch.ensure_team_domains()
return {"created": created, "total": len(orch.list_teams())} return {"created": created, "total": len(orch.list_teams()), "ufw": ufw}
@app.put("/api/teams/{idx}")
async def api_team_update(idx: int, req: Request):
"""Update a team's custom name and/or domain (applies live)."""
require_login(req)
if not (orch.TEAMS_DIR / f"team{idx}" / "state.json").exists():
raise HTTPException(404, "Team not found")
data = await req.json()
try:
st = orch.update_team(idx, label=data.get("label"), domain=data.get("domain"))
return {"ok": True, "team": st}
except FileNotFoundError as e:
raise HTTPException(404, str(e))
@app.delete("/api/teams/{idx}")
async def api_team_delete(idx: int, req: Request):
"""Permanently delete ONE team: containers, network, receiver unit, ports,
directory, score records and its Traefik domain.
Body: {"purge_scores": true} (default) — set false to keep the team's
leaderboard/points history. Destructive and irreversible, so the UI gates
it behind a confirm dialog.
"""
require_login(req)
raw = {}
try:
raw = await req.json()
except Exception:
pass # DELETE with no body is fine
if not (orch.TEAMS_DIR / f"team{idx}" / "state.json").exists():
raise HTTPException(404, f"Team {idx} not found")
try:
# compose down for 16 services takes a while — keep the event loop free
result = await asyncio.to_thread(orch.delete_team, idx,
bool(raw.get("purge_scores", True)))
# refresh the remaining teams' generated artifacts (receiver main.py,
# systemd units) so nothing points at the deleted team
subprocess.run([sys.executable, str(orch.BASE / "panel" / "gen_receiver_services.py"), "start"],
check=False, capture_output=True)
return result
except FileNotFoundError as e:
raise HTTPException(404, str(e))
except Exception as e:
raise HTTPException(500, str(e))
@app.post("/api/teams/bulk-delete")
async def api_teams_bulk_delete(req: Request):
"""Delete SEVERAL teams in one background job.
Body: {"indices": [5, 6], "purge_scores": true}
Why a job and not a loop of DELETE /api/teams/{idx}: a single team takes
~100 s (compose down of 16 services), so deleting four teams inline would
hold the request open for ~7 minutes and trip every proxy/browser timeout
in front of the panel. Each team is therefore deleted sequentially inside
ONE background thread, and the client polls a single job id.
Teams are processed one at a time on purpose. delete_team() runs
`docker compose -p teamN down` and regenerates shared artifacts
(receiver main.py, systemd units) afterwards, so running several in
parallel would race on those shared files.
A team that fails does NOT abort the rest: the job records the error and
moves on, because the point of a bulk delete is to clear stale teams and
one broken compose shouldn't strand the others.
"""
require_login(req)
data = await req.json()
raw = data.get("indices") or data.get("indices[]") or []
try:
indices = sorted({int(i) for i in raw})
except (TypeError, ValueError):
raise HTTPException(400, "indices must be a list of team numbers")
if not indices:
raise HTTPException(400, "No team selected")
if len(indices) > 20:
raise HTTPException(400, "Refusing to delete more than 20 teams at once")
purge = bool(data.get("purge_scores", True))
existing = [i for i in indices
if (orch.TEAMS_DIR / f"team{i}" / "state.json").exists()]
skipped = [i for i in indices if i not in existing]
if not existing:
raise HTTPException(404, "None of the selected teams exist")
job_id = f"bulkdel-{int(time.time())}-{len(existing)}"
_DELETE_JOBS[job_id] = {
"job": job_id, "indices": existing, "skipped": skipped,
"state": "running", "done": [], "errors": {},
"detail": "queued", "started": int(time.time()),
}
def _worker():
job = _DELETE_JOBS[job_id]
try:
for n, i in enumerate(existing, 1):
job["detail"] = f"menghapus team {i} ({n}/{len(existing)})"
try:
# delete_team is blocking (subprocess + shutil), and this
# runs in a plain thread, so call it directly.
res = orch.delete_team(i, purge)
job["done"].append({
"team": i,
"label": res.get("label", f"Team {i}"),
"steps": res.get("steps", []),
"purged": res.get("purged", {}),
})
except Exception as e:
job["errors"][str(i)] = str(e)
# regenerate shared artifacts once at the end, so the remaining
# teams' receiver main.py / systemd units stop referencing deleted ones
subprocess.run(
[sys.executable, str(orch.BASE / "panel" / "gen_receiver_services.py"), "start"],
check=False, capture_output=True)
job["state"] = "done" if not job["errors"] else "partial"
job["detail"] = "complete" if not job["errors"] else "completed with errors"
except Exception as e:
job["state"] = "error"
job["detail"] = str(e)
finally:
job["finished"] = int(time.time())
threading.Thread(target=_worker, name=f"bulkdel-{job_id}", daemon=True).start()
return {"ok": True, "job": job_id, "state": "running",
"indices": existing, "skipped": skipped}
@app.get("/api/teams/bulk-delete/{job_id}")
async def api_teams_bulk_delete_job(job_id: str, req: Request):
"""Poll a bulk team delete started by POST /api/teams/bulk-delete."""
require_login(req)
job = _DELETE_JOBS.get(job_id)
if not job:
raise HTTPException(404, "Unknown job")
return job
@app.post("/api/teams/{idx}/ufw")
async def api_team_ufw(idx: int, req: Request):
"""Reconcile UFW rules for a team's port block.
UFW defaults to deny(incoming) on this host, so a team whose ports were
never opened is blackholed. Use this after creating a team out-of-band, or
to close the ports of a team you just deleted by hand.
Body: {"remove": true} deletes the rules instead.
"""
require_login(req)
raw = {}
try:
raw = await req.json()
except Exception:
pass
return await asyncio.to_thread(orch.sync_team_ufw, idx, bool(raw.get("remove", False)))
@app.post("/api/teams/start") @app.post("/api/teams/start")
async def api_teams_start(req: Request): async def api_teams_start(req: Request):
@@ -345,7 +830,7 @@ async def api_topology(req: Request):
require_login(req) require_login(req)
teams = orch.list_teams() teams = orch.list_teams()
nodes = [ nodes = [
{"id": "panel", "label": "Panel A/D", "type": "panel", "url": "https://panel.gemastik.imrnes.team"}, {"id": "panel", "label": "Panel A/D", "type": "panel", "url": "https://panel.attackdefense.imrnes.team"},
{"id": "traefik", "label": "Traefik / Coolify", "type": "infra"}, {"id": "traefik", "label": "Traefik / Coolify", "type": "infra"},
{"id": "dns", "label": "*.imrnes.team → 43.134.105.109", "type": "infra"}, {"id": "dns", "label": "*.imrnes.team → 43.134.105.109", "type": "infra"},
] ]
@@ -379,11 +864,26 @@ async def api_randomize(idx: int, req: Request):
raise HTTPException(500, str(e)) raise HTTPException(500, str(e))
@app.post("/api/reset/scores")
async def api_reset_scores(req: Request):
"""Admin: wipe leaderboard (all solves)."""
require_login(req)
return orch.reset_scores()
@app.post("/api/reset/environment")
async def api_reset_environment(req: Request):
"""Admin: full environment reset (stop all, remove teams/containers/receivers)."""
require_login(req)
return orch.reset_environment()
@app.post("/api/flag/submit") @app.post("/api/flag/submit")
async def api_flag_submit(req: Request): async def api_flag_submit(req: Request):
"""Public endpoint: teams submit flags. No login needed.""" """Public endpoint: teams submit flags. No login needed.
body: {team: attacker, target?: victim, challenge, flag}"""
data = await req.json() data = await req.json()
team = int(data.get("team", 0)) team = int(data.get("team", 0)) # attacker (tim yang submit)
target = int(data.get("target") or 0) or team # victim team (flag dicuri dari sini)
chall = data.get("challenge", "") chall = data.get("challenge", "")
flag = data.get("flag", "").strip() flag = data.get("flag", "").strip()
team_name = data.get("team_name", "").strip()[:64] or f"Team {team}" team_name = data.get("team_name", "").strip()[:64] or f"Team {team}"
@@ -393,27 +893,194 @@ async def api_flag_submit(req: Request):
return {"success": False, "error": "Challenge not found"} return {"success": False, "error": "Challenge not found"}
if not flag: if not flag:
return {"success": False, "error": "Flag is required"} return {"success": False, "error": "Flag is required"}
return orch.submit_flag(team, chall, flag, team_name) return orch.submit_flag(target, chall, flag, attacker_idx=team, attacker_name=team_name)
@app.get("/api/attacks")
async def api_attacks(req: Request):
"""Admin: recent attack events (attacker -> target) for the topology visualizer."""
require_login(req)
ap = orch.TEAMS_DIR / "attacks.json"
if ap.exists():
log = json.loads(ap.read_text())
else:
log = {"events": []}
return {"events": log.get("events", [])}
@app.get("/api/leaderboard") @app.get("/api/leaderboard")
async def api_leaderboard(req: Request): async def api_leaderboard(req: Request):
"""Leaderboard of solves so far.""" """Leaderboard of solves so far. Team names resolved LIVE from state.json
so renaming a team updates leaderboard + topology everywhere."""
lb_path = orch.TEAMS_DIR / "leaderboard.json" lb_path = orch.TEAMS_DIR / "leaderboard.json"
if lb_path.exists(): if lb_path.exists():
lb = json.loads(lb_path.read_text()) lb = json.loads(lb_path.read_text())
else: else:
lb = {"solves": []} lb = {"solves": []}
# live name lookup: state.json label fallback to snapshot
def team_name(idx):
try:
st = json.loads((orch.TEAMS_DIR / f"team{idx}" / "state.json").read_text())
return st.get("label") or f"Team {idx}"
except Exception:
return f"Team {idx}"
# aggregate per team # aggregate per team
teams = {} teams = {}
for e in lb["solves"]: for e in lb["solves"]:
t = teams.setdefault(e["team"], {"team": e["team"], "name": e["team_name"], "solves": 0, "challs": []}) name = team_name(e["team"])
t = teams.setdefault(e["team"], {"team": e["team"], "name": name, "solves": 0, "challs": [], "points": 0})
t["name"] = name
t["solves"] += 1 t["solves"] += 1
t["challs"].append(e["challenge"]) t["challs"].append(e["challenge"])
return {"solves": lb["solves"], "teams": sorted(teams.values(), key=lambda x: -x["solves"])} # attach live points from points.json
for tid, t in teams.items():
t["points"] = orch.get_team_points(tid)
return {"solves": lb["solves"], "teams": sorted(teams.values(), key=lambda x: (-x["points"], -x["solves"]))}
@app.get("/api/scoreboard")
async def api_scoreboard(req: Request):
"""Admin + team: full scoreboard with points, SLA, rank, badges."""
require_login(req)
return orch.sla_status_all()
@app.get("/api/public/scoreboard")
async def api_public_scoreboard():
"""Public scoreboard (no login) — used by the team portal status tab."""
d = orch.sla_status_all()
# strip receiver creds / ports internals for the public view
for t in d["teams"]:
t.pop("domain", None)
return d
@app.get("/api/public/teams") @app.get("/api/public/teams")
async def api_public_teams(): async def api_public_teams():
"""Public list of team names (for the submit dropdown).""" """Public list of team names (for the submit dropdown)."""
return {"teams": [{"index": t["index"], "label": t.get("label", f"Team {t['index']}")} for t in orch.list_teams()]} return {"teams": [{"index": t["index"], "label": t.get("label", f"Team {t['index']}")} for t in orch.list_teams()]}
@app.get("/api/targets")
async def api_admin_targets(req: Request):
"""Admin: matrix of every team's service domain:port (public targets)."""
require_login(req)
out = []
for d in sorted(orch.TEAMS_DIR.glob("team*")):
if not (d / "state.json").exists():
continue
st = json.loads((d / "state.json").read_text())
dom = st.get("domain") or (st.get("slug", f"team{st.get('index')}") + ".attackdefense.imrnes.team")
for name, coff, soff in orch.CHALLENGES:
p = st["ports"].get(name)
if not p:
continue
out.append({
"team": st.get("index"),
"team_label": st.get("label", f"Team {st.get('index')}"),
"challenge": name,
"domain": dom,
"port": p["chall"],
})
return {"targets": out}
# ============ WebSocket SSH terminal (team portal) ============
import paramiko
import websockets
@app.websocket("/api/team/{idx}/ssh/ws")
async def team_ssh_ws(ws: WebSocket, idx: int):
chall = ws.query_params.get("chall", "")
# auth: team session cookie must match this team
token = ws.cookies.get("team_token")
e = _team_sessions.get(token or "")
if not e or e[0] != idx or e[1] < time.time():
await ws.close(code=4001, reason="unauthorized")
return
td = orch.TEAMS_DIR / f"team{idx}"
st = json.loads((td / "state.json").read_text())
# host check (IDOR): only this team's domain can open its SSH
host = (ws.headers.get("host") or "").split(":")[0]
if not (host == st.get("domain") or host.startswith("127.0.0.1") or host.startswith("localhost")):
await ws.close(code=4003, reason="wrong host")
return
if chall not in st.get("ports", {}):
await ws.close(code=4002, reason="unknown challenge")
return
recv_port = st["ports"][chall]["ssh"]
# The SSH login is PER-CHALLENGE, not per-team. Only the 6 native GEMASTIK
# XVIII images provision `ctfuser`; every imported XVI/XVII image does
# `RUN echo root:${PASSWORD} | chpasswd`. Reading st["ssh_user"] (a single
# team-wide value, default ctfuser) made the web terminal log in as ctfuser
# for all 16 challenges, so 10 of them always failed with "Permission denied".
# challenge_ssh_users() reads the registry -- the same field set_ssh_passwords()
# chpasswds -- so the login and the password can never drift apart.
user = orch.challenge_ssh_users().get(chall) or st.get("ssh_user", "ctfuser")
# each challenge container has its own password (chall_passwords);
# ssh_pass is the portal login password (may differ).
pw = st.get("chall_passwords", {}).get(chall) or st.get("ssh_pass", "")
await ws.accept()
chan = client = None
try:
client = paramiko.SSHClient()
client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
loop = asyncio.get_event_loop()
await loop.run_in_executor(
None, lambda: client.connect("127.0.0.1", port=recv_port, username=user,
password=pw, timeout=10, allow_agent=False,
look_for_keys=False))
chan = client.invoke_shell(term="xterm-256color", width=120, height=32)
async def ws_to_ssh():
while True:
try:
msg = await ws.receive_text()
except Exception:
break
if msg.startswith("__resize__"):
try:
_, cols, rows = msg.split(":", 2)
chan.resize_pty(int(cols), int(rows))
except Exception:
pass
else:
try:
chan.send(msg)
except Exception:
break
async def ssh_to_ws():
# non-blocking poll: chan.recv() di dalam async task akan
# memblokir seluruh event loop (deadlock) — jadi poll recv_ready.
while True:
try:
if chan.recv_ready():
data = chan.recv(4096)
if not data:
break
await ws.send_text(data.decode("utf-8", "replace"))
elif chan.closed:
break
except Exception:
break
await asyncio.sleep(0.03)
t1 = asyncio.create_task(ws_to_ssh())
t2 = asyncio.create_task(ssh_to_ws())
done, pending = await asyncio.wait({t1, t2}, return_when=asyncio.FIRST_COMPLETED)
for t in pending:
t.cancel()
except Exception as e:
try:
await ws.send_text(f"\r\n[ssh error] {e}\r\n")
except Exception:
pass
finally:
try:
if chan: chan.close()
except Exception: pass
try:
if client: client.close()
except Exception: pass
try:
await ws.close()
except Exception: pass
panel/phew_chall_ref.py
Executable
+68
View File
@@ -0,0 +1,68 @@
#!/usr/bin/env python3
import os
from Pailier import *
from Crypto.Util.number import *
with open("/flag.txt", "rb") as f:
flag_bytes = f.read()
key = os.urandom(66)
key_int = bytes_to_long(key)
cipher = pailier()
while True:
print("1. encrypt")
print("2. bingo")
print("3. decrypt")
print("4. key?")
try:
inp = int(input("> "))
except (ValueError, EOFError):
print("Invalid input")
continue
if inp == 1:
print("pt (hex)")
try:
inp = input("> ")
ct = cipher.encrypt(int(inp, 16))
print('ct : ', '{0:x}'.format(ct))
except (ValueError, EOFError):
print("Invalid hex input")
elif inp == 2:
print("key (hex)")
try:
user_hex = input("> ").strip()
user_key = bytes.fromhex(user_hex)
if len(user_key) == 66 and user_key == key:
try:
print(flag_bytes.decode())
except Exception:
print(flag_bytes.hex())
else:
print("nope")
except (ValueError, EOFError):
print("nope")
elif inp == 3:
print("ct (hex)")
try:
inp = input("> ")
pt = cipher.decrypt(int(inp, 16))
print('pt : ', '{0:x}'.format(pt))
except (ValueError, EOFError):
print("Invalid hex input")
elif inp == 4:
try:
ct = cipher.encrypt(key_int)
print('ct : ', '{0:x}'.format(ct))
except Exception:
print("Encryption error")
else:
exit()
panel/phew_concurrency_test.sh
+35
View File
@@ -0,0 +1,35 @@
#!/usr/bin/env bash
# Concurrency regression test for the Phew checker.
#
# The bug this guards against: the checker reaped chall.py processes it did not
# own, so two overlapping checks killed each other's session and the victim
# reported "Process ended while waiting for '> '" on a healthy service. Firing
# several checks at once is the only way to reproduce it — sequential runs pass
# even with the bug present.
set -uo pipefail
BASE=/opt/gemastik18-final
TEAM=${1:-1}
N=${2:-5}
case "$TEAM" in 1) PORT=31080;; 2) PORT=32080;; 3) PORT=33080;; 4) PORT=34080;; esac
U=$(grep -oP '^ADMIN_USERNAME=\K.*' "$BASE/teams/team$TEAM/receiver/.env")
P=$(grep -oP '^ADMIN_PASSWORD=\K.*' "$BASE/teams/team$TEAM/receiver/.env")
count() { docker exec "phew_container_team$TEAM" sh -c 'ps ax | grep -c "[c]hall.py"'; }
echo "before: $(count) chall.py (1 = socat service only)"
pids=()
for i in $(seq 1 "$N"); do
( out=$(timeout 300 curl -sS -u "$U:$P" "http://127.0.0.1:$PORT/check/phew")
echo " req$i: $out" ) &
pids+=($!)
done
for p in "${pids[@]}"; do wait "$p"; done
sleep 5
after=$(count)
echo "after: $after chall.py"
if [ "$after" -le 1 ]; then
echo "RESULT: PASS (no leak)"
else
echo "RESULT: FAIL (leaked $((after - 1)))"
fi
panel/phew_trace.py
+95
View File
@@ -0,0 +1,95 @@
#!/usr/bin/env python3
"""Replay the Phew checker's exact interaction, timing every step.
Purpose: find WHICH read exceeds its budget. The receiver log only says
"Timeout waiting for '> '. Got so far: <empty>", which cannot distinguish a
slow keygen from a hang. This prints per-step wall time and the buffer state
at the moment of the timeout.
"""
import os
import select
import subprocess
import sys
import time
CONT = os.environ.get("PHEW_CONT", "phew_container_team1")
CMD = ["docker", "exec", "-i", "-e", "PYTHONUNBUFFERED=1", CONT,
"python3", "/home/ctfuser/chall/src/chall.py"]
def read_until(proc, needle, timeout):
"""Mirror of the checker's _read_until, but reporting the buffer."""
buf = ""
end = time.time() + timeout
raw = proc.stdout.buffer if hasattr(proc.stdout, "buffer") else proc.stdout
while needle not in buf:
left = end - time.time()
if left <= 0:
raise TimeoutError(f"timeout after {timeout}s, buffer={buf!r}")
r, _, _ = select.select([raw], [], [], min(left, 1.0))
if not r:
continue
chunk = raw.read1(4096) if hasattr(raw, "read1") else raw.read(4096)
if not chunk:
raise TimeoutError(f"EOF, buffer={buf!r}")
buf += chunk.decode(errors="replace")
return buf
def step(label, fn):
t0 = time.time()
try:
out = fn()
print(f" {label:<34} {time.time()-t0:6.2f}s ok")
return out
except TimeoutError as e:
print(f" {label:<34} {time.time()-t0:6.2f}s TIMEOUT {e}")
raise
def main():
proc = subprocess.Popen(CMD, stdin=subprocess.PIPE, stdout=subprocess.PIPE,
stderr=subprocess.STDOUT, text=True, bufsize=0)
try:
print(f"container={CONT}")
step("boot -> first menu (budget 45s)", lambda: read_until(proc, "> ", 45))
for name, send, budget in (("encrypt", "1", 30), ("decrypt", "3", 30),
("key?", "4", 30)):
proc.stdin.write(send + "\n")
proc.stdin.flush()
step(f"send '{send}' -> prompt (budget 30s)",
lambda: read_until(proc, "> ", 30))
if name == "encrypt":
step(" send plaintext -> prompt",
lambda: read_until(proc, "> ", 30)) if False else None
proc.stdin.write("414243\n")
proc.stdin.flush()
step(" send plaintext -> prompt",
lambda: read_until(proc, "> ", 30))
elif name == "key?":
proc.stdin.write("\n")
proc.stdin.flush()
step(" send blank -> prompt",
lambda: read_until(proc, "> ", 30))
else:
proc.stdin.write("0\n")
proc.stdin.flush()
step(" send ct -> prompt",
lambda: read_until(proc, "> ", 30))
print("ALL STEPS WITHIN BUDGET")
except TimeoutError:
print("=> a step needs a bigger budget (or a different prompt)")
raise SystemExit(1)
finally:
try:
subprocess.run(["docker", "exec", CONT, "pkill", "-f", "chall.py"],
capture_output=True, timeout=20)
except Exception:
pass
if proc.poll() is None:
proc.kill()
if __name__ == "__main__":
main()
panel/prebuild_images.py
+88
View File
@@ -0,0 +1,88 @@
#!/usr/bin/env python3
"""Pre-build every challenge's shared image (`services-<name>`) in parallel.
The admin toggle only reuses `image: services-<name>` when that image already
exists locally; otherwise it keeps `build:` and each of the 4 teams rebuilds it
separately (team1-x, team2-x, ...), which wastes minutes and gigabytes. Since a
challenge's image content is identical for every team (the SSH password is
applied at runtime via chpasswd, not baked into the image), one shared build
suffices.
Runs up to --jobs builds at a time and prints a per-challenge PASS/FAIL summary.
"""
from __future__ import annotations
import argparse
import json
import subprocess
import sys
import time
from concurrent.futures import ThreadPoolExecutor
from pathlib import Path
SERVICES = Path("/opt/gemastik18-final/services")
REGISTRY = Path("/opt/gemastik18-final/teams/challenge_registry.json")
def image_exists(name: str) -> bool:
r = subprocess.run(["docker", "image", "inspect", f"services-{name}"],
capture_output=True)
return r.returncode == 0
def build(name: str, force: bool) -> tuple[str, bool, str]:
if not force and image_exists(name):
return name, True, "already built"
d = SERVICES / name
if not (d / "Dockerfile").exists():
return name, False, "no Dockerfile (multi-service challenge)"
t0 = time.time()
# Several challenge Dockerfiles do `echo root:${PASSWORD} | chpasswd`, so an
# empty build-arg makes the RUN step fail. Pass a throwaway value: the real
# per-team password is applied at container start via chpasswd, never baked
# into the image, so this value never matters.
r = subprocess.run(
["docker", "build", "-t", f"services-{name}",
"--build-arg", "PASSWORD=prebuild-placeholder", "."],
cwd=d, capture_output=True, text=True,
)
if r.returncode == 0:
return name, True, f"built in {time.time()-t0:.0f}s"
tail = [l for l in r.stderr.splitlines() if l.strip()][-1:] or ["unknown error"]
return name, False, tail[0][:160]
def main() -> int:
ap = argparse.ArgumentParser()
ap.add_argument("names", nargs="*", help="challenge names (default: all in registry)")
ap.add_argument("--jobs", type=int, default=4)
ap.add_argument("--force", action="store_true", help="rebuild even if present")
args = ap.parse_args()
if args.names:
names = args.names
else:
reg = json.loads(REGISTRY.read_text())
names = [c["name"] for c in reg["challenges"]]
print(f"building {len(names)} challenge images with {args.jobs} parallel jobs\n", flush=True)
t0 = time.time()
results: list[tuple[str, bool, str]] = []
with ThreadPoolExecutor(max_workers=args.jobs) as ex:
for res in ex.map(lambda n: build(n, args.force), names):
results.append(res)
mark = "PASS" if res[1] else "FAIL"
print(f"[{mark}] {res[0]:16s} {res[2]}", flush=True)
ok = [r for r in results if r[1]]
bad = [r for r in results if not r[1]]
print(f"\n{len(ok)}/{len(results)} images ready in {(time.time()-t0)/60:.1f} min")
if bad:
print("\nfailures:")
for n, _, why in bad:
print(f" {n}: {why}")
return 1 if bad else 0
if __name__ == "__main__":
raise SystemExit(main())
panel/prune_disabled.sh
+48
View File
@@ -0,0 +1,48 @@
#!/usr/bin/env bash
# Remove containers + images for challenges that are no longer enabled.
#
# Why: the platform can host 28 challenges but the images are large (1.2 GB for
# pasta alone) and the host disk is 79 GB. Keeping every image resident filled
# it to 98% and started failing builds. Disabled challenges keep their source in
# services/ and can be re-enabled at any time — only the runtime artifacts go.
set -uo pipefail
cd /opt/gemastik18-final/panel
ENABLED=$(python3 - <<'PY'
import sys
sys.path.insert(0, '.')
import teams
print(" ".join(c["name"] for c in teams.enabled_challenges()))
PY
)
echo "enabled: $ENABLED"
echo "--- stopping containers of disabled challenges ---"
for name in $(docker ps -a --format '{{.Names}}' | grep '_container_team' || true); do
base=${name%%_container_team*}
keep=0
for e in $ENABLED; do
[ "$base" = "$e" ] && keep=1
done
[ "$keep" = "0" ] && docker rm -f "$name" >/dev/null 2>&1 && echo "removed container $name"
done
echo "--- removing images of disabled challenges ---"
for img in $(docker images --format '{{.Repository}}' | grep -E '^(services-|team[0-9]+-)' || true); do
base=${img#services-}
base=${base#team[0-9]-}
# only challenge-shaped names (services-blogpost, team2-art, ...)
case "$base" in
blogpost|carbeat|cdn|phew|sheesh|warmup|art|xl|pasta|gemas-fetcher|s3|crawlback|back-to-basic|anti-alchemy|asmr|bit-canvas|fjb|gift-card|gift-voucher|gleam-drive|go-green|kode-viewer|more-less|ticketer|hirnfick|burvesigner|back-to-basic|gemas-notes|tempest-poc) ;;
*) continue ;;
esac
keep=0
for e in $ENABLED; do
[ "$base" = "$e" ] && keep=1
done
[ "$keep" = "0" ] && docker rmi "$img" >/dev/null 2>&1 && echo "removed image $img"
done
echo "--- done ---"
docker images --format '{{.Repository}}' | grep -c '^services-' || true
df -h / | tail -1
panel/reset_runtime.sh
+69
View File
@@ -0,0 +1,69 @@
#!/usr/bin/env bash
# FULL reset of the runtime — keeps ONLY the shared challenge images.
#
# Removes: every team container, every team docker network, every anonymous/
# named volume, every per-team receiver systemd unit, and all team directories
# (state, flags, credentials, compose). KEEPS: services-* images (the
# challenges themselves), the panel, the global receiver, the challenge sources
# in services/, and the registry.
#
# This is the "purge everything except the challenges" path the organiser asked
# for after passwords drifted: fresh containers get fresh /etc/shadow state, so
# no stale credential can survive.
set -uo pipefail
BASE=/opt/gemastik18-final
TEAMS=$BASE/teams
echo "=== [1/6] stop per-team receivers + remove units ==="
for u in $(systemctl list-unit-files 'gemastik-receiver-team*.service' 2>/dev/null \
| awk '/gemastik-receiver-team/{print $1}'); do
systemctl disable --now "$u" >/dev/null 2>&1
rm -f "/etc/systemd/system/$u"
echo " removed $u"
done
systemctl daemon-reload
echo "=== [2/6] compose down for every team (before deleting dirs) ==="
for d in "$TEAMS"/team*/services; do
[ -d "$d" ] || continue
idx=$(basename "$(dirname "$d")")
echo " compose down $idx"
(cd "$d" && docker compose -p "$idx" -f docker-compose.yml down -v --remove-orphans 2>&1 | tail -1)
done
echo "=== [3/6] force-remove any surviving team containers ==="
left=$(docker ps -aq --filter 'name=_container_team' | wc -l)
echo " found $left"
[ "$left" -gt 0 ] && docker rm -f $(docker ps -aq --filter 'name=_container_team') >/dev/null 2>&1
echo "=== [4/6] remove team networks + stray volumes ==="
for n in $(docker network ls --format '{{.Name}}' | grep -E '^team[0-9]+_default$' || true); do
docker network rm "$n" >/dev/null 2>&1 && echo " network $n"
done
# anonymous + team-scoped volumes (challenge DB state lives here)
anon=$(docker volume ls -q --filter dangling=true | wc -l)
echo " dangling volumes: $anon"
[ "$anon" -gt 0 ] && docker volume prune -f >/dev/null 2>&1 && echo " pruned"
for v in $(docker volume ls --format '{{.Name}}' | grep -E '^team[0-9]+' || true); do
docker volume rm "$v" >/dev/null 2>&1 && echo " volume $v"
done
echo "=== [5/6] delete team dirs + ledgers ==="
rm -rf "$TEAMS"/team*
rm -f "$TEAMS"/leaderboard.json "$TEAMS"/points.json "$TEAMS"/attacks.json
echo " team dirs now: $(ls -d "$TEAMS"/team* 2>/dev/null | wc -l)"
echo "=== [6/6] drop team domains from Traefik ==="
cd "$BASE/panel" && python3 -c "
import sys; sys.path.insert(0,'.')
import teams
print(' ', teams.ensure_team_domains())
"
# the platform-level receiver is separate and must keep running
systemctl restart gemastik-panel 2>/dev/null
echo " panel: $(systemctl is-active gemastik-panel)"
echo "=== done ==="
docker ps --format '{{.Names}}' | grep -c '_container_team' || echo " team containers: 0"
docker images --format '{{.Repository}}' | grep -c '^services-' || true
df -h / | tail -1
panel/run_topo_tests.sh
+20
View File
@@ -0,0 +1,20 @@
#!/usr/bin/env bash
# Run the topology test suite and report one line per test.
set -u
export PLAYWRIGHT_BROWSERS_PATH=/root/.cache/ms-playwright
cd /opt/gemastik18-final/panel || exit 1
fail=0
for t in test_topo_pixels test_topo_browser test_topo_viewports test_topo_race test_topo_drag; do
log="/tmp/${t}.log"
timeout 400 node "${t}.js" > "$log" 2>&1
code=$?
if [ $code -eq 0 ]; then
echo "PASS ${t} (exit 0)"
else
echo "FAIL ${t} (exit ${code})"
tail -12 "$log" | sed 's/^/ /'
fail=1
fi
done
exit $fail
panel/set_enabled.py
+37
View File
@@ -0,0 +1,37 @@
#!/usr/bin/env python3
"""Set the registry's enabled flags to exactly the given challenge names.
`set_challenge_enabled` only reports a change when the flag actually differs,
so flipping several challenges at once through the API is a long round trip.
This writes the registry directly (the same file the API writes) and leaves
runtime reconciliation to panel/sync_all_challenges.py.
Usage:
python3 panel/set_enabled.py gift-card art fjb
python3 panel/set_enabled.py --clear
"""
import json
import sys
from pathlib import Path
REG = Path("/opt/gemastik18-final/teams/challenge_registry.json")
def main(argv):
reg = json.loads(REG.read_text())
names = [c["name"] for c in reg["challenges"]]
want = set(argv[1:]) if "--clear" not in argv else set()
unknown = want - set(names)
if unknown:
print("unknown challenge(s):", ", ".join(sorted(unknown)))
return 2
for c in reg["challenges"]:
c["enabled"] = c["name"] in want
REG.write_text(json.dumps(reg, indent=2) + "\n")
enabled = [c["name"] for c in reg["challenges"] if c["enabled"]]
print(f"registry now enables {len(enabled)}: {', '.join(enabled)}")
return 0
if __name__ == "__main__":
raise SystemExit(main(sys.argv))
panel/sla_probe.py
+56
View File
@@ -0,0 +1,56 @@
#!/usr/bin/env python3
"""Probe each team receiver's /check/<challenge> directly and report SLA.
Probes are SEQUENTIAL per team on purpose: the team receivers are sync Flask
apps, so 8 concurrent /check requests make them time out and report false
failures. Keep max_workers=1. This is still far faster than the panel's
/api/scoreboard, which probes every team on one shared refresher thread.
python3 panel/sla_probe.py # all teams
python3 panel/sla_probe.py 1 2 # specific teams
"""
import base64
import json
import sys
import urllib.error
import urllib.request
from pathlib import Path
sys.path.insert(0, str(Path(__file__).resolve().parent))
import teams as orch
def check(recv_port, au, ap, name):
url = f"http://127.0.0.1:{recv_port}/check/{name}"
tok = base64.b64encode(f"{au}:{ap}".encode()).decode()
req = urllib.request.Request(url, headers={"Authorization": f"Basic {tok}"})
try:
with urllib.request.urlopen(req, timeout=30) as r:
body = json.loads(r.read().decode())
return name, bool(body.get("success")), ""
except urllib.error.HTTPError as e:
return name, False, f"HTTP {e.code}"
except Exception as e:
return name, False, str(e)[:60]
def main():
want = [int(a) for a in sys.argv[1:]]
teams = [t for t in orch.list_teams() if not want or t["index"] in want]
enabled = [c["name"] for c in orch.enabled_challenges()]
grand_ok = grand_all = 0
for t in teams:
idx = t["index"]
port = t["ports"]["receiver"]
au, ap = t.get("admin_user", ""), t.get("admin_pass", "")
res = [check(port, au, ap, n) for n in enabled]
up = [n for n, ok, _ in res if ok]
down = [(n, e) for n, ok, e in res if not ok]
grand_ok += len(up); grand_all += len(res)
print(f"team{idx} ({t.get('label')}) SLA {len(up)}/{len(res)}")
if down:
for n, e in down:
print(f" DOWN {n}: {e}")
print(f"\nTOTAL {grand_ok}/{grand_all} "
f"({100.0 * grand_ok / grand_all if grand_all else 0:.1f}%)")
if __name__ == "__main__":
main()
panel/sla_sweep.sh
+40
View File
@@ -0,0 +1,40 @@
#!/usr/bin/env bash
# Full SLA sweep across every team, SEQUENTIALLY.
#
# Sequential is not optional: the receivers are sync Flask apps, so hitting
# several at once makes them contend for the same 2 CPUs and report false
# timeouts (a pitfall already documented, and re-violated once here).
set -uo pipefail
BASE=/opt/gemastik18-final
declare -A RPORT=( [1]=31080 [2]=32080 [3]=33080 [4]=34080 )
echo "load: $(cut -d' ' -f1-3 /proc/loadavg)"
for t in 1 2 3 4; do
ENVF=$BASE/teams/team$t/receiver/.env
[ -f "$ENVF" ] || { echo "=== team$t: no receiver env ==="; continue; }
U=$(grep -oP '^ADMIN_USERNAME=\K.*' "$ENVF")
P=$(grep -oP '^ADMIN_PASSWORD=\K.*' "$ENVF")
port=${RPORT[$t]}
S=$(date +%s)
code=$(timeout 900 curl -sS -u "$U:$P" \
"http://127.0.0.1:$port/check/all" \
-o "/tmp/sla_t$t.json" -w '%{http_code}' 2>/dev/null)
took=$(( $(date +%s) - S ))
echo "=== team$t (receiver :$port, HTTP $code, ${took}s) ==="
python3 - "$t" <<'PY'
import json, sys
t = sys.argv[1]
try:
d = json.load(open(f"/tmp/sla_t{t}.json"))
except Exception as e:
print(" no/invalid result:", e); raise SystemExit
r = d.get("results", d)
if not isinstance(r, dict):
print(" ", json.dumps(d)[:300]); raise SystemExit
ok = sorted(k for k, v in r.items() if v is True)
bad = sorted(k for k, v in r.items() if v is not True)
print(f" PASS {len(ok)}/{len(r)}")
if ok: print(" ok :", ", ".join(ok))
if bad: print(" BAD:", ", ".join(bad))
PY
done
panel/start_team_bg.sh
+32
View File
@@ -0,0 +1,32 @@
#!/usr/bin/env bash
# Start one team's full stack in the BACKGROUND (safe for a 16-challenge team:
# `compose up` for 16 services takes minutes and would blow a foreground timeout).
# Usage: start_team_bg.sh <teamIdx>
set -uo pipefail
IDX="${1:?usage: start_team_bg.sh <teamIdx>}"
LOG="/tmp/start-team${IDX}.log"
TEAMDIR="/opt/gemastik18-final/teams/team${IDX}"
cd "${TEAMDIR}/services" || exit 1
{
echo "=== $(date -Is) start team${IDX} ==="
docker compose -p "team${IDX}" up -d --remove-orphans 2>&1
echo "compose rc=$?"
# independent systemd receiver (never a child of the panel)
python3 /opt/gemastik18-final/panel/gen_receiver_services.py start 2>&1
systemctl restart "gemastik-receiver-team${IDX}.service" 2>&1
echo "receiver: $(systemctl is-active gemastik-receiver-team${IDX}.service)"
python3 - "$IDX" <<'PY'
import sys, json, time
sys.path.insert(0, '/opt/gemastik18-final/panel')
import teams
idx = int(sys.argv[1])
sf = f"/opt/gemastik18-final/teams/team{idx}/state.json"
st = json.loads(open(sf).read()); st["status"] = "running"
open(sf, "w").write(json.dumps(st, indent=2))
# retry loop: chpasswd races container boot
teams.set_ssh_passwords(idx)
print("=== done team", idx, "===")
PY
df -h / | tail -1
} >"${LOG}" 2>&1
echo "started team${IDX} -> ${LOG}"
panel/static/guide.html
+108
View File
@@ -0,0 +1,108 @@
<!DOCTYPE html>
<html lang="id">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<meta name="team-id" content="0">
<title>Panduan SSH — Gemastik A/D</title>
<style>
:root { --bg:#0b0e14; --panel:#151a23; --panel2:#1d2430; --line:#2a3444; --txt:#e6edf3; --dim:#8b98a9; --accent:#38bdf8; --green:#34d399; --red:#f87171; --purple:#a78bfa; }
* { margin:0; padding:0; box-sizing:border-box; }
body { background:var(--bg); color:var(--txt); font-family:'Segoe UI',system-ui,sans-serif; min-height:100vh; }
.wrap { max-width:800px; margin:0 auto; padding:24px 16px 60px; }
header { display:flex; align-items:center; gap:12px; margin-bottom:24px; flex-wrap:wrap; }
.logo { width:42px; height:42px; border-radius:10px; background:linear-gradient(135deg,#38bdf8,#6366f1); display:flex; align-items:center; justify-content:center; font-weight:800; font-size:20px; color:#fff; }
h1 { font-size:22px; }
.sub { color:var(--dim); font-size:13px; }
.card { background:var(--panel); border:1px solid var(--line); border-radius:14px; padding:20px; margin-bottom:16px; }
.card h2 { font-size:15px; margin-bottom:12px; color:var(--accent); }
h3 { color:var(--purple); margin:18px 0 8px; font-size:14px; }
p, li { font-size:13px; color:#c9d4e3; line-height:1.7; }
ol, ul { padding-left:20px; }
.sshbox { background:var(--panel2); border:1px solid var(--line); border-radius:8px; padding:10px 12px; font-family:ui-monospace,monospace; font-size:12px; overflow-x:auto; margin:6px 0; }
code { background:var(--panel2); padding:2px 6px; border-radius:5px; font-size:12px; }
.warn { background:#3a1414; border:1px solid var(--red); border-radius:8px; padding:12px; font-size:13px; color:#fca5a5; margin:10px 0; }
a { color:var(--accent); }
table { width:100%; border-collapse:collapse; font-size:13px; margin:8px 0; }
th, td { text-align:left; padding:8px 6px; border-bottom:1px solid var(--line); }
th { color:var(--dim); font-weight:500; }
</style>
</head>
<body>
<div class="wrap">
<header>
<div class="logo">G</div>
<div style="flex:1">
<h1>📖 Panduan SSH & Attack</h1>
<div class="sub">Gemastik 18 Final — Attack & Defense</div>
</div>
</header>
<div class="card">
<h2>🎯 Konsep Attack & Defense</h2>
<p>Setiap tim punya <b>6 challenge container</b> yang harus dijaga (<b>defense</b>) dan bisa menyerang container tim lain (<b>attack</b>). Setiap container menyimpan <b>flag</b> yang nilainya dicek panitia secara berkala (SLA). Kalau service mati atau flag berubah, tim kamu <b>kehilangan poin SLA</b>.</p>
<p style="margin-top:8px">Kamu menang dengan: (1) menjaga service tetap hidup, (2) <b>mencuri flag</b> dari tim lawan dan submit, (3) mencegah tim lawan mencuri flag kamu.</p>
</div>
<div class="card">
<h2>🔐 Login SSH</h2>
<h3>Cara 1 — Web Terminal di Portal Tim</h3>
<ol>
<li>Buka <b>portal tim kamu</b> (domain dari panitia).</li>
<li>Login dengan <b>password SSH tim</b>.</li>
<li>Tab <b>🖥️ Terminal SSH</b> → pilih challenge → <b>Sambung</b>.</li>
<li>Langsung masuk sebagai user yang tertera di dropdown — <code>ctfuser</code> untuk 6 challenge native GEMASTIK XVIII, <code>root</code> untuk challenge XVI/XVII import — tanpa perlu aplikasi SSH.</li>
</ol>
<h3>Cara 2 — SSH Client (opsional)</h3>
<div class="sshbox">ssh &lt;USER&gt;@43.134.105.109 -p &lt;PORT_SSH&gt;</div>
<p>Contoh: untuk challenge <code>blogpost</code> tim 1, port SSH = <code>31022</code>.</p>
</div>
<div class="card">
<h2>🧭 Command Penting</h2>
<table>
<tr><th>Command</th><th>Fungsi</th></tr>
<tr><td><code>cat /flag.txt</code></td><td>Lihat flag tim kamu sendiri</td></tr>
<tr><td><code>ls /app /srv /opt /home</code></td><td>Cari file source/service</td></tr>
<tr><td><code>ps aux</code></td><td>Lihat proses yang berjalan</td></tr>
<tr><td><code>ss -tlnp</code></td><td>Lihat port yang dibuka service</td></tr>
<tr><td><code>systemctl status</code></td><td>Cek service (kalau ada)</td></tr>
<tr><td><code>cat /etc/passwd</code></td><td>Daftar user lokal</td></tr>
</table>
</div>
<div class="card">
<h2>⚔️ Alur Attack</h2>
<ol>
<li>Buka tab <b>🎯 Target Musuh</b> di portal — lihat daftar domain/port tim lain.</li>
<li>Analisa service lawan dari <b>source code di container kamu sendiri</b> (biasanya sama).</li>
<li>Cari vuln (SSTI, path traversal, RCE, crypto oracle, dsb).</li>
<li>Exploit service lawan → baca <code>/flag.txt</code> mereka.</li>
<li>Submit flag di tab <b>🚩 Submit Flag</b> → <b>poin masuk ke leaderboard</b>.</li>
</ol>
<div class="warn">⚠️ Jangan sampai flag tim kamu bocor! Ganti password SSH rutin (via panitia), dan jangan tinggalkan flag di tempat umum.</div>
</div>
<div class="card">
<h2>🛡️ Alur Defense</h2>
<ol>
<li>Pastikan service <b>selalu hidup</b> — SLA dicek panitia berkala.</li>
<li>Patch vuln yang bisa dipakai lawan (jika tahu).</li>
<li>Jangan ubah <code>/flag.txt</code> — mount <b>read-only</b>, tidak bisa diubah dari dalam container.</li>
<li>Pantau <code>ps aux</code> / log — kalau ada aktivitas mencurigakan, restart via panitia.</li>
</ol>
</div>
<div class="card">
<h2>📞 Butuh Bantuan?</h2>
<p>Hubungi panitia untuk: reset password SSH, restart container, atau lapor service down. Portal ini untuk peserta — panel admin terpisah.</p>
<p style="margin-top:8px"><a href="/team/0" data-portal-link>← Kembali ke portal tim</a></p>
</div>
</div>
<script>
const TEAM_ID = parseInt(document.querySelector('meta[name="team-id"]').content || '0', 10);
document.querySelectorAll('[data-portal-link]').forEach(a => a.href = `/team/${TEAM_ID}`);
</script>
</body>
</html>
panel/static/index.html
+517 -94
View File
@@ -3,7 +3,7 @@
<head> <head>
<meta charset="UTF-8"> <meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Gemastik A/D Panel</title> <title>Attack Defense Platform</title>
<style> <style>
* { margin:0; padding:0; box-sizing:border-box; } * { margin:0; padding:0; box-sizing:border-box; }
body { body {
@@ -83,6 +83,15 @@
} }
.toast.show { opacity:1; transform:translateY(0); } .toast.show { opacity:1; transform:translateY(0); }
.toast.err { border-color:#f87171; color:#fca5a5; } .toast.err { border-color:#f87171; color:#fca5a5; }
/* loading overlay */
#loadingOverlay {
display:none; position:fixed; inset:0; background:rgba(4,8,14,0.82); z-index:2000;
align-items:center; justify-content:center; flex-direction:column; gap:18px;
}
#loadingOverlay.show { display:flex; }
.loader { width:44px; height:44px; border:4px solid #2a3444; border-top-color:#38bdf8; border-radius:50%; animation:spin 0.9s linear infinite; }
@keyframes spin { to { transform:rotate(360deg); } }
#loadingText { color:#dbe6f4; font-size:14px; text-align:center; padding:0 24px; line-height:1.6; }
.history-box { .history-box {
background:#0a101f; border:1px solid #1e3a5f; border-radius:10px; padding:14px; background:#0a101f; border:1px solid #1e3a5f; border-radius:10px; padding:14px;
font-size:11px; color:#7dd3fc; max-height:300px; overflow-y:auto; white-space:pre-wrap; font-size:11px; color:#7dd3fc; max-height:300px; overflow-y:auto; white-space:pre-wrap;
@@ -91,7 +100,16 @@
.spin { display:inline-block; width:12px; height:12px; border:2px solid #2a4a6f; border-top-color:#5ad1ff; border-radius:50%; animation:sp .7s linear infinite; } .spin { display:inline-block; width:12px; height:12px; border:2px solid #2a4a6f; border-top-color:#5ad1ff; border-radius:50%; animation:sp .7s linear infinite; }
@keyframes sp { to { transform:rotate(360deg); } } @keyframes sp { to { transform:rotate(360deg); } }
.topo-wrap { background:#0a0f1c; border:1px solid #1e3a5f; border-radius:12px; padding:20px; overflow-x:auto; } .topo-wrap { background:#0a0f1c; border:1px solid #1e3a5f; border-radius:12px; padding:20px; overflow-x:auto; }
.topo-svg { width:100%; min-width:800px; } /* Now a DIV host for the PixiJS canvas (was an inline <svg>). It needs an
explicit height: the Pixi Application is created with resizeTo:this element
and a zero-height box would size the renderer to nothing. */
.topo-svg { width:100%; min-width:800px; height:520px; }
/* attack visualizer: recent attacks pulse */
@keyframes attackPulse { 0%,100% { stroke-opacity:0.4; } 50% { stroke-opacity:1; } }
@keyframes attackBlink { 0%,100% { opacity:1; } 50% { opacity:0.35; } }
.attack-line { animation: attackPulse 1.2s ease-in-out infinite; }
.attack-icon { animation: attackBlink 1s ease-in-out infinite; }
.topo-hint { font-size:12px; color:var(--dim); margin-top:8px; }
.team-head { display:flex; justify-content:space-between; align-items:center; gap:10px; flex-wrap:wrap; } .team-head { display:flex; justify-content:space-between; align-items:center; gap:10px; flex-wrap:wrap; }
.team-status { font-size:11px; } .team-status { font-size:11px; }
.kv { display:grid; grid-template-columns:120px 1fr; gap:6px 12px; font-size:12px; } .kv { display:grid; grid-template-columns:120px 1fr; gap:6px 12px; font-size:12px; }
@@ -102,10 +120,12 @@
</head> </head>
<body> <body>
<header> <header>
<h1>⚔️ GEMASTIK A/D — NODE CONTROL</h1> <h1>⚔️ ATTACK DEFENSE PLATFORM — NODE CONTROL</h1>
<div class="actions"> <div class="actions">
<span class="pill" id="clock">--:--:--</span> <span class="pill" id="clock">--:--:--</span>
<button onclick="refresh()">🔄 Refresh</button> <button onclick="refresh()">🔄 Refresh</button>
<button class="danger" onclick="resetScores()" style="background:#dc2626;border:none;border-radius:8px;padding:8px 14px;color:#fff;font-weight:600;cursor:pointer">🧹 Reset Skor</button>
<button class="danger" onclick="resetEnv()" style="background:#7f1d1d;border:none;border-radius:8px;padding:8px 14px;color:#fff;font-weight:600;cursor:pointer">💥 Reset Environment</button>
<button onclick="logout()">Keluar</button> <button onclick="logout()">Keluar</button>
</div> </div>
</header> </header>
@@ -116,6 +136,9 @@
<button class="tab" data-view="teams" onclick="showView('teams'); loadTeams()">👥 Teams</button> <button class="tab" data-view="teams" onclick="showView('teams'); loadTeams()">👥 Teams</button>
<button class="tab" data-view="logs" onclick="showView('logs'); loadLogs()">📜 Logs</button> <button class="tab" data-view="logs" onclick="showView('logs'); loadLogs()">📜 Logs</button>
<button class="tab" data-view="creds" onclick="showView('creds'); loadCreds()">🔑 Creds</button> <button class="tab" data-view="creds" onclick="showView('creds'); loadCreds()">🔑 Creds</button>
<button class="tab" data-view="targets" onclick="showView('targets'); loadTargetMatrix()">🎯 Target Matrix</button>
<button class="tab" data-view="sla" onclick="showView('sla'); loadSla()">📊 SLA & Skor</button>
<button class="tab" data-view="chmgr" onclick="showView('chmgr'); loadChMgr()">🏗️ Challenge Manager</button>
</div> </div>
<!-- Challenges view --> <!-- Challenges view -->
@@ -125,7 +148,14 @@
<!-- Topology view --> <!-- Topology view -->
<div class="view" id="view-topo"> <div class="view" id="view-topo">
<div class="topo-wrap"><svg id="topoSvg" class="topo-svg" height="420"></svg></div> <div class="topo-toolbar" style="display:flex;align-items:center;gap:8px;margin-bottom:8px;flex-wrap:wrap">
<button onclick="topoZoom(1.25)">🔍 + Zoom In</button>
<button onclick="topoZoom(0.8)">🔎 Zoom Out</button>
<button onclick="topoReset()">⟳ Reset</button>
<span id="topoZoomLabel" style="font-size:12px;color:var(--dim);min-width:40px">100%</span>
</div>
<div class="topo-wrap"><div id="topoHost" class="topo-svg"></div></div>
<div class="topo-hint">💡 <b>Geser node</b> untuk atur layout • <b>scroll / ctrl+scroll</b> untuk zoom in-out • <b>drag area kosong</b> untuk geser canvas • ⚔️ garis merah = serangan (attacker → target) • garis tebal = serangan 60 detik terakhir &nbsp;<span id="topoEngine" style="opacity:.6"></span></div>
</div> </div>
<!-- Teams view --> <!-- Teams view -->
@@ -144,6 +174,12 @@
<button class="danger" onclick="stopAllTeams()">⏹ Stop CTF (semua)</button> <button class="danger" onclick="stopAllTeams()">⏹ Stop CTF (semua)</button>
</div> </div>
</div> </div>
<div id="bulkDelBar" style="display:none;margin:10px 0"></div>
<div class="card" style="margin-bottom:10px;display:flex;gap:10px;align-items:center;flex-wrap:wrap">
<button onclick="selectAllTeams(true)">☑️ Pilih semua</button>
<button onclick="clearTeamSelection()">☐ Kosongkan</button>
<span style="font-size:11px;color:#718096">Centang tim di kiri nama untuk hapus massal sekaligus</span>
</div>
<div class="grid" id="teamsGrid"></div> <div class="grid" id="teamsGrid"></div>
<div class="card" style="margin-top:16px"> <div class="card" style="margin-top:16px">
<div class="team-head"> <div class="team-head">
@@ -181,7 +217,41 @@
<div class="grid" id="credsGrid"></div> <div class="grid" id="credsGrid"></div>
</div> </div>
<div class="footer-note">Receiver: https://gemastik.imrnes.team · Panel: https://panel.gemastik.imrnes.team · Auto-refresh tiap 15 detik</div> <!-- Target Matrix view -->
<div class="view" id="view-targets">
<div class="card">
<div style="display:flex;align-items:center;gap:10px;flex-wrap:wrap">
<b style="color:#5ad1ff">🎯 Target Matrix</b>
<span style="font-size:11px;color:#718096">Domain:port semua service semua tim — buat dibagikan ke peserta sebagai daftar target</span>
</div>
<div id="targetMatrix" style="margin-top:14px;font-family:ui-monospace,monospace;font-size:12px;line-height:1.9;color:#dbe6f4;background:#0a101f;border:1px solid #1e3a5f;border-radius:10px;padding:14px;overflow-x:auto">Memuat…</div>
</div>
</div>
<!-- SLA & Scoreboard view -->
<div class="view" id="view-sla">
<div class="card">
<div style="display:flex;align-items:center;gap:10px;flex-wrap:wrap">
<b style="color:#5ad1ff">📊 SLA & Skor Tim</b>
<span style="font-size:11px;color:#718096">Status service tiap tim (dicek otomatis tiap ~30 detik) + poin: +100/flag dicuri, +50 bonus SLA saat 6/6 UP. Auto-refresh 30 detik.</span>
</div>
<div id="slaAdminList" style="margin-top:14px;font-family:ui-monospace,monospace;font-size:12px;line-height:1.9;color:#dbe6f4;background:#0a101f;border:1px solid #1e3a5f;border-radius:10px;padding:14px;overflow-x:auto">Memuat…</div>
</div>
</div>
<!-- Challenge Manager view -->
<div class="view" id="view-chmgr">
<div class="card">
<div style="display:flex;align-items:center;gap:10px;flex-wrap:wrap">
<b style="color:#5ad1ff">🏗️ Challenge Manager</b>
<span style="font-size:11px;color:#718096">Semua challenge dari registry (GEMASTIK 18, XVI, XVII). Toggle untuk aktif/nonaktif global di semua tim — diterapkan langsung (build/up atau stop/remove + restart receiver).</span>
<button class="primary" onclick="loadChMgr()" style="padding:4px 10px;font-size:12px">🔄 Muat ulang</button>
</div>
<div id="chMgrList" style="margin-top:14px;font-family:ui-monospace,monospace;font-size:12px;line-height:1.9;color:#dbe6f4;background:#0a101f;border:1px solid #1e3a5f;border-radius:10px;padding:14px;overflow-x:auto">Memuat…</div>
</div>
</div>
<div class="footer-note">Receiver: https://attackdefense.imrnes.team · Panel: https://panel.attackdefense.imrnes.team · Auto-refresh tiap 15 detik</div>
<!-- modal flag --> <!-- modal flag -->
<div class="modal-back" id="modalFlag"> <div class="modal-back" id="modalFlag">
@@ -219,6 +289,12 @@
<div class="toast" id="toast"></div> <div class="toast" id="toast"></div>
<!-- loading overlay -->
<div id="loadingOverlay">
<div class="loader"></div>
<div id="loadingText">Memproses…</div>
</div>
<script> <script>
let CURRENT = null; let CURRENT = null;
let REFRESH_MS = 15000; let REFRESH_MS = 15000;
@@ -237,16 +313,152 @@ function toast(msg, err=false) {
setTimeout(() => t.className = 'toast', 3000); setTimeout(() => t.className = 'toast', 3000);
} }
function esc(s) { function showLoading(html) {
return (s||'').replace(/[&<>"']/g, c => ({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;',"'":'&#39;'}[c])); const ov = document.getElementById('loadingOverlay');
document.getElementById('loadingText').innerHTML = html;
ov.classList.add('show');
return ov;
} }
function hideLoading() {
document.getElementById('loadingOverlay').classList.remove('show');
}
function esc(s) {
return String(s ?? '').replace(/[&<>"']/g, c => ({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;',"'":'&#39;'}[c]));
}
// Alias used by the Challenge Manager render. Kept as a separate name so
// existing esc() call sites stay untouched, but it MUST exist: a missing
// helper throws ReferenceError mid-render and the tab hangs on "Memuat…"
// forever with no visible error.
function escapeHtml(s) { return esc(s); }
function showView(v) { function showView(v) {
document.querySelectorAll('.tab').forEach(b => b.classList.toggle('active', b.dataset.view === v)); document.querySelectorAll('.tab').forEach(b => b.classList.toggle('active', b.dataset.view === v));
document.querySelectorAll('.view').forEach(x => x.classList.toggle('active', x.id === 'view-' + v)); document.querySelectorAll('.view').forEach(x => x.classList.toggle('active', x.id === 'view-' + v));
if (v === 'topo') loadTopo(); // refresh attacks immediately on tab switch + every 10s
if (v === 'sla') loadSla();
if (v === 'chmgr') loadChMgr();
}
let topoTimer = null;
function startTopoTimer() {
if (!topoTimer) topoTimer = setInterval(() => {
if (document.getElementById('view-topo').classList.contains('active')) loadTopo();
}, 10000);
}
startTopoTimer();
let slaTimer = null;
function startSlaTimer() {
if (!slaTimer) slaTimer = setInterval(() => {
if (document.getElementById('view-sla').classList.contains('active')) loadSla();
}, 30000);
}
startSlaTimer();
async function loadSla() {
const box = document.getElementById('slaAdminList');
if (!box) return;
box.innerHTML = 'Memuat…';
try {
const d = await api('/api/scoreboard');
const rows = (d.teams || []).map(t => {
const pct = Math.round(t.sla_pct || 0);
const color = pct === 100 ? '#2ecc71' : (pct >= 60 ? '#f1c40f' : '#e74c3c');
const bar = `<span style="display:inline-block;vertical-align:middle;width:120px;height:8px;background:#1e3a5f;border-radius:4px;margin:0 8px;overflow:hidden"><span style="display:block;height:100%;width:${pct}%;background:${color}"></span></span>`;
return `<div style="padding:8px 4px;border-bottom:1px solid #16233a">
<b>${t.badge ? t.badge + ' ' : '#' + t.rank + ' '}</b>${esc(t.label)} ${bar}<span style="color:${color}">${t.alive}/${t.total} (${pct}%)</span>
<span style="float:right;color:#5ad1ff">⚑ ${t.solves} flag · 🏆 ${t.points} pts</span>
</div>`;
}).join('');
box.innerHTML = rows || '<div style="color:#718096">Belum ada tim.</div>';
} catch (e) {
box.innerHTML = '<div style="color:#e74c3c">Gagal memuat SLA.</div>';
}
} }
// ---------- Challenge Manager ----------
async function loadChMgr() {
const box = document.getElementById('chMgrList');
if (!box) return;
box.innerHTML = 'Memuat…';
try {
const d = await api('/api/challenges');
const list = d.challenges || [];
const setLabels = { 'gemastik18': 'GEMASTIK 18', 'xvi': 'GEMASTIK XVI', 'xvii': 'GEMASTIK XVII' };
const bySet = {};
for (const c of list) (bySet[c.set] = bySet[c.set] || []).push(c);
let html = '';
for (const [set, chs] of Object.entries(bySet)) {
html += `<div style="margin:8px 0 4px;color:#5ad1ff;font-weight:700">📦 ${escapeHtml(setLabels[set] || set)} (${chs.length})</div>`;
for (const c of chs) {
const on = c.enabled ? 'checked' : '';
html += `<div style="display:flex;align-items:center;gap:10px;padding:6px 8px;border-bottom:1px solid #13233d;border-radius:6px">
<input type="checkbox" id="chmgr-${escapeHtml(c.name)}" ${on} onchange="toggleChallenge('${escapeHtml(c.name)}', this.checked)" style="width:16px;height:16px;accent-color:#22c55e">
<b style="min-width:150px">${escapeHtml(c.name)}</b>
<span style="color:#718096;font-size:11px">${escapeHtml(c.set)} · ${escapeHtml(c.category || '-')}</span>
<span style="color:#3d5a80;font-size:11px">chall+${c.chall_offset}/ssh+${c.ssh_offset}</span>
<span style="margin-left:auto;font-size:11px;color:${c.enabled ? '#22c55e' : '#e74c3c'}">${c.enabled ? '● AKTIF' : '○ NONAKTIF'}</span>
<span id="chmgr-msg-${escapeHtml(c.name)}" style="font-size:11px;color:#718096"></span>
</div>`;
}
}
box.innerHTML = html || '<div style="color:#718096">Tidak ada challenge di registry.</div>';
} catch (e) {
box.innerHTML = `<div style="color:#e74c3c">Gagal memuat: ${escapeHtml(e.message)}</div>`;
}
}
async function toggleChallenge(name, enabled) {
const msg = document.getElementById('chmgr-msg-' + name);
if (!msg) return;
msg.textContent = '⏳ menerapkan…';
msg.style.color = '#f5c542';
try {
const d = await api('/api/challenges/' + encodeURIComponent(name), { method: 'PATCH', body: JSON.stringify({ enabled }) });
if (d.unchanged) {
msg.textContent = `✓ ${d.enabled ? 'diaktifkan' : 'dinonaktifkan'} (sudah sesuai)`;
msg.style.color = '#22c55e';
setTimeout(() => { msg.textContent = ''; loadChMgr(); }, 3000);
return;
}
// Docker build runs on the server; poll the job until it reports per-team results.
if (!d.job) throw new Error('server tidak mengembalikan job id');
const started = Date.now();
const poll = async () => {
const j = await api('/api/challenges/jobs/' + encodeURIComponent(d.job));
if (j.state === 'running') {
const secs = Math.round((Date.now() - started) / 1000);
msg.textContent = `⏳ build ${secs}s…`;
setTimeout(poll, 3000);
return;
}
if (j.state === 'error') {
msg.textContent = '✗ ' + (j.detail || 'gagal');
msg.style.color = '#e74c3c';
loadChMgr();
return;
}
const okCount = (j.applied || []).filter(t => t.ok).length;
const bad = (j.applied || []).filter(t => !t.ok);
msg.textContent = bad.length
? `⚠ ${okCount}/${(j.applied || []).length} tim OK — ${bad.map(t => `team${t.team}: ${(t.detail || '').split('\n').slice(-1)[0]}`).join('; ').slice(0, 120)}`
: `✓ ${d.enabled ? 'diaktifkan' : 'dinonaktifkan'} (${okCount} tim)`;
msg.style.color = bad.length ? '#f5c542' : '#22c55e';
setTimeout(() => { msg.textContent = ''; loadChMgr(); }, 6000);
};
poll();
} catch (e) {
msg.textContent = '✗ ' + e.message;
msg.style.color = '#e74c3c';
loadChMgr();
}
}
// ---------- Challenges ---------- // ---------- Challenges ----------
// The admin challenge grid is a global node view with no team of its own, so it
// asks for credentials without ?team= and the server falls back to the receiver.
// Team-scoped pages pass their own index instead.
function TEAM_Q() { return ''; }
async function refresh() { async function refresh() {
const grid = document.getElementById('grid'); const grid = document.getElementById('grid');
try { try {
@@ -276,9 +488,11 @@ async function refresh() {
<button onclick="viewCred('${esc(ch.name)}')">SSH</button> <button onclick="viewCred('${esc(ch.name)}')">SSH</button>
</div> </div>
</div>`; </div>`;
fetch(`/api/credential/${ch.name}`).then(r=>r.json()).then(c => { fetch(`/api/credential/${ch.name}${TEAM_Q()}`).then(r=>r.json()).then(c => {
const el = document.getElementById('creds-' + ch.name); const el = document.getElementById('creds-' + ch.name);
if (el && c.username) el.innerHTML = `<b>ctfuser</b> / <b>${esc(c.password)}</b>`; // Use the username the server reports: it is per-challenge (ctfuser for
// the 6 native XVIII images, root for the imported XVI/XVII ones).
if (el && c.username) el.innerHTML = `<b>${esc(c.username)}</b> / <b>${esc(c.password)}</b>`;
}).catch(()=>{}); }).catch(()=>{});
} }
grid.innerHTML = html; grid.innerHTML = html;
@@ -317,12 +531,17 @@ async function submitFlag() {
async function viewCred(ch) { async function viewCred(ch) {
try { try {
const c = await api(`/api/credential/${ch}`); const c = await api(`/api/credential/${ch}${TEAM_Q()}`);
// user + port both come from the server: the SSH login is per-challenge and
// the port is per-team, so a hardcoded table went stale for every imported
// challenge and for any team other than the first.
const user = c.username || 'ctfuser';
const port = c.port || 10022;
const host = `${ch}.attackdefense.imrnes.team`;
document.getElementById('mcTitle').textContent = 'SSH Credentials — ' + ch; document.getElementById('mcTitle').textContent = 'SSH Credentials — ' + ch;
const sshPort = {blogpost:10022, carbeat:11022, cdn:12022, phew:13022, sheesh:14022, warmup:15022}[ch] || 10022; const cmd = `ssh ${user}@${host} -p ${port}`;
const cmd = `ssh ctfuser@${ch}.gemastik.imrnes.team -p ${sshPort}`;
document.getElementById('mcBody').innerHTML = document.getElementById('mcBody').innerHTML =
`<div>User: <b>ctfuser</b></div> `<div>User: <b>${esc(user)}</b></div>
<div>Pass: <b>${esc(c.password)}</b></div> <div>Pass: <b>${esc(c.password)}</b></div>
<div style="margin-top:10px">SSH:</div> <div style="margin-top:10px">SSH:</div>
<div class="flag" style="margin-top:6px">${esc(cmd)}</div>`; <div class="flag" style="margin-top:6px">${esc(cmd)}</div>`;
@@ -330,158 +549,309 @@ async function viewCred(ch) {
} catch (e) { toast(e.message, true); } } catch (e) { toast(e.message, true); }
} }
// ---------- Topology ---------- // ---------- Topology (PixiJS v8) ----------
let topoLoaded = false; // The renderer lives in topo_pixi.js as an ES module so the ~810 KB Pixi bundle is
async function loadTopo() { // only parsed when this tab is actually opened. These functions are the thin
try { // bridge the tab buttons and the 10s refresh timer already call.
const d = await api('/api/topology'); let topoAttacks = [];
renderTopo(d.nodes, d.edges); let topoGraph = null;
} catch (e) { toast('Topologi gagal: ' + e.message, true); } let topoModule = null;
// Single-flight guard. The Topology tab button calls `showView('topo'); loadTopo()`
// and showView() also calls loadTopo() for this view, so two loadTopo() run
// concurrently on every click. Previously the re-entry check was
// `if (topoGraph && topoGraph.app)`, but `topoGraph` was assigned BEFORE the
// awaited init(), so `app` was still null and the second call built a SECOND
// renderer. Both ran `host.innerHTML = ''` and appended their own canvas, so
// whichever init() finished last won the DOM while `topoGraph` still referenced
// the other — a live canvas that was no longer on the page. Track the in-flight
// promise so every caller awaits the same init.
let topoInitPromise = null;
let topoLoadPromise = null;
async function topoEngine() {
if (!topoModule) topoModule = await import('/static/topo_pixi.js');
return topoModule;
} }
function renderTopo(nodes, edges) { async function ensureTopoGraph() {
const svg = document.getElementById('topoSvg'); const host = document.getElementById('topoHost');
const W = Math.max(900, nodes.length * 130); if (!host) return null;
const H = 400; if (topoGraph && topoGraph.app) return topoGraph;
svg.setAttribute('width', W); svg.setAttribute('height', H); if (topoInitPromise) return topoInitPromise; // an init is already running
const cx = W / 2; topoInitPromise = (async () => {
const ns = {}; try {
nodes.forEach(n => { ns[n.id] = n; }); const mod = await topoEngine();
const g = new mod.TopoGraph(host);
// layout: panel/infra top center, teams in circle, challenges below each team await g.init();
const pos = {}; topoGraph = g; // publish only when ready
pos['dns'] = {x: cx, y: 30}; const lbl = document.getElementById('topoEngine');
pos['traefik'] = {x: cx, y: 100}; if (lbl) lbl.textContent = '· rendered with PixiJS v8';
pos['panel'] = {x: cx - 140, y: 100}; return g;
const teams = nodes.filter(n => n.type === 'team'); } finally {
const teamPos = {}; topoInitPromise = null;
teams.forEach((t, i) => {
const ang = (i / Math.max(1, teams.length)) * Math.PI * 2 - Math.PI / 2;
const rx = W * 0.36, ry = 100;
const tx = cx + rx * Math.cos(ang);
const ty = 210 + ry * Math.sin(ang) * 0.6;
teamPos[t.index] = {x: tx, y: ty};
pos[t.id] = {x: tx, y: ty};
});
nodes.filter(n => n.type === 'challenge').forEach(n => {
const ti = n.id.split('-')[0].replace('team','');
const base = teamPos[ti] || {x: cx, y: 250};
const chIdx = ['blogpost','carbeat','cdn','phew','sheesh','warmup'].indexOf(n.label.split('-').pop() || n.label);
pos[n.id] = {x: base.x + (chIdx - 2.5) * 70, y: base.y + 110};
});
// edges
let html = '';
edges.forEach(e => {
const a = pos[e.from], b = pos[e.to];
if (!a || !b) return;
html += `<line x1="${a.x}" y1="${a.y}" x2="${b.x}" y2="${b.y}" stroke="#2a4a6f" stroke-width="1.5" stroke-dasharray="4 3"/>`;
if (e.label) {
const mx = (a.x + b.x) / 2, my = (a.y + b.y) / 2 - 6;
html += `<text x="${mx}" y="${my}" fill="#5a7a9f" font-size="9" text-anchor="middle">${e.label}</text>`;
} }
}); })();
return topoInitPromise;
// nodes
nodes.forEach(n => {
const p = pos[n.id];
if (!p) return;
let fill = '#0e1526', stroke = '#2a4a6f', color = '#a8c3e0', r = 34;
if (n.type === 'panel') { fill = '#0ea5e933'; stroke = '#0ea5e9'; color = '#7dd3fc'; r = 42; }
if (n.type === 'infra') { r = 30; color = '#8aa0b8'; }
if (n.type === 'team') { fill = '#2563eb22'; stroke = '#3b82f6'; color = '#93c5fd'; r = 48; }
if (n.type === 'challenge') { r = 26; color = '#c9d4e3'; }
const status = n.status === 'running' ? ' fill="#34d399"' : '';
const sub = n.type === 'team' ? `:${n.receiver_port}` : (n.port ? `:${n.port}` : '');
html += `<g>
<circle cx="${p.x}" cy="${p.y}" r="${r}" fill="${fill}" stroke="${stroke}" stroke-width="1.5"/>
<circle cx="${p.x}" cy="${p.y}" r="${r-4}" fill="none" stroke="${stroke}" stroke-opacity="0.3"/>
<text x="${p.x}" y="${p.y - (sub ? 0 : 4)}" fill="${color}" font-size="${n.type==='team'?12:10}" font-weight="bold" text-anchor="middle">${esc(n.label)}</text>
${sub ? `<text x="${p.x}" y="${p.y + 12}" fill="#5a7a9f" font-size="9" text-anchor="middle">${sub}</text>` : ''}
${status ? `<circle cx="${p.x + r - 8}" cy="${p.y - r + 8}" r="5" fill="#34d399"/>` : ''}
</g>`;
});
svg.innerHTML = `<defs><marker id="arrow" viewBox="0 0 10 10" refX="8" refY="5" markerWidth="5" markerHeight="5" orient="auto"><path d="M0,0 L10,5 L0,10 z" fill="#2a4a6f"/></marker></defs>` + html;
} }
async function loadTopo() {
// The 10s timer plus the tab click both land here; serialise so two refreshes
// never interleave a scene rebuild.
if (topoLoadPromise) return topoLoadPromise;
topoLoadPromise = (async () => {
try {
const g = await ensureTopoGraph();
if (!g) return;
const [d, a] = await Promise.all([api('/api/topology'), api('/api/attacks').catch(() => ({events: []}))]);
topoAttacks = a.events || [];
g.setData(d.nodes, d.edges, topoAttacks);
} catch (e) {
toast('Topologi gagal: ' + e.message, true);
} finally {
topoLoadPromise = null;
}
})();
return topoLoadPromise;
}
function topoZoom(factor) {
if (topoGraph && topoGraph.app) topoGraph.zoomBy(factor);
}
function topoReset() {
if (topoGraph && topoGraph.app) topoGraph.reset();
}
// Debug/automation hook: the inline script's top-level `let topoGraph` is not a
// window property, so headless tests and devtools have no way to inspect the
// live scene graph. Expose the instance deliberately.
window.__topoProbe = () => topoGraph;
// ---------- Teams ---------- // ---------- Teams ----------
let TEAM_LABELS = {}; // idx -> label, filled by loadTeams (for confirm dialogs)
let TEAM_SELECTED = new Set(); // idx ticked for bulk delete
function renderTeamSelectBar() {
const bar = document.getElementById('bulkDelBar');
if (!bar) return;
const n = TEAM_SELECTED.size;
if (!n) { bar.style.display = 'none'; bar.innerHTML = ''; return; }
const names = [...TEAM_SELECTED].sort((a, b) => a - b)
.map(i => `#${i} ${esc(TEAM_LABELS[i] || '')}`).join(', ');
bar.style.display = 'block';
bar.innerHTML =
`<div style="display:flex;align-items:center;gap:10px;flex-wrap:wrap">
<b style="color:#f6ad55">${n} tim dipilih</b>
<span style="color:#a0aec0;font-size:12px">${esc(names)}</span>
<button class="danger" onclick="bulkDeleteTeams()">🗑️ Hapus ${n} Tim Sekaligus</button>
<button onclick="clearTeamSelection()">Batalkan pilihan</button>
</div>`;
}
function toggleTeamSelect(idx, on) {
if (on) TEAM_SELECTED.add(idx); else TEAM_SELECTED.delete(idx);
const cb = document.getElementById(`teamSel${idx}`);
if (cb) cb.checked = on;
renderTeamSelectBar();
}
function selectAllTeams(on) {
TEAM_SELECTED.clear();
if (on) for (const k of Object.keys(TEAM_LABELS)) TEAM_SELECTED.add(Number(k));
for (const k of Object.keys(TEAM_LABELS)) {
const cb = document.getElementById(`teamSel${k}`);
if (cb) cb.checked = on && TEAM_SELECTED.has(Number(k));
}
renderTeamSelectBar();
}
function clearTeamSelection() { selectAllTeams(false); }
async function bulkDeleteTeams() {
const idx = [...TEAM_SELECTED].sort((a, b) => a - b);
if (!idx.length) { toast('Pilih minimal satu tim dulu', true); return; }
const names = idx.map(i => `#${i} ${TEAM_LABELS[i] || ''}`).join(', ');
if (!confirm(
`🗑️ HAPUS ${idx.length} TIM SEKALIGUS?\n\n${names}\n\n` +
`Yang akan dihapus (semua tim di atas):\n` +
`• Semua container challenge\n• Receiver + systemd unit\n` +
`• Folder team (port, flag, kredensial)\n• Port firewall UFW\n` +
`• Domain Traefik\n• Skor & riwayat leaderboard\n\n` +
`⚠️ TIDAK BISA dibatalkan.`)) return;
showLoading(`Menghapus ${idx.length} tim (${names})…<br>Compose down 16 service per tim, bisa beberapa menit`);
try {
const d = await api('/api/teams/bulk-delete', {
method: 'POST', headers: {'Content-Type': 'application/json'},
body: JSON.stringify({indices: idx, purge_scores: true})
});
// One team takes ~100s, so poll a single job instead of blocking here.
const final = await pollJob(`/api/teams/bulk-delete/${d.job}`, 1500);
const done = final.done || [];
const errs = final.errors || {};
let msg = `Terhapus ${done.length}/${idx.length} tim`;
if (Object.keys(errs).length) msg += ` · gagal: ${Object.keys(errs).join(', ')}`;
const purged = done.reduce((a, x) =>
a + Object.values(x.purged || {}).reduce((p, q) => p + q, 0), 0);
if (purged) msg += ` · ${purged} skor dibersihkan`;
toast(msg, Object.keys(errs).length > 0);
TEAM_SELECTED.clear();
loadTeams();
if (document.getElementById('view-topo').classList.contains('active')) loadTopo();
} catch (e) { toast('Bulk delete gagal: ' + e.message, true); }
finally { hideLoading(); }
}
async function pollJob(url, everyMs) {
for (;;) {
const j = await api(url);
if (j.state !== 'running') return j;
const el = document.querySelector('#loadingText');
if (el && j.detail) el.innerHTML = `${esc(j.detail)}…<br><span style="font-size:11px">${esc(url.split('/').pop())}</span>`;
await new Promise(r => setTimeout(r, everyMs));
}
}
async function loadTeams() { async function loadTeams() {
try { try {
const d = await api('/api/teams'); const d = await api('/api/teams');
document.getElementById('teamCount').value = d.teams.length; document.getElementById('teamCount').value = d.teams.length;
loadLeaderboard(); loadLeaderboard();
TEAM_LABELS = {};
for (const t of d.teams) TEAM_LABELS[t.index] = t.label || ('Team ' + t.index);
// drop selections for teams that no longer exist
for (const i of [...TEAM_SELECTED]) if (!(i in TEAM_LABELS)) TEAM_SELECTED.delete(i);
const grid = document.getElementById('teamsGrid'); const grid = document.getElementById('teamsGrid');
if (!d.teams.length) { grid.innerHTML = '<div class="card"><span style="color:#718096">Belum ada team. Set jumlah team untuk auto-create.</span></div>'; return; } if (!d.teams.length) { grid.innerHTML = '<div class="card"><span style="color:#718096">Belum ada team. Set jumlah team untuk auto-create.</span></div>'; renderTeamSelectBar(); return; }
let html = ''; let html = '';
for (const t of d.teams) { for (const t of d.teams) {
const alive = t.status === 'running'; const alive = t.status === 'running';
const dom = t.domain || ''; const dom = t.domain || '';
const sel = TEAM_SELECTED.has(t.index);
html += `<div class="card ${alive ? '' : 'dead'}"> html += `<div class="card ${alive ? '' : 'dead'}">
<div class="team-head"> <div class="team-head">
<span class="ch-name">${esc(t.label || ('Team ' + t.index))}</span> <label style="display:flex;align-items:center;gap:6px;cursor:pointer;user-select:none" title="Pilih untuk hapus massal">
<input type="checkbox" id="teamSel${t.index}" ${sel ? 'checked' : ''}
onchange="toggleTeamSelect(${t.index}, this.checked)">
<span class="ch-name">${esc(t.label || ('Team ' + t.index))}</span>
</label>
<span class="status ${alive ? 'up' : 'down'}">${alive ? '● RUNNING' : '● STOPPED'}</span> <span class="status ${alive ? 'up' : 'down'}">${alive ? '● RUNNING' : '● STOPPED'}</span>
</div> </div>
<div class="kv"> <div class="kv">
<b>Receiver</b><span>${t.ports.receiver}</span> <b>Receiver</b><span>${t.ports.receiver}</span>
<b>Admin</b><span>${esc(t.admin_user)}</span> <b>Admin</b><span>${esc(t.admin_user)}</span>
<b>SSH user</b><span>ctfuser</span> <b>SSH user</b><span>ctfuser</span>
<b>Status</b><span>${esc(t.status)}</span>${dom ? `<b>Domain</b><span><a href="https://${esc(dom)}/team/${t.index}" target="_blank" style="color:#5ad1ff">${esc(dom)} →</a></span>` : ''} <b>Status</b><span>${esc(t.status)}</span>${dom ? `<b>Domain</b><span><a href="https://${esc(dom)}" target="_blank" style="color:#5ad1ff">${esc(dom)} →</a></span>` : ''}
</div> </div>
<div class="btn-row"> <div class="btn-row">
<button class="primary" onclick="startTeam(${t.index})">▶ Start</button> <button class="primary" onclick="startTeam(${t.index})">▶ Start</button>
<button class="danger" onclick="stopTeam(${t.index})">⏹ Stop</button> <button class="danger" onclick="stopTeam(${t.index})">⏹ Stop</button>
<button onclick="viewTeamCred(${t.index})">🔑 SSH & Pass</button> <button onclick="viewTeamCred(${t.index})">🔑 SSH & Pass</button>
<button onclick="editTeam(${t.index})">✏️ Edit Nama/Domain</button>
<button onclick="openTeamLogs(${t.index})">📜 Logs</button> <button onclick="openTeamLogs(${t.index})">📜 Logs</button>
<button onclick="randomizeTeam(${t.index})">🎲 Randomize Flag</button> <button onclick="randomizeTeam(${t.index})">🎲 Randomize Flag</button>
<button class="danger" onclick="deleteTeam(${t.index})">🗑️ Hapus Team</button>
</div> </div>
</div>`; </div>`;
} }
grid.innerHTML = html; grid.innerHTML = html;
renderTeamSelectBar();
} catch (e) { toast('Teams gagal: ' + e.message, true); } } catch (e) { toast('Teams gagal: ' + e.message, true); }
} }
async function setTeams() { async function setTeams() {
const n = parseInt(document.getElementById('teamCount').value || '0', 10); const n = parseInt(document.getElementById('teamCount').value || '0', 10);
const labels = {}; const labels = {}, domains = {};
for (let i = 1; i <= n; i++) { for (let i = 1; i <= n; i++) {
const inp = document.getElementById('teamNameInputs')?.querySelector(`input[data-idx="${i}"]`); const inpN = document.getElementById('teamNameInputs')?.querySelector(`input[data-idx="${i}"][data-field="name"]`);
if (inp && inp.value.trim()) labels[i] = inp.value.trim(); if (inpN && inpN.value.trim()) labels[i] = inpN.value.trim();
const inpD = document.getElementById('teamNameInputs')?.querySelector(`input[data-idx="${i}"][data-field="domain"]`);
if (inpD && inpD.value.trim()) domains[i] = inpD.value.trim();
} }
try { try {
const d = await api('/api/teams/set', {method:'POST', headers:{'Content-Type':'application/json'}, body: JSON.stringify({count: n, labels})}); showLoading(`Membuat ${n} team…<br>Generate compose, flags, domain, Traefik config`);
const d = await api('/api/teams/set', {method:'POST', headers:{'Content-Type':'application/json'}, body: JSON.stringify({count: n, labels, domains})});
toast(`Team dibuat: ${d.created.join(', ') || 'tidak ada yang baru'} · total ${d.total}`, false); toast(`Team dibuat: ${d.created.join(', ') || 'tidak ada yang baru'} · total ${d.total}`, false);
loadTeams(); loadTeams();
} catch (e) { toast(e.message, true); } } catch (e) { toast(e.message, true); }
finally { hideLoading(); }
} }
function teamCountChanged() { function teamCountChanged() {
const n = parseInt(document.getElementById('teamCount').value || '0', 10); const n = parseInt(document.getElementById('teamCount').value || '0', 10);
const box = document.getElementById('teamNameInputs'); const box = document.getElementById('teamNameInputs');
let html = ''; let html = '<div style="font-size:11px;color:#718096;margin-bottom:4px">Nama team & domain custom (opsional — kosongkan untuk auto dari nama)</div>';
for (let i = 1; i <= n; i++) { for (let i = 1; i <= n; i++) {
html += `<div style="display:flex;align-items:center;gap:8px"> html += `<div style="display:flex;align-items:center;gap:6px">
<span style="color:#718096;font-size:12px;width:60px">Team ${i}</span> <span style="color:#718096;font-size:12px;width:60px">Team ${i}</span>
<input data-idx="${i}" placeholder="Nama team (jd domain: nama.gemastik.imrnes.team)" style="flex:1"> <input data-idx="${i}" data-field="name" placeholder="Nama team (contoh: Cyber Warriors)" style="flex:1;min-width:120px">
<input data-idx="${i}" data-field="domain" placeholder="domain custom (contoh: team-cyber)" style="flex:1;min-width:120px">
<span style="color:#3b4a63;font-size:11px">.attackdefense.imrnes.team</span>
</div>`; </div>`;
} }
box.innerHTML = html; box.innerHTML = html;
} }
async function editTeam(idx) {
// fetch current team info
let t = null;
try { t = (await api(`/api/team/${idx}/creds`)).team; } catch (e) { toast('Gagal ambil data team', true); return; }
const newLabel = prompt(`✏️ Nama team ${idx} (sekarang: ${t.label || ('Team ' + idx)}):`, t.label || '');
if (newLabel === null) return;
const newDomain = prompt(`🌐 Domain custom team ${idx} (sekarang: ${t.domain || ''} — ketik subdomain saja, contoh: team-cyber):`, (t.domain || '').split('.')[0]);
if (newDomain === null) return;
try {
showLoading('Update nama/domain team…');
const d = await api(`/api/teams/${idx}`, {method:'PUT', headers:{'Content-Type':'application/json'}, body: JSON.stringify({label: newLabel.trim(), domain: newDomain.trim()})});
toast(`Team ${idx} diupdate: ${d.team.label} @ ${d.team.domain}`, false);
loadTeams();
if (document.getElementById('view-topo').classList.contains('active')) loadTopo();
} catch (e) { toast(e.message, true); }
finally { hideLoading(); }
}
async function startTeam(idx) { async function startTeam(idx) {
try { await api('/api/teams/start', {method:'POST', headers:{'Content-Type':'application/json'}, body: JSON.stringify({index: idx})}); toast(`Team ${idx} start (build bisa makan waktu)`, false); setTimeout(loadTeams, 3000); } const ov = showLoading(`Menyiapkan Team ${idx}…<br>Membangun & start container (bisa butuh 1-3 menit)`);
try { await api('/api/teams/start', {method:'POST', headers:{'Content-Type':'application/json'}, body: JSON.stringify({index: idx})}); toast(`Team ${idx} start`, false); }
catch (e) { toast(e.message, true); } catch (e) { toast(e.message, true); }
finally { hideLoading(); setTimeout(loadTeams, 2500); }
} }
async function stopTeam(idx) { async function stopTeam(idx) {
const ov = showLoading(`Menghentikan Team ${idx}…`);
try { await api('/api/teams/stop', {method:'POST', headers:{'Content-Type':'application/json'}, body: JSON.stringify({index: idx})}); toast(`Team ${idx} stop`, false); loadTeams(); } try { await api('/api/teams/stop', {method:'POST', headers:{'Content-Type':'application/json'}, body: JSON.stringify({index: idx})}); toast(`Team ${idx} stop`, false); loadTeams(); }
catch (e) { toast(e.message, true); } catch (e) { toast(e.message, true); }
finally { hideLoading(); }
} }
async function startAllTeams() { async function startAllTeams() {
const ov = showLoading('Start SEMUA team…<br>Ini bisa butuh beberapa menit (build + boot + set password)');
try { const d = await api('/api/teams/start', {method:'POST', headers:{'Content-Type':'application/json'}, body: JSON.stringify({})}); toast(`Start semua: ${d.results.filter(r=>r.ok).length}/${d.results.length} ok`, false); setTimeout(loadTeams, 4000); } try { const d = await api('/api/teams/start', {method:'POST', headers:{'Content-Type':'application/json'}, body: JSON.stringify({})}); toast(`Start semua: ${d.results.filter(r=>r.ok).length}/${d.results.length} ok`, false); setTimeout(loadTeams, 4000); }
catch (e) { toast(e.message, true); } catch (e) { toast(e.message, true); }
finally { hideLoading(); }
} }
async function stopAllTeams() { async function stopAllTeams() {
const ov = showLoading('Menghentikan SEMUA team…');
try { const d = await api('/api/teams/stop', {method:'POST', headers:{'Content-Type':'application/json'}, body: JSON.stringify({})}); toast(`Stop semua: ${d.results.filter(r=>r.ok).length}/${d.results.length} ok`, false); loadTeams(); } try { const d = await api('/api/teams/stop', {method:'POST', headers:{'Content-Type':'application/json'}, body: JSON.stringify({})}); toast(`Stop semua: ${d.results.filter(r=>r.ok).length}/${d.results.length} ok`, false); loadTeams(); }
catch (e) { toast(e.message, true); } catch (e) { toast(e.message, true); }
finally { hideLoading(); }
}
async function resetScores() {
if (!confirm('⚠️ Apakah anda yakin ingin mereset skor?\n\nSemua poin & solve di leaderboard akan DIHAPUS.\nTindakan ini tidak bisa dibatalkan.')) return;
showLoading('Menghapus semua skor…');
try {
const d = await api('/api/reset/scores', {method:'POST', headers:{'Content-Type':'application/json'}, body: '{}'});
toast('Skor direset: semua solve dihapus', false);
} catch (e) { toast(e.message, true); }
finally { hideLoading(); }
}
async function resetEnv() {
if (!confirm('⚠️ Apakah anda yakin ingin mereset environment?\n\nSEMUA team akan DISTOP:\n• Container challenge dihapus\n• Receiver team dihapus\n• Folder team dihapus (perlu create ulang)\n• Skor leaderboard direset\n\nTindakan ini TIDAK BISA dibatalkan.')) return;
showLoading('Reset environment…\nMenghentikan semua team + menghapus container/receiver (beberapa menit)');
try {
const d = await api('/api/reset/environment', {method:'POST', headers:{'Content-Type':'application/json'}, body: '{}'});
const n = (d.stopped || []).length;
toast(`Environment direset: ${n} team dihentikan & dihapus`, false);
setTimeout(() => location.reload(), 1200);
} catch (e) { toast(e.message, true); }
finally { hideLoading(); }
} }
async function randomizeTeam(idx) { async function randomizeTeam(idx) {
@@ -495,6 +865,38 @@ async function randomizeTeam(idx) {
} catch (e) { toast(e.message, true); } } catch (e) { toast(e.message, true); }
} }
async function deleteTeam(idx) {
// Per-team delete. Deliberately NOT the same as resetEnv: this removes ONE
// team (containers, network, receiver unit, ports, dir, domain) and leaves
// the other teams untouched.
const label = TEAM_LABELS[idx] || ('Team ' + idx);
if (!confirm(
`🗑️ HAPUS PERMANEN Team ${idx} (${label})?\n\n` +
`Yang akan dihapus:\n` +
`• Semua container challenge team ini\n` +
`• Receiver team + systemd unit\n` +
`• Folder team (port, flag, kredensial)\n` +
`• Port firewall UFW team ini\n` +
`• Domain ${label}.attackdefense.imrnes.team\n` +
`• Skor & riwayat di leaderboard\n\n` +
`Tindakan ini TIDAK BISA dibatalkan.\n` +
`Team lain tidak terpengaruh.`)) return;
// second gate: type the team number to confirm
if (prompt(`Ketik angka ${idx} untuk konfirmasi hapus:`)?.trim() !== String(idx)) {
toast('Dibatalkan', false);
return;
}
showLoading(`Menghapus Team ${idx} (${label})…<br>Stop container + receiver, hapus port & domain`);
try {
const d = await api(`/api/teams/${idx}`, {method:'DELETE', headers:{'Content-Type':'application/json'}, body: JSON.stringify({purge_scores: true})});
const n = (d.purged ? Object.values(d.purged).reduce((a, b) => a + b, 0) : 0);
toast(`Team ${idx} (${label}) dihapus: ${(d.steps || []).join(' · ')}${n ? ` · ${n} skor dibersihkan` : ''}`, false);
loadTeams();
if (document.getElementById('view-topo').classList.contains('active')) loadTopo();
} catch (e) { toast('Hapus team gagal: ' + e.message, true); }
finally { hideLoading(); }
}
async function loadLeaderboard() { async function loadLeaderboard() {
try { try {
const d = await api('/api/leaderboard'); const d = await api('/api/leaderboard');
@@ -522,7 +924,7 @@ async function viewTeamCred(idx) {
for (const [name, p] of Object.entries(t.team.ports)) { for (const [name, p] of Object.entries(t.team.ports)) {
if (name === 'receiver' || name === 'panel') continue; if (name === 'receiver' || name === 'panel') continue;
html += `<div class="kv" style="margin-top:6px"> html += `<div class="kv" style="margin-top:6px">
<b>${name}</b><span>ssh ctfuser@${name}.gemastik.imrnes.team -p ${p.ssh} &nbsp;·&nbsp; pass: ${esc(t.team.chall_passwords[name])}</span> <b>${name}</b><span>ssh ctfuser@${name}.attackdefense.imrnes.team -p ${p.ssh} &nbsp;·&nbsp; pass: ${esc(t.team.chall_passwords[name])}</span>
</div>`; </div>`;
} }
document.getElementById('mtcTitle').textContent = `Kredensial Team ${idx}`; document.getElementById('mtcTitle').textContent = `Kredensial Team ${idx}`;
@@ -584,6 +986,27 @@ async function loadCreds() {
} catch (e) { toast(e.message, true); } } catch (e) { toast(e.message, true); }
} }
// ---------- Target Matrix ----------
async function loadTargetMatrix() {
const box = document.getElementById('targetMatrix');
try {
const d = await api('/api/targets');
const targets = d.targets || [];
if (!targets.length) { box.textContent = 'Belum ada team.'; return; }
// group by team
const rows = [];
let curTeam = null;
for (const t of targets) {
if (t.team !== curTeam) {
rows.push(`\n[${esc(t.team_label || ('Team ' + t.team))}]`);
curTeam = t.team;
}
rows.push(` ${esc(t.domain)}:${t.port} (${esc(t.challenge)})`);
}
box.textContent = rows.join('\n');
} catch (e) { box.textContent = 'Gagal: ' + e.message; }
}
// ---------- misc ---------- // ---------- misc ----------
function closeModal(id) { document.getElementById(id).classList.remove('open'); } function closeModal(id) { document.getElementById(id).classList.remove('open'); }
async function logout() { async function logout() {
panel/static/login.html
+2 -2
View File
@@ -3,7 +3,7 @@
<head> <head>
<meta charset="UTF-8"> <meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Gemastik A/D Panel — Login</title> <title>Attack Defense Platform — Login</title>
<style> <style>
* { margin:0; padding:0; box-sizing:border-box; } * { margin:0; padding:0; box-sizing:border-box; }
body { body {
@@ -34,7 +34,7 @@
</head> </head>
<body> <body>
<div class="card"> <div class="card">
<h1>⚔️ GEMASTIK A/D</h1> <h1>⚔️ ATTACK DEFENSE</h1>
<div class="sub">Node Control Panel — imrnes</div> <div class="sub">Node Control Panel — imrnes</div>
<form id="f"> <form id="f">
<label>Username</label> <label>Username</label>
panel/static/submit.html
+1 -1
View File
@@ -41,7 +41,7 @@
<div class="logo">G</div> <div class="logo">G</div>
<div> <div>
<h1>Gemastik XVIII — Attack &amp; Defense</h1> <h1>Gemastik XVIII — Attack &amp; Defense</h1>
<div class="sub">Submit flag untuk tim kamu. Server: gemastik.imrnes.team</div> <div class="sub">Submit flag untuk tim kamu. Server: attackdefense.imrnes.team</div>
</div> </div>
</header> </header>
panel/static/team.html
+475 -56
View File
@@ -3,17 +3,21 @@
<head> <head>
<meta charset="UTF-8"> <meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Portal Team — Gemastik A/D</title> <meta name="team-id" content="0">
<title>Portal Tim — Attack Defense Platform</title>
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/xterm@5.3.0/css/xterm.min.css">
<script src="https://cdn.jsdelivr.net/npm/xterm@5.3.0/lib/xterm.min.js"></script>
<style> <style>
:root { --bg:#0b0e14; --panel:#151a23; --panel2:#1d2430; --line:#2a3444; --txt:#e6edf3; --dim:#8b98a9; --accent:#38bdf8; --green:#34d399; --red:#f87171; } :root { --bg:#0b0e14; --panel:#151a23; --panel2:#1d2430; --line:#2a3444; --txt:#e6edf3; --dim:#8b98a9; --accent:#38bdf8; --green:#34d399; --red:#f87171; --purple:#a78bfa; }
* { margin:0; padding:0; box-sizing:border-box; } * { margin:0; padding:0; box-sizing:border-box; }
body { background:var(--bg); color:var(--txt); font-family:'Segoe UI',system-ui,sans-serif; min-height:100vh; } body { background:var(--bg); color:var(--txt); font-family:'Segoe UI',system-ui,sans-serif; min-height:100vh; }
.wrap { max-width:900px; margin:0 auto; padding:24px 16px 60px; } .wrap { max-width:1000px; margin:0 auto; padding:24px 16px 60px; }
header { display:flex; align-items:center; gap:12px; margin-bottom:24px; flex-wrap:wrap; } header { display:flex; align-items:center; gap:12px; margin-bottom:24px; flex-wrap:wrap; }
.logo { width:42px; height:42px; border-radius:10px; background:linear-gradient(135deg,#38bdf8,#6366f1); display:flex; align-items:center; justify-content:center; font-weight:800; font-size:20px; color:#fff; } .logo { width:42px; height:42px; border-radius:10px; background:linear-gradient(135deg,#38bdf8,#6366f1); display:flex; align-items:center; justify-content:center; font-weight:800; font-size:20px; color:#fff; }
h1 { font-size:22px; } h1 { font-size:22px; }
.sub { color:var(--dim); font-size:13px; } .sub { color:var(--dim); font-size:13px; }
.badge { background:#06352a; border:1px solid var(--green); color:var(--green); border-radius:20px; padding:3px 12px; font-size:12px; font-weight:600; } .badge { background:#06352a; border:1px solid var(--green); color:var(--green); border-radius:20px; padding:3px 12px; font-size:12px; font-weight:600; }
.badge.stopped { background:#3a1414; border-color:var(--red); color:var(--red); }
.card { background:var(--panel); border:1px solid var(--line); border-radius:14px; padding:20px; margin-bottom:16px; } .card { background:var(--panel); border:1px solid var(--line); border-radius:14px; padding:20px; margin-bottom:16px; }
.card h2 { font-size:15px; margin-bottom:12px; color:var(--accent); } .card h2 { font-size:15px; margin-bottom:12px; color:var(--accent); }
.kv { display:grid; grid-template-columns:150px 1fr; gap:6px 12px; font-size:13px; margin-bottom:4px; } .kv { display:grid; grid-template-columns:150px 1fr; gap:6px 12px; font-size:13px; margin-bottom:4px; }
@@ -25,13 +29,60 @@
.dot { display:inline-block; width:8px; height:8px; border-radius:50%; margin-right:6px; } .dot { display:inline-block; width:8px; height:8px; border-radius:50%; margin-right:6px; }
.dot.up { background:var(--green); } .dot.down { background:var(--red); } .dot.up { background:var(--green); } .dot.down { background:var(--red); }
label { display:block; font-size:12px; color:var(--dim); margin:12px 0 5px; } label { display:block; font-size:12px; color:var(--dim); margin:12px 0 5px; }
select, input { width:100%; padding:10px 12px; border-radius:8px; border:1px solid var(--line); background:var(--panel2); color:var(--txt); font-size:14px; } select, input[type=text], input[type=password] { width:100%; padding:10px 12px; border-radius:8px; border:1px solid var(--line); background:var(--panel2); color:var(--txt); font-size:14px; }
button { margin-top:16px; width:100%; padding:12px; border:none; border-radius:8px; background:linear-gradient(135deg,#38bdf8,#6366f1); color:#fff; font-weight:600; font-size:15px; cursor:pointer; } button { padding:12px 16px; border:none; border-radius:8px; background:linear-gradient(135deg,#38bdf8,#6366f1); color:#fff; font-weight:600; font-size:14px; cursor:pointer; }
button:hover { filter:brightness(1.1); } button:hover { filter:brightness(1.1); }
button.ghost { background:var(--panel2); border:1px solid var(--line); color:var(--txt); }
#result { margin-top:14px; padding:12px; border-radius:8px; display:none; font-size:14px; } #result { margin-top:14px; padding:12px; border-radius:8px; display:none; font-size:14px; }
#result.ok { display:block; background:#06352a; border:1px solid var(--green); color:var(--green); } #result.ok { display:block; background:#06352a; border:1px solid var(--green); color:var(--green); }
#result.err { display:block; background:#3a1414; border:1px solid var(--red); color:var(--red); } #result.err { display:block; background:#3a1414; border:1px solid var(--red); color:var(--red); }
.sshbox { background:var(--panel2); border:1px solid var(--line); border-radius:8px; padding:10px 12px; font-family:ui-monospace,monospace; font-size:12px; overflow-x:auto; } .sshbox { background:var(--panel2); border:1px solid var(--line); border-radius:8px; padding:10px 12px; font-family:ui-monospace,monospace; font-size:12px; overflow-x:auto; }
/* login */
#loginScreen { max-width:420px; margin:80px auto; }
#loginScreen .card { padding:32px; }
#loginScreen h2 { text-align:center; margin-bottom:6px; }
#loginScreen .hint { text-align:center; color:var(--dim); font-size:12px; margin-bottom:18px; }
.login-err { color:var(--red); font-size:13px; margin-top:10px; display:none; }
/* tabs */
.tabs { display:flex; gap:8px; margin-bottom:16px; flex-wrap:wrap; }
.tabs button { background:var(--panel2); border:1px solid var(--line); color:var(--dim); font-weight:500; }
.tabs button.active { background:linear-gradient(135deg,#38bdf8,#6366f1); color:#fff; border-color:transparent; }
.view { display:none; }
.view.active { display:block; }
/* terminal */
#termWrap { background:#0d1117; border:1px solid var(--line); border-radius:10px; padding:8px; height:480px; }
#term { height:100%; }
.term-toolbar { display:flex; gap:8px; align-items:center; margin-bottom:10px; flex-wrap:wrap; }
#termStatus { font-size:12px; color:var(--dim); }
code { background:var(--panel2); padding:2px 6px; border-radius:5px; font-size:12px; }
.guide h3 { color:var(--purple); margin:18px 0 8px; font-size:14px; }
.guide p, .guide li { font-size:13px; color:#c9d4e3; line-height:1.7; }
.guide ol, .guide ul { padding-left:20px; }
.login-note { font-size:12px; color:var(--dim); margin-top:14px; text-align:center; }
.login-note a { color:var(--accent); }
/* activity feed */
.feed { display:flex; flex-direction:column; gap:10px; max-height:420px; overflow-y:auto; }
.feed-item { background:var(--panel2); border:1px solid var(--line); border-left:3px solid var(--line); border-radius:10px; padding:10px 14px; font-size:13px; line-height:1.5; }
.feed-item.in { border-left-color:var(--red); }
.feed-item.out { border-left-color:var(--green); }
.feed-item.ok { border-left-color:var(--green); }
.feed-item.fail { border-left-color:var(--red); }
.feed-time { color:var(--dim); font-size:11px; margin-left:8px; }
.feed-tag { font-size:11px; border-radius:5px; padding:1px 7px; margin-right:6px; font-weight:700; }
.tag-in { background:#3a1414; color:var(--red); }
.tag-out { background:#06352a; color:var(--green); }
code { background:var(--panel2); padding:2px 6px; border-radius:5px; font-size:12px; }
.lb-row { display:flex; align-items:center; gap:12px; padding:10px 12px; border-bottom:1px solid var(--line); font-size:14px; }
.lb-row.me { background:rgba(56,189,248,.08); border-left:3px solid var(--accent); }
.lb-rank { width:28px; font-weight:800; color:var(--dim); }
.lb-name { flex:1; font-weight:600; }
.lb-name small { color:var(--dim); font-weight:400; margin-left:6px; }
.lb-solves { background:var(--panel2); border:1px solid var(--line); border-radius:20px; padding:3px 12px; font-size:12px; color:var(--green); }
.lb-empty { color:var(--dim); font-size:13px; padding:20px; text-align:center; }
.svc-health { display:flex; flex-wrap:wrap; gap:8px; margin-top:12px; }
.svc-chip { border:1px solid var(--line); border-radius:8px; padding:4px 10px; font-size:12px; background:var(--panel2); }
.svc-chip.up { border-color:var(--green); color:var(--green); }
.svc-chip.down { border-color:var(--red); color:var(--red); }
</style> </style>
</head> </head>
<body> <body>
@@ -43,70 +94,308 @@
<div class="sub" id="teamDomain"></div> <div class="sub" id="teamDomain"></div>
</div> </div>
<span class="badge" id="teamStatus">…</span> <span class="badge" id="teamStatus">…</span>
<button class="ghost" id="logoutBtn" style="display:none" onclick="logout()">Keluar</button>
</header> </header>
<div class="card"> <!-- LOGIN -->
<h2>🌐 Akses Server Tim Kamu</h2> <div id="loginScreen">
<div id="accessBox" class="sshbox">Memuat…</div> <div class="card">
<div style="margin-top:12px;font-size:12px;color:var(--dim)"> <h2>🔐 Login Portal Tim</h2>
Tiap challenge punya port sendiri. SSH login: <b>ctfuser</b> + password dari panel panitia. <div class="hint" id="loginHint">Masukkan <b>password SSH tim</b> kamu (dari panitia)</div>
<label>Password Tim</label>
<input type="password" id="loginPass" placeholder="password SSH tim" autocomplete="off">
<button onclick="doLogin()" style="width:100%;margin-top:16px">Masuk Portal</button>
<div class="login-err" id="loginErr"></div>
<div class="login-note">Belum punya password? Hubungi panitia.<br>Tutorial SSH: <a href="/team/0/guide" data-guide-link>baca panduan</a></div>
</div> </div>
</div> </div>
<div class="card"> <!-- PORTAL -->
<h2>📊 Status Challenge</h2> <div id="portalScreen" style="display:none">
<table> <div class="tabs">
<thead><tr><th>Challenge</th><th>Port</th><th>SSH</th><th>Status</th></tr></thead> <button data-view="term" onclick="showView('term')">🖥️ Terminal SSH</button>
<tbody id="statusBody"></tbody> <button data-view="targets" onclick="showView('targets')">🎯 Target Musuh</button>
</table> <button data-view="submit" onclick="showView('submit')">🚩 Submit Flag</button>
</div> <button data-view="activity" onclick="showView('activity')">📡 Aktivitas</button>
<button data-view="leaderboard" onclick="showView('leaderboard')">🏆 Leaderboard</button>
<button data-view="sla" onclick="showView('sla'); loadSla()">📊 SLA & Skor</button>
<button data-view="guide" onclick="showView('guide')">📖 Panduan SSH</button>
</div>
<div class="card"> <div class="view active" id="view-term">
<h2>🚩 Submit Flag</h2> <div class="card">
<label>Challenge</label> <h2>🖥️ SSH Terminal — pilih challenge</h2>
<select id="challenge"> <div class="term-toolbar">
<option value="blogpost">blogpost (web)</option> <select id="termChall" style="width:200px" onchange="connectTerm()"></select>
<option value="carbeat">carbeat (pwn)</option> <button class="ghost" onclick="connectTerm()">🔄 Sambung</button>
<option value="cdn">cdn (web)</option> <span id="termStatus">Belum tersambung</span>
<option value="phew">phew (crypto)</option> </div>
<option value="sheesh">sheesh (crypto)</option> <div id="termWrap"><div id="term"></div></div>
<option value="warmup">warmup</option> <div style="margin-top:10px;font-size:12px;color:var(--dim)">
</select> SSH otomatis login ke container challenge timmu. User <b>ctfuser</b> untuk 6 challenge native GEMASTIK XVIII, <b>root</b> untuk challenge XVI/XVII hasil import — user shown di dropdown. Koneksi diputus setelah idle.
<label>Flag</label> </div>
<input id="flag" placeholder="GEMASTIK18{...}" autocomplete="off"> </div>
<button onclick="submitFlag()">Submit Flag</button> </div>
<div id="result"></div>
<div class="view" id="view-targets">
<div class="card">
<h2>🎯 Target Musuh</h2>
<p style="font-size:13px;color:var(--dim);margin-bottom:12px">Service challenge tim lain — inilah yang harus kamu attack & curi flagnya.</p>
<div id="targetList" class="sshbox">Memuat…</div>
</div>
</div>
<div class="view" id="view-submit">
<div class="card">
<h2>🚩 Submit Flag</h2>
<label>Challenge</label>
<select id="challenge">
<option value="blogpost">blogpost (web)</option>
<option value="carbeat">carbeat (pwn)</option>
<option value="cdn">cdn (web)</option>
<option value="phew">phew (crypto)</option>
<option value="sheesh">sheesh (crypto)</option>
<option value="warmup">warmup</option>
</select>
<label>Target (tim musuh yang diserang)</label>
<select id="target">
<option value="">Memuat target…</option>
</select>
<label>Flag (yang kamu curi dari target)</label>
<input type="text" id="flag" placeholder="GEMASTIK18{...}" autocomplete="off">
<button onclick="submitFlag()" style="width:100%;margin-top:16px">Submit Flag</button>
<div id="result"></div>
</div>
</div>
<div class="view" id="view-activity">
<div class="card">
<h2>📡 Aktivitas &amp; Serangan</h2>
<p style="font-size:13px;color:var(--dim);margin-bottom:12px">
🔴 <b>masuk</b> = ada yang menyerang service timmu · 🟢 <b>keluar</b> = kamu menyerang tim lain.
Update otomatis tiap 15 detik.
</p>
<div id="activityFeed" class="feed"><div class="lb-empty">Memuat aktivitas…</div></div>
<div class="svc-health" id="svcHealth"></div>
</div>
</div>
<div class="view" id="view-leaderboard">
<div class="card">
<h2>🏆 Leaderboard</h2>
<p style="font-size:13px;color:var(--dim);margin-bottom:12px">Papan skor flag yang berhasil dicuri. Kamu = baris biru.</p>
<div id="lbList"></div>
</div>
</div>
<div class="view" id="view-sla">
<div class="card">
<h2>📊 SLA & Skor Tim</h2>
<p style="font-size:13px;color:var(--dim);margin-bottom:12px">
💚 <b>SLA</b> = service timmu hidup (dicek tiap ~30 detik) · 🏆 <b>poin</b> = dapat dari mencuri flag lawan (+100/flag) & bonus SLA saat seluruh service UP (+50).
</p>
<div id="slaList"><div class="lb-empty">Memuat…</div></div>
</div>
</div>
<div class="view" id="view-guide">
<div class="card guide">
<h2>📖 Panduan SSH & Attack</h2>
<h3>1. Apa itu SSH di sini?</h3>
<p>Setiap challenge punya service yang harus kamu <b>pertahankan</b> (defense) dan service tim lain yang harus kamu <b>serang</b> (attack). SSH container adalah akses administratif ke challenge tim kamu — untuk riset, patch, atau recovery.</p>
<h3>2. Login via Web Terminal</h3>
<ol>
<li>Buka tab <b>🖥️ Terminal SSH</b>.</li>
<li>Pilih challenge (misal <code>blogpost</code>) — user SSH-nya tercetak di dropdown.</li>
<li>Klik <b>Sambung</b> — otomatis login sebagai user yang tertera.</li>
</ol>
<h3>3. Login via SSH biasa (opsional)</h3>
<div class="sshbox">ssh &lt;USER&gt;@43.134.105.109 -p &lt;PORT_SSH&gt;
# user: ctfuser (XVIII native) atau root (XVI/XVII import)
# password = password tim kamu</div>
<h3>4. Command yang berguna</h3>
<ul>
<li><code>cat /flag.txt</code> — flag <b>tim kamu sendiri</b> (jangan bocorin!)</li>
<li><code>ls /app /srv /opt</code> — cari source code challenge</li>
<li><code>ps aux</code> — lihat proses service</li>
<li><code>cat /flag.txt | nc &lt;ip_tim_lawan&gt; &lt;port_chall&gt;</code> — kirim flag kamu 🤫</li>
</ul>
<h3>5. Alur Attack</h3>
<ol>
<li>Cari vuln di challenge (SSTI, path traversal, crypto oracle, dll).</li>
<li>Exploit service <b>tim lawan</b> — lihat tab <b>🎯 Target Musuh</b>.</li>
<li>Baca flag dari container/service lawan.</li>
<li>Submit flag di tab <b>🚩 Submit Flag</b> → dapat poin.</li>
</ol>
<h3>6. Aturan</h3>
<ul>
<li>Jangan ubah flag tim sendiri (mount read-only).</li>
<li>Jangan matikan service tim sendiri — SLA dicek panitia.</li>
<li>Flag yang valid: <code>GEMASTIK18{...}</code>.</li>
</ul>
</div>
</div>
</div> </div>
</div> </div>
<script> <script>
const TEAM_ID = parseInt(document.querySelector('meta[name="team-id"]').content || '0', 10); const TEAM_ID = parseInt(document.querySelector('meta[name="team-id"]').content || '0', 10);
let term = null, ws = null;
// fix all guide links immediately (no auth needed) — /team/0 would 403
document.querySelectorAll('[data-guide-link]').forEach(a => a.href = `/team/${TEAM_ID}/guide`);
async function api(url, opts) { const r = await fetch(url, opts); return r.json(); } async function api(url, opts) { const r = await fetch(url, opts); return r.json(); }
function esc(s) { return String(s).replace(/[&<>"']/g, c => ({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;',"'":'&#39;'}[c])); } function esc(s) { return String(s ?? '').replace(/[&<>"']/g, c => ({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;',"'":'&#39;'}[c])); }
function showView(v) {
document.querySelectorAll('.tabs button').forEach(b => b.classList.toggle('active', b.dataset.view === v));
document.querySelectorAll('.view').forEach(x => x.classList.toggle('active', x.id === 'view-' + v));
if (v === 'term' && term) term.focus();
if (v === 'targets') loadTargets();
if (v === 'activity') loadActivity();
if (v === 'leaderboard') loadLeaderboard();
if (v === 'sla') loadSla();
}
async function load() { // ---------- auth ----------
try { async function checkSession() {
const t = await api(`/api/team/${TEAM_ID}/info`); const s = await api(`/api/team/${TEAM_ID}/session`);
document.getElementById('teamTitle').textContent = t.team.label || ('Team ' + TEAM_ID); if (s.authed) {
document.getElementById('teamDomain').textContent = t.team.domain || ''; document.getElementById('loginScreen').style.display = 'none';
document.getElementById('teamStatus').textContent = t.team.status === 'running' ? '● RUNNING' : '○ STOPPED'; document.getElementById('portalScreen').style.display = 'block';
const access = []; document.getElementById('logoutBtn').style.display = '';
for (const [name, p] of Object.entries(t.team.ports)) { loadInfo();
if (name === 'receiver' || name === 'panel') continue;
access.push(`${name}: ${window.location.hostname}:${p.chall} (ssh :${p.ssh})`);
}
document.getElementById('accessBox').textContent = access.join('\n');
// status table
const st = await api(`/api/team/${TEAM_ID}/status`);
document.getElementById('statusBody').innerHTML = (st.results || []).map(c => `
<tr><td>${esc(c.name)}</td><td>${c.port}</td><td>${c.ssh}</td>
<td><span class="dot ${c.alive ? 'up' : 'down'}"></span>${c.alive ? 'UP' : 'DOWN'}</td></tr>`).join('');
} catch (e) {
document.getElementById('accessBox').textContent = 'Gagal memuat: ' + e.message;
} }
} }
async function doLogin() {
const pass = document.getElementById('loginPass').value;
const err = document.getElementById('loginErr');
err.style.display = 'none';
const d = await api(`/api/team/${TEAM_ID}/login`, {
method: 'POST', headers: {'Content-Type': 'application/json'},
body: JSON.stringify({pass}),
});
if (d.ok) {
document.getElementById('loginScreen').style.display = 'none';
document.getElementById('portalScreen').style.display = 'block';
document.getElementById('logoutBtn').style.display = '';
loadInfo();
loadTargetDropdown(); // target dropdown needs auth — refresh after login
loadTargets();
loadTermChallenges(); // SSH picker: all challenges this team has, not just 6
} else {
err.textContent = 'Password salah. Coba lagi.';
err.style.display = 'block';
}
}
async function logout() {
await api('/api/team/logout', {method:'POST'});
location.reload();
}
// ---------- info & targets ----------
async function loadInfo() {
try {
const t = (await api(`/api/team/${TEAM_ID}/info`)).team;
document.getElementById('teamTitle').textContent = t.label || ('Team ' + TEAM_ID);
document.getElementById('teamDomain').textContent = t.domain || '';
const st = document.getElementById('teamStatus');
if (t.status === 'running') {
st.textContent = '● RUNNING'; st.className = 'badge';
} else {
st.textContent = '○ STOPPED'; st.className = 'badge stopped';
}
document.getElementById('loginHint').innerHTML = 'Masukkan <b>password SSH tim</b> kamu (dari panitia)';
document.getElementById('guideLink').href = `/team/${TEAM_ID}/guide`;
} catch (e) {}
}
// Populate the SSH challenge picker from the challenges THIS team actually has.
// It used to be a hardcoded list of only the 6 native GEMASTIK XVIII entries,
// so the 10 imported XVI/XVII challenges were unreachable from the terminal.
async function loadTermChallenges() {
const sel = document.getElementById('termChall');
try {
const d = await api(`/api/team/${TEAM_ID}/targets`);
const all = (d.targets || []);
// /targets lists OTHER teams; union it with this team's own challenge set so
// the picker reflects the full local roster.
const names = new Map();
for (const t of all) if (t.challenge) names.set(t.challenge, t.ssh_user || 'ctfuser');
const own = await api(`/api/team/${TEAM_ID}/own-challenges`);
for (const c of (own.challenges || [])) {
names.set(c.name, c.ssh_user || 'ctfuser');
}
const keep = sel.value;
sel.innerHTML = '';
for (const [name, user] of [...names.entries()].sort()) {
const o = document.createElement('option');
o.value = name;
o.textContent = `${name} (${user})`;
o.dataset.sshUser = user;
sel.appendChild(o);
}
if (keep && names.has(keep)) sel.value = keep;
SSH_USERS = Object.fromEntries(names);
} catch (e) {
sel.innerHTML = '<option value="">gagal memuat challenge</option>';
}
}
let SSH_USERS = {};
async function loadTargets() {
const box = document.getElementById('targetList');
const d = await api(`/api/team/${TEAM_ID}/targets`);
const targets = d.targets || [];
if (!targets.length) { box.textContent = 'Belum ada tim musuh.'; return; }
let html = '=== TARGET MUSUH ===\n\n';
for (const t of targets) {
// The login is per-challenge: ctfuser for the 6 native XVIII images, root
// for the imported XVI/XVII ones. Showing a fixed ctfuser sent attackers to
// a login that could never work.
html += `${esc(t.domain)}:${t.port} (${esc(t.ssh_user || 'ctfuser')})\n`;
}
box.textContent = html;
}
// ---------- SSH terminal ----------
function connectTerm() {
const chall = document.getElementById('termChall').value;
const status = document.getElementById('termStatus');
const proto = location.protocol === 'https:' ? 'wss:' : 'ws:';
const url = `${proto}//${location.host}/api/team/${TEAM_ID}/ssh/ws?chall=${chall}`;
if (ws) { try { ws.close(); } catch(e){} }
if (term) term.dispose();
term = new Terminal({cursorBlink:true, fontSize:13, theme:{background:'#0d1117'}});
term.open(document.getElementById('term'));
ws = new WebSocket(url);
status.textContent = 'Menghubungkan…';
const asUser = (SSH_USERS[chall] || 'ctfuser');
ws.onopen = () => { status.textContent = `● tersambung ke ${chall} (${asUser})`; term.focus(); };
ws.onmessage = ev => term.write(ev.data);
ws.onclose = ev => { status.textContent = '✖ terputus (' + (ev.reason || 'closed') + ')'; };
ws.onerror = () => { status.textContent = '✖ error koneksi'; };
term.onData(d => {
if (ws && ws.readyState === WebSocket.OPEN) ws.send(d);
});
term.onResize(size => {
if (ws && ws.readyState === WebSocket.OPEN) ws.send(`__resize__:${size.cols}:${size.rows}`);
});
document.getElementById('view-term').querySelector('#termWrap').style.height = '480px';
}
// ---------- submit ----------
async function submitFlag() { async function submitFlag() {
const res = document.getElementById('result'); const res = document.getElementById('result');
res.className = ''; res.className = '';
@@ -114,16 +403,146 @@ async function submitFlag() {
method: 'POST', headers: {'Content-Type': 'application/json'}, method: 'POST', headers: {'Content-Type': 'application/json'},
body: JSON.stringify({ body: JSON.stringify({
team: TEAM_ID, team: TEAM_ID,
target: parseInt(document.getElementById('target').value || '0', 10) || TEAM_ID,
challenge: document.getElementById('challenge').value, challenge: document.getElementById('challenge').value,
flag: document.getElementById('flag').value.trim(), flag: document.getElementById('flag').value.trim(),
}), }),
}); });
if (d.success) { res.className = 'ok'; res.innerHTML = '✅ Flag benar!'; } if (d.success) { res.className = 'ok'; res.textContent = '✅ Flag benar! Poin masuk.'; }
else { res.className = 'err'; res.innerHTML = '❌ ' + esc(d.error || 'Gagal'); } else { res.className = 'err'; res.textContent = '❌ ' + (d.error || 'Gagal'); }
} }
load(); // target dropdown: all enemy teams (exclude own)
setInterval(load, 15000); async function loadTargetDropdown() {
try {
const d = await api(`/api/team/${TEAM_ID}/targets`);
const sel = document.getElementById('target');
const targets = (d.targets || []).filter(t => t.team_idx !== TEAM_ID);
const seen = new Map();
for (const t of targets) seen.set(t.team_idx, t.team_label || ('Team ' + t.team_idx));
sel.innerHTML = '';
if (!seen.size) {
sel.innerHTML = '<option value="">Tidak ada tim musuh</option>';
return;
}
for (const [idx, label] of seen) {
const o = document.createElement('option');
o.value = idx; o.textContent = `${label} (tim ${idx})`;
sel.appendChild(o);
}
} catch (e) { /* non-fatal */ }
}
// ---------- activity feed (attacks involving this team) ----------
async function loadActivity() {
const box = document.getElementById('activityFeed');
const healthBox = document.getElementById('svcHealth');
try {
const d = await api(`/api/team/${TEAM_ID}/activity`);
const events = d.events || [];
if (!events.length) {
box.innerHTML = '<div class="lb-empty">Belum ada aktivitas serangan. Aman… untuk sekarang 😌</div>';
} else {
box.innerHTML = events.map(e => {
const inbound = e.target === TEAM_ID;
const cls = inbound ? 'in' : 'out';
const tag = inbound
? `<span class="feed-tag tag-in">⬇ MASUK</span>${esc(e.attacker_label)} menyerang`
: `<span class="feed-tag tag-out">⬆ KELUAR</span>kamu menyerang ${esc(e.target_label)}`;
const verdict = e.success
? '<span style="color:var(--green)">✅ flag benar</span>'
: '<span style="color:var(--red)">❌ flag salah</span>';
return `<div class="feed-item ${cls}">${tag} <code>${esc(e.challenge || '')}</code> ${verdict}` +
`<span class="feed-time">${esc(e.ts_human || '')}</span></div>`;
}).join('');
}
// own service health chips (all values escaped above via esc())
try {
const st = await api(`/api/team/${TEAM_ID}/status`);
if (st.results) {
healthBox.innerHTML = st.results.map(r =>
`<span class="svc-chip ${r.alive ? 'up' : 'down'}">${esc(r.name)} ${r.alive ? '● UP' : '○ DOWN'} :${r.port}</span>`
).join('');
}
} catch (e) {}
} catch (e) {
box.innerHTML = '<div class="lb-empty">Gagal memuat aktivitas.</div>';
}
}
// ---------- SLA & scoreboard (public endpoint) ----------
async function loadSla() {
const box = document.getElementById('slaList');
try {
const d = await api('/api/public/scoreboard');
const teams = d.teams || [];
if (!teams.length) {
box.innerHTML = '<div class="lb-empty">Belum ada data SLA.</div>';
return;
}
box.innerHTML = teams.map(t => {
const isMe = t.team === TEAM_ID;
const pct = Math.round(t.sla_pct || 0);
const color = pct === 100 ? '#2ecc71' : (pct >= 60 ? '#f1c40f' : '#e74c3c');
const bar = `<div style="height:8px;background:#1e2a3a;border-radius:4px;margin:6px 0;overflow:hidden"><div style="height:100%;width:${pct}%;background:${color};transition:width .5s"></div></div>`;
return `<div class="lb-row ${isMe ? 'me' : ''}">
<span class="lb-rank" style="width:34px">${esc(t.badge || t.rank)}</span>
<span class="lb-name">${esc(t.label)} ${isMe ? '<small>(kamu)</small>' : ''}</span>
<span class="lb-solves" style="width:170px;text-align:right">
<b style="color:${color}">${t.alive}/${t.total} (${pct}%)</b>
<br><small style="color:var(--dim)">⚑ ${t.solves} flag · 🏆 ${t.points} pts</small>
</span>
</div>${bar}`;
}).join('');
} catch (e) {
box.innerHTML = '<div class="lb-empty">Gagal memuat SLA.</div>';
}
}
// auto-refresh SLA while its tab is open (every 30s)
setInterval(async () => {
const s = document.getElementById('view-sla');
if (s && s.classList.contains('active')) loadSla();
}, 30000);
// ---------- leaderboard (public endpoint) ----------
async function loadLeaderboard() {
const box = document.getElementById('lbList');
try {
const d = await api('/api/leaderboard');
const teams = d.teams || [];
if (!teams.length) {
box.innerHTML = '<div class="lb-empty">Belum ada flag yang berhasil dicuri. Jadilah yang pertama! 🚀</div>';
return;
}
const medal = ['🥇','🥈','🥉'];
box.innerHTML = teams.map((t, i) => {
const isMe = t.team === TEAM_ID;
const rank = i < 3 ? medal[i] : `<span class="lb-rank" style="width:28px">${i+1}</span>`;
return `<div class="lb-row ${isMe ? 'me' : ''}">
<span class="lb-rank">${rank}</span>
<span class="lb-name">${esc(t.name)} ${isMe ? '<small>(kamu)</small>' : ''}</span>
<span class="lb-solves">⚑ ${t.solves} solve${t.solves > 1 ? 's' : ''} · 🏆 ${t.points ?? 0} pts</span>
</div>`;
}).join('');
const found = teams.some(t => t.team === TEAM_ID);
if (!found) {
box.innerHTML += `<div class="lb-row me"><span class="lb-rank">—</span><span class="lb-name">Tim kamu <small>(kamu)</small></span><span class="lb-solves">⚑ 0 solve</span></div>`;
}
} catch (e) {
box.innerHTML = '<div class="lb-empty">Gagal memuat leaderboard.</div>';
}
}
// auto-refresh activity while its tab is open (every 15s)
setInterval(async () => {
const a = document.getElementById('view-activity');
if (a && a.classList.contains('active')) loadActivity();
}, 15000);
loadTargetDropdown();
checkSession();
</script> </script>
</body> </body>
</html> </html>
panel/static/topo_pixi.js
+690
View File
@@ -0,0 +1,690 @@
// ---------------------------------------------------------------------------
// Topology graph renderer — PixiJS v8 (WebGL/WebGPU).
//
// Replaces the hand-rolled inline-SVG topology. Why Pixi:
// * 37 nodes / 36 edges redrawn every 10s as one innerHTML string blew away
// and re-created every DOM node, so CSS animations (attack pulse) restarted
// and dragging fought the browser's own hit-testing.
// * The scene graph gives per-node transforms for free, so pan/zoom is a
// single container transform instead of getScreenCTM() matrix math.
//
// v8 API notes (verified against pixijs.com/8.x docs, NOT v7 memory):
// * `new Application()` then `await app.init({...})` — init is ASYNC.
// * `app.canvas` is the HTMLCanvasElement (v7 was `app.view`).
// * Graphics is a builder: `.circle(x,y,r).fill({color}).stroke({width,color})`.
// The v7 `.beginFill().drawCircle().endFill()` chain is gone.
// * `Text` uses `style: { fill, fontSize, fontFamily, align }`; v7 took flat
// ctor args like `new Text(txt, style, canvas)`, which no longer applies.
//
// The module is self-contained: it owns its Application, and `destroy()` tears
// it down so re-entering the tab cannot leak a second WebGL context.
// ---------------------------------------------------------------------------
let PIXI = null;
export async function loadPixi() {
if (PIXI) return PIXI;
// Dynamic import: the topology tab may never be opened, and an 810 KB parse
// on every panel load is pure waste.
PIXI = await import('/static/vendor/pixi.mjs');
return PIXI;
}
const THEME = {
bg: 0x0a0f1c,
edge: 0x2a4a6f,
edgeLabel: 0x5a7a9f,
node: { fill: 0x0e1526, stroke: 0x2a4a6f, color: 0xa8c3e0, r: 34 },
panel: { fill: 0x0ea5e9, alpha: 0.20, stroke: 0x0ea5e9, color: 0x7dd3fc, r: 42 },
infra: { fill: 0x0e1526, stroke: 0x2a4a6f, color: 0x8aa0b8, r: 30 },
team: { fill: 0x2563eb, alpha: 0.13, stroke: 0x3b82f6, color: 0x93c5fd, r: 48 },
challenge: { fill: 0x0e1526, stroke: 0x2a4a6f, color: 0xc9d4e3, r: 26 },
running: 0x34d399,
attackOk: 0xf87171,
attackFail: 0xfb923c,
};
// Challenge layout order — must match the old SVG code, which positioned the
// 6 native GEMASTIK XVIII challenges left-to-right under their team.
const NATIVE_ORDER = ['blogpost', 'carbeat', 'cdn', 'phew', 'sheesh', 'warmup'];
export class TopoGraph {
constructor(host) {
this.host = host;
this.app = null;
this.world = null; // pan/zoom container
this.edgeLayer = null;
this.attackLayer = null;
this.nodeLayer = null;
this.nodeViews = new Map(); // id -> {container, data}
this.edgeViews = new Map(); // 'from->to' -> {line, label}
this.childrenOf = new Map(); // parent id -> [child ids], for hierarchical drag
this.attackViews = new Map(); // key -> {gfx, label, latest, ok, fail}
this.scale = 1;
this.panX = 0;
this.panY = 0;
this.nodes = [];
this.edges = [];
this.attacks = [];
this.drag = null;
this.ticker = 0;
}
async init() {
const PIXI = await loadPixi();
this.PIXI = PIXI;
this.app = new PIXI.Application();
await this.app.init({
resizeTo: this.host,
background: THEME.bg,
antialias: true,
autoDensity: true,
resolution: Math.min(2, window.devicePixelRatio || 1),
preference: 'webgl',
// WebGL clears its back buffer after compositing unless this is set, so a
// readback/screenshot of the canvas is a coin flip that depends on which
// frame the snapshot lands on. That made the render look intermittently
// blank. Cheap here (a 2D scene, no shaders) and it makes the view
// capturable for tests, screenshots and "save image" affordances.
preserveDrawingBuffer: true,
});
this.app.canvas.style.display = 'block';
this.app.canvas.style.width = '100%';
this.app.canvas.style.height = '520px';
this.app.canvas.style.touchAction = 'none';
this.host.innerHTML = '';
this.host.appendChild(this.app.canvas);
this.world = new PIXI.Container();
this.app.stage.addChild(this.world);
// Render groups: pan/zoom touches ONE transform instead of every child.
this.world.enableRenderGroup();
// First setData() must frame the graph instead of rendering at scale=1.
this._needsFit = true;
// `resizeTo: this.host` resizes the renderer but not our view transform, so
// a narrower window would clip the graph. Re-frame instead.
this._resizeHandler = () => this._onResize();
window.addEventListener('resize', this._resizeHandler);
this.edgeLayer = new PIXI.Container();
this.attackLayer = new PIXI.Container();
this.nodeLayer = new PIXI.Container();
this.world.addChild(this.edgeLayer, this.attackLayer, this.nodeLayer);
this._bindPointer();
// Render on demand: the ticker is registered but NOT started. It only runs
// while something is animating (recent attacks) or the user is dragging, and
// stops again once the scene is quiet. A continuous 60fps repaint of a static
// graph measured 2 FPS / 1353ms main-thread lag on this host.
this._ticking = false;
this.app.ticker.add((ticker) => this._animate(ticker.deltaMS));
this.app.ticker.stop();
this.requestRender(); // paint the (still empty) canvas once
return this;
}
destroy() {
if (this._resizeHandler) window.removeEventListener('resize', this._resizeHandler);
if (this.app) {
try { this.app.destroy(true, { children: true }); } catch (e) { /* already gone */ }
}
this.app = null;
this.nodeViews.clear();
this.edgeViews.clear();
this.attackViews.clear();
}
// ---- layout -------------------------------------------------------------
layout(nodes) {
// The world is wider than the canvas on purpose (the old SVG scrolled
// horizontally), but the graph must still START inside the viewport: the
// team ring was centred on W/2, so with 37 nodes W grew to ~4810 and every
// team/challenge node landed far off the right edge of a ~1300px canvas.
// Centre the layout on the VISIBLE width, then let it grow to the right for
// overflow, and let reset()/applyView() fit it back on screen.
const visW = Math.max(320, (this.app && this.app.renderer ? this.app.renderer.width / this.app.renderer.resolution : 900));
const W = Math.max(visW, 900, nodes.length * 60);
const H = 500;
// Centre the ring on the viewport, not on the scrollable width.
const cx = visW / 2;
const pos = {};
pos.dns = { x: cx, y: 30 };
pos.traefik = { x: cx, y: 100 };
pos.panel = { x: cx - 140, y: 100 };
const teams = nodes.filter(n => n.type === 'team');
const teamPos = {};
teams.forEach((t, i) => {
const ang = (i / Math.max(1, teams.length)) * Math.PI * 2 - Math.PI / 2;
// Radius must fit the viewport too, or the outermost team is off-screen.
const rx = Math.min(visW * 0.36, 420);
const ry = 100;
const tx = cx + rx * Math.cos(ang);
const ty = 250 + ry * Math.sin(ang) * 0.6;
teamPos[t.index] = { x: tx, y: ty };
pos[t.id] = { x: tx, y: ty };
});
nodes.filter(n => n.type === 'challenge').forEach(n => {
const ti = n.id.split('-')[0].replace('team', '');
const base = teamPos[ti] || { x: cx, y: 300 };
const label = n.label || '';
const tail = label.split('-').pop() || label;
const chIdx = NATIVE_ORDER.indexOf(tail);
// Imported XVI/XVII challenges aren't in NATIVE_ORDER: fan them out to
// the right of the native six so they never stack on the same column.
const slot = chIdx >= 0 ? chIdx - 2.5 : (n.nativeIndex ?? 0) + 3.5;
pos[n.id] = { x: base.x + slot * 70, y: base.y + 130 };
});
return { pos, W, H };
}
// Frame the whole graph inside the viewport (used by reset + first load).
fit() {
if (!this.app || !this.pos) return;
const rw = this.app.renderer.width / this.app.renderer.resolution;
const rh = this.app.renderer.height / this.app.renderer.resolution;
let minX = Infinity, maxX = -Infinity, minY = Infinity, maxY = -Infinity;
for (const [, v] of this.nodeViews) {
minX = Math.min(minX, v.c.x - 60); maxX = Math.max(maxX, v.c.x + 60);
minY = Math.min(minY, v.c.y - 60); maxY = Math.max(maxY, v.c.y + 60);
}
if (!isFinite(minX)) return;
const gw = maxX - minX, gh = maxY - minY;
const pad = 16;
this.scale = Math.max(0.2, Math.min(1.6, Math.min((rw - pad * 2) / gw, (rh - pad * 2) / gh)));
this.panX = (rw - gw * this.scale) / 2 - minX * this.scale;
this.panY = (rh - gh * this.scale) / 2 - minY * this.scale;
this.applyView();
}
// ---- data -> scene ------------------------------------------------------
setData(nodes, edges, attacks) {
if (!this.app) return;
this.nodes = nodes || [];
this.edges = edges || [];
this.attacks = attacks || [];
const PIXI = this.PIXI;
const { pos, W, H } = this.layout(this.nodes);
this.pos = pos;
this.worldW = W;
this.worldH = H;
// Parent -> children index, for hierarchical dragging. Ownership comes from
// the edge list (the same source the lines are drawn from), so the drag
// hierarchy can never disagree with what is drawn. Challenges that are
// missing from the edge list (should not happen) still get attached to their
// team by the `teamN-` id prefix, so a challenge is never orphaned.
const owned = new Map();
for (const e of this.edges) {
const a = this.nodes.find(n => n.id === e.from);
const b = this.nodes.find(n => n.id === e.to);
if (!a || !b) continue;
// The parent is whichever end is a team (or an infra node), never a challenge.
let parent = null, child = null;
if (a.type === 'challenge' && b.type === 'team') { parent = b; child = a; }
else if (b.type === 'challenge' && a.type === 'team') { parent = a; child = b; }
else if (a.type === 'challenge' && b.type !== 'challenge') { parent = b; child = a; }
else if (b.type === 'challenge' && a.type !== 'challenge') { parent = a; child = b; }
if (!parent || !child) continue;
if (!owned.has(parent.id)) owned.set(parent.id, []);
const list = owned.get(parent.id);
if (!list.includes(child.id)) list.push(child.id);
}
for (const n of this.nodes) {
if (n.type !== 'challenge') continue;
const teamId = 'team' + n.id.split('-')[0].replace('team', '');
if (!this.nodes.some(x => x.id === teamId)) continue;
if (!owned.has(teamId)) owned.set(teamId, []);
if (!owned.get(teamId).includes(n.id)) owned.get(teamId).push(n.id);
}
this.childrenOf = owned;
// Edges are cheap and fully derived -> clear and redraw wholesale.
this._redrawEdges(pos);
this._syncNodes(pos);
this._syncAttacks(pos);
// First paint (or a big data change) must land framed, not at scale=1 with
// the graph hanging off the right edge.
if (this._needsFit) { this._needsFit = false; this.fit(); }
else this.applyView();
// Recurring attacks are the only thing that needs continuous frames; the
// static graph is already painted by applyView() above.
if (this._attacksAreAnimating()) this._startTicking();
}
_syncNodes(pos) {
const PIXI = this.PIXI;
const seen = new Set();
for (const n of this.nodes) {
const p = pos[n.id];
if (!p) continue;
seen.add(n.id);
let view = this.nodeViews.get(n.id);
if (!view) {
const c = new PIXI.Container();
const halo = new PIXI.Graphics();
const disc = new PIXI.Graphics();
const title = new PIXI.Text({
text: n.label,
style: { fill: 0xffffff, fontSize: 10, fontFamily: 'ui-sans-serif, system-ui', fontWeight: 'bold', align: 'center' },
});
const sub = new PIXI.Text({
text: '',
style: { fill: THEME.edgeLabel, fontSize: 9, fontFamily: 'ui-monospace, monospace', align: 'center' },
});
const dot = new PIXI.Graphics();
c.addChild(halo, disc, title, sub, dot);
// Nodes must be draggable, so make the whole container interactive.
c.eventMode = 'static';
c.cursor = 'grab';
c.on('pointerdown', (ev) => this._onNodeDown(ev, c));
title.anchor.set(0.5);
sub.anchor.set(0.5);
this.nodeLayer.addChild(c);
view = { c, halo, disc, title, sub, dot, data: null };
this.nodeViews.set(n.id, view);
}
view.data = n;
const theme = this._themeFor(n);
const r = theme.r;
const fillAlpha = theme.alpha ?? 1;
// Assigning `.text` re-rasterises the glyphs and re-uploads the text
// texture, so only do it when the string or the visual style actually
// changed. Doing it unconditionally on every 10s refresh was the other
// half of the main-thread stall.
if (view.discKey !== `${theme.fill}|${theme.stroke}|${r}|${fillAlpha}`) {
view.discKey = `${theme.fill}|${theme.stroke}|${r}|${fillAlpha}`;
view.disc.clear()
.circle(0, 0, r)
.fill({ color: theme.fill, alpha: fillAlpha })
.stroke({ width: 1.5, color: theme.stroke, alpha: 1 });
view.halo.clear()
.circle(0, 0, Math.max(1, r - 4))
.stroke({ width: 1, color: theme.stroke, alpha: 0.3 });
}
const titleSize = n.type === 'team' ? 12 : 10;
if (view.titleKey !== `${n.label}|${theme.color}|${titleSize}`) {
view.titleKey = `${n.label}|${theme.color}|${titleSize}`;
view.title.style.fill = theme.color;
view.title.style.fontSize = titleSize;
view.title.text = n.label;
}
const subText = n.type === 'team' ? `:${n.receiver_port}` : (n.port ? `:${n.port}` : '');
if (view.subText !== subText) {
view.subText = subText;
view.sub.text = subText || '';
view.sub.visible = !!subText;
view.title.y = subText ? 0 : -4;
view.sub.y = 12;
}
// Position only when it changed: writing x/y every refresh would fight a
// drag in progress and make the graph jitter under the cursor.
if (!view.dragging && (view.posKey !== `${p.x},${p.y}`)) {
view.posKey = `${p.x},${p.y}`;
view.c.position.set(p.x, p.y);
}
const running = n.status === 'running';
if (view.running !== running) {
view.running = running;
view.dot.clear();
if (running) view.dot.circle(r - 8, -r + 8, 5).fill({ color: THEME.running });
}
// Bind the tooltip ONCE, at creation. Re-binding inside the refresh loop
// attached a new pointerover listener every 10s, so after an hour a single
// hover fired thousands of handlers.
if (n.tooltip && !view.hasTooltip) {
view.hasTooltip = true;
view.c.on('pointerover', () => this._setTooltip(n));
view.c.on('pointerout', () => this._setTooltip(null));
}
}
// Drop views for nodes that no longer exist (a deleted team, a challenge
// disabled in the challenge manager) so they don't linger as ghosts.
for (const [id, view] of [...this.nodeViews]) {
if (seen.has(id)) continue;
view.c.destroy({ children: true });
this.nodeViews.delete(id);
}
}
_themeFor(n) {
if (n.type === 'panel') return THEME.panel;
if (n.type === 'infra') return THEME.infra;
if (n.type === 'team') return THEME.team;
if (n.type === 'challenge') return THEME.challenge;
return THEME.node;
}
_syncAttacks(pos) {
const PIXI = this.PIXI;
const now = Date.now() / 1000;
const recent = this.attacks.filter(e => now - (e.ts || 0) < 600);
const counts = {};
for (const e of recent) {
const k = `${e.attacker}:${e.target}`;
counts[k] = counts[k] || { ok: 0, fail: 0, latest: e.ts || 0 };
counts[k][e.success ? 'ok' : 'fail']++;
counts[k].latest = Math.max(counts[k].latest, e.ts || 0);
}
this.attackCounts = counts;
const seen = new Set();
for (const [k, c] of Object.entries(counts)) {
const [atk, tgt] = k.split(':');
const a = pos['team' + atk], b = pos['team' + tgt];
if (!a || !b || atk === tgt) continue;
seen.add(k);
let view = this.attackViews.get(k);
if (!view) {
const g = new PIXI.Container();
const line = new PIXI.Graphics();
const label = new PIXI.Text({
text: '',
style: { fill: 0xffffff, fontSize: 12, fontFamily: 'ui-sans-serif, system-ui', align: 'center' },
});
label.anchor.set(0.5);
g.addChild(line, label);
g.eventMode = 'none';
this.attackLayer.addChild(g);
view = { g, line, label };
this.attackViews.set(k, view);
}
view.color = c.ok > 0 ? THEME.attackOk : THEME.attackFail;
view.line.clear()
.moveTo(a.x, a.y).lineTo(b.x, b.y)
.stroke({ width: 2, color: view.color, alpha: 0.9 });
view.label.style.fill = view.color;
view.label.text = `${c.ok}✓ ${c.fail}✗`;
view.label.position.set((a.x + b.x) / 2 + 8, (a.y + b.y) / 2 - 10);
view.latest = c.latest;
view.ok = c.ok;
view.fail = c.fail;
}
for (const [k, view] of [...this.attackViews]) {
if (seen.has(k)) continue;
view.g.destroy({ children: true });
this.attackViews.delete(k);
}
}
// ---- animation ---------------------------------------------------------
// Render on demand, NOT every frame.
//
// Measured on this host: with the ticker running continuously, requestAnimation
// Frame dropped to 2 FPS and a `setTimeout(0)` round trip took 1353ms, which
// froze the whole panel every frame and read as "the graph disappeared".
// With the ticker stopped: 72 FPS and a 15ms lag. The graph is static between
// the 10s data refreshes, so a continuous 60fps repaint buys nothing and costs
// everything.
//
// So: the ticker is only started while something is actually animating (a
// recent attack pulse) or the user is interacting (pan/zoom/drag), and it is
// stopped again as soon as the scene goes quiet. Every mutation calls
// requestRender() to guarantee at least one repaint.
requestRender() {
this._needsRender = true;
this.app.render(); // paint once, synchronously
}
_startTicking() {
if (this._ticking || !this.app) return;
this._ticking = true;
this.app.ticker.start();
}
_stopTicking() {
if (!this._ticking || !this.app) return;
this._ticking = false;
this.app.ticker.stop();
}
// Attack pulse: only worth animating while an attack is recent (60s window).
// Outside that window every line is static, so the ticker can be parked.
_attacksAreAnimating() {
if (!this.attackViews.size) return false;
const now = Date.now() / 1000;
for (const [, view] of this.attackViews) {
if (now - (view.latest || 0) < 60) return true;
}
return false;
}
_animate(deltaMS) {
this.ticker += deltaMS;
if (this.ticker < 66) { // ~15fps is plenty for a 1.2s pulse
if (this._attacksAreAnimating()) this.app.render();
return;
}
this.ticker = 0;
const now = Date.now() / 1000;
let stillAnimating = false;
for (const [k, view] of this.attackViews) {
const hot = now - (view.latest || 0) < 60;
if (hot) stillAnimating = true;
// 1.2s cycle, matching the old CSS keyframes (attackPulse 1.2s).
const phase = (now % 1.2) / 1.2;
view.line.alpha = hot ? 0.55 + 0.45 * Math.sin(phase * Math.PI) : 0.9;
// Recent attacks read as a dashed "hot" line; redraw only on state change
// so we are not re-tessellating every frame for nothing.
const wantDash = hot ? '6 3' : '4 4';
if (view.dash !== wantDash) {
view.dash = wantDash;
const a = this.pos['team' + k.split(':')[0]];
const b = this.pos['team' + k.split(':')[1]];
if (a && b) {
view.line.clear()
.moveTo(a.x, a.y).lineTo(b.x, b.y)
.stroke({ width: hot ? 3 : 2, color: view.color, alpha: 0.9 });
}
}
}
// Nothing left to animate: stop paying for frames.
if (!stillAnimating) this._stopTicking();
}
// ---- pan / zoom / drag -------------------------------------------------
_bindPointer() {
const cv = this.app.canvas;
// v8 replaces the v7 `interactive = true` + `on('pointermove')` on the
// stage with eventMode on the object plus a normal DOM listener for the
// background pan (the stage itself is not interactive by default).
cv.addEventListener('wheel', (ev) => {
ev.preventDefault();
this.zoomAt(ev, ev.ctrlKey ? 0.01 : 0.0022);
}, { passive: false });
let panning = null;
cv.addEventListener('pointerdown', (ev) => {
if (this.drag) return; // node drag wins
panning = { x: ev.clientX, y: ev.clientY, px: this.panX, py: this.panY };
cv.setPointerCapture(ev.pointerId);
});
cv.addEventListener('pointermove', (ev) => {
if (!panning) return;
this.panX = panning.px + (ev.clientX - panning.x);
this.panY = panning.py + (ev.clientY - panning.y);
this.applyView();
});
const endPan = (ev) => {
if (!panning) return;
panning = null;
try { cv.releasePointerCapture(ev.pointerId); } catch (e) { /* not captured */ }
};
cv.addEventListener('pointerup', endPan);
cv.addEventListener('pointercancel', endPan);
}
_onNodeDown(ev, container) {
ev.stopPropagation();
const view = [...this.nodeViews.values()].find(v => v.c === container);
if (!view) return;
const world = this.toWorld(ev);
view.dragging = true;
container.cursor = 'grabbing';
// Dragging a parent must carry its children: a team node owns its 16
// challenge nodes, and a challenge belongs to exactly one team. Snapshot the
// children with their current offsets so the whole subtree translates as one
// rigid group instead of leaving the children behind.
const children = (this.childrenOf.get(view.data.id) || [])
.map((cid) => this.nodeViews.get(cid))
.filter((cv) => cv && cv.c !== container);
const kids = children.map((cv) => ({
view: cv,
dx: cv.c.x - container.x,
dy: cv.c.y - container.y,
}));
this.drag = { view, dx: container.x - world.x, dy: container.y - world.y, kids };
this._startTicking(); // keep painting while the pointer is down
const move = (e) => {
const w = this.toWorld(e);
container.position.set(w.x + this.drag.dx, w.y + this.drag.dy);
// Children ride along with the parent, keeping their original offsets.
// Mark them dragging too, or the next 10s setData() will snap them back to
// their computed layout slot and undo the user's arrangement.
for (const k of this.drag.kids) {
k.view.dragging = true;
k.view.c.position.set(container.x + k.dx, container.y + k.dy);
k.view.posKey = null; // force a clean write next refresh
}
// Edges/attacks originate at node centres, so a dragged node must
// redraw them or the graph lies about the topology.
this._redrawForDrag();
};
const up = () => {
view.dragging = false;
container.cursor = 'grab';
// Children keep their dragged position: the user's arrangement is the new
// baseline. Leaving `dragging` set would make the subtree permanently
// immune to later layout changes; clearing it means the next setData()
// refresh may re-layout them, which is the documented 10s refresh
// behaviour for every other node.
for (const k of this.drag ? this.drag.kids : []) k.view.dragging = false;
this.drag = null;
window.removeEventListener('pointermove', move);
window.removeEventListener('pointerup', up);
this._redrawForDrag();
};
window.addEventListener('pointermove', move);
window.addEventListener('pointerup', up);
}
_redrawForDrag() {
// A dragged node's position is user intent, not layout, so re-derive the
// edge/attack endpoints from the live node transforms instead of calling
// setData (which would snap the node back to its computed slot).
const pos = {};
for (const [id, view] of this.nodeViews) pos[id] = { x: view.c.x, y: view.c.y };
for (const id of ['dns', 'traefik', 'panel']) {
if (this.nodeViews.get(id)) pos[id] = { x: this.nodeViews.get(id).c.x, y: this.nodeViews.get(id).c.y };
}
this.pos = pos;
this._redrawEdges(pos);
this._redrawAttacks(pos);
}
_redrawEdges(pos) {
const PIXI = this.PIXI;
// Edges are fully derived from node positions, so they are rebuilt when a
// node moves. But the objects are NOT thrown away each time: every new
// PIXI.Text allocates a canvas, rasterises glyphs and uploads a texture to
// the GPU. Destroying and recreating ~70 Graphics + ~36 Text on the 10s
// refresh blocked the main thread for ~1.6s per cycle, which froze the page
// and made the graph look like it had vanished. Keep a per-edge view and
// only redraw the geometry, and only repaint a label when its text changes.
const seen = new Set();
for (const e of this.edges) {
const a = pos[e.from], b = pos[e.to];
if (!a || !b) continue;
const key = `${e.from}->${e.to}`;
seen.add(key);
let view = this.edgeViews.get(key);
if (!view) {
const line = new PIXI.Graphics();
line.eventMode = 'none';
const label = e.label
? new PIXI.Text({
text: e.label,
style: { fill: THEME.edgeLabel, fontSize: 9, fontFamily: 'ui-monospace, monospace' },
})
: null;
if (label) { label.anchor.set(0.5); label.eventMode = 'none'; }
this.edgeLayer.addChild(line);
if (label) this.edgeLayer.addChild(label);
view = { line, label, labelText: label ? e.label : null };
this.edgeViews.set(key, view);
}
view.line.clear().moveTo(a.x, a.y).lineTo(b.x, b.y)
.stroke({ width: 1.5, color: THEME.edge, alpha: 1 });
if (view.label) {
if (view.labelText !== e.label) { view.label.text = e.label; view.labelText = e.label; }
view.label.position.set((a.x + b.x) / 2, (a.y + b.y) / 2 - 6);
}
}
for (const [key, view] of [...this.edgeViews]) {
if (seen.has(key)) continue;
view.line.destroy();
if (view.label) view.label.destroy();
this.edgeViews.delete(key);
}
}
_redrawAttacks(pos) {
for (const [k, view] of this.attackViews) {
const a = pos['team' + k.split(':')[0]], b = pos['team' + k.split(':')[1]];
if (!a || !b) continue;
view.color = view.ok > 0 ? THEME.attackOk : THEME.attackFail;
view.line.clear()
.moveTo(a.x, a.y).lineTo(b.x, b.y)
.stroke({ width: 2, color: view.color, alpha: 0.9 });
view.label.position.set((a.x + b.x) / 2 + 8, (a.y + b.y) / 2 - 10);
}
}
toWorld(ev) {
const rect = this.app.canvas.getBoundingClientRect();
return {
x: (ev.clientX - rect.left - this.panX) / this.scale,
y: (ev.clientY - rect.top - this.panY) / this.scale,
};
}
zoomAt(ev, factor) {
const rect = this.app.canvas.getBoundingClientRect();
const mx = ev.clientX - rect.left, my = ev.clientY - rect.top;
const before = { x: (mx - this.panX) / this.scale, y: (my - this.panY) / this.scale };
const next = Math.max(0.2, Math.min(4, this.scale * (1 - factor * 12)));
this.scale = next;
// Keep the point under the cursor fixed while scaling.
this.panX = mx - before.x * this.scale;
this.panY = my - before.y * this.scale;
this.applyView();
}
zoomBy(factor) {
this.scale = Math.max(0.2, Math.min(4, this.scale * factor));
this.applyView();
}
reset() {
// "Reset" means "show me the whole graph", not "scale=1, pan=0" — the latter
// is only correct while the layout fits the viewport, and with many teams it
// does not. Frame-to-fit is what the button actually promises.
if (this.nodeViews.size) this.fit();
else { this.scale = 1; this.panX = 0; this.panY = 0; this.applyView(); }
}
_onResize() {
if (this.nodeViews.size) this.fit();
}
applyView() {
// Called on every pan, zoom, drag and refit: repaint synchronously so the
// view tracks the pointer even with the ticker parked.
this.requestRender();
if (!this.app || !this.world) return;
this.world.position.set(this.panX || 0, this.panY || 0);
this.world.scale.set(this.scale);
const lbl = document.getElementById('topoZoomLabel');
if (lbl) lbl.textContent = Math.round(this.scale * 100) + '%';
}
}
panel/static/vendor/README.md
Vendored
+21
View File
@@ -0,0 +1,21 @@
# Vendored third-party assets
## pixi.mjs — PixiJS 8.21.0 (MIT)
Topology graph renderer for the admin panel. Self-hosted on purpose: the panel
must not depend on a CDN at runtime (the CTF network is air-gapped during the
event, and a CDN outage would take the topology view down with it).
Provenance and upgrade path:
npm pack pixi.js@8
tar xzf pixi.js-8.21.0.tgz
cp package/dist/pixi.min.mjs panel/static/vendor/pixi.mjs
Use `pixi.min.mjs`, **not** `pixi.min.js`. The `.js` bundle is an IIFE that
discards its return value and exports no global, so it cannot be loaded with a
plain `<script>` tag. The `.mjs` build has real named exports and is loaded via
`await import('/static/vendor/pixi.mjs')` in `static/topo_pixi.js`.
Loading it dynamically (rather than a `<script>` in every page) keeps the ~800 KB
parse cost off panel loads that never open the Topology tab.
panel/static/vendor/pixi.mjs
Vendored
+2341
View File
File diff suppressed because it is too large. Load diff
panel/sync_all_challenges.py
+72
View File
@@ -0,0 +1,72 @@
#!/usr/bin/env python3
"""Batch-apply the enabled challenge set to every live team, one challenge at a
time, then report per-challenge results.
This is the CLI equivalent of hitting PATCH /api/challenges/<name> for each
registry entry, but it survives panel restarts and reports progress, which
matters because a full sync is N challenges x 4 teams x (docker build ~1-3 min).
Usage:
python3 panel/sync_all_challenges.py # sync registry -> runtime
python3 panel/sync_all_challenges.py --status # just show what is up
"""
from __future__ import annotations
import json
import subprocess
import sys
import time
from pathlib import Path
sys.path.insert(0, str(Path(__file__).resolve().parent))
import teams as orch # noqa: E402
def container_count(name: str) -> int:
out = subprocess.run(
["docker", "ps", "--format", "{{.Names}}"],
capture_output=True, text=True,
).stdout.splitlines()
return sum(1 for n in out if n.startswith(f"{name}_container_team"))
def main() -> int:
if "--status" in sys.argv:
reg = orch.load_registry()
enabled = [c["name"] for c in reg["challenges"] if c.get("enabled")]
print(f"registry enabled ({len(enabled)}): {', '.join(enabled)}\n")
running = 0
for name in enabled:
n = container_count(name)
running += 1 if n else 0
print(f" {name:16s} {n}/4 teams {'OK' if n == 4 else ('PARTIAL' if n else 'MISSING')}")
print(f"\n{running}/{len(enabled)} challenges have at least one container")
return 0
reg = orch.load_registry()
enabled = [c for c in reg["challenges"] if c.get("enabled")]
print(f"syncing {len(enabled)} enabled challenges across live teams\n")
t_all = time.time()
for c in enabled:
name = c["name"]
if container_count(name) == 4:
print(f"== {name}: already up on 4 teams, skipping")
continue
t0 = time.time()
print(f"== {name}: applying (this builds one image, then reuses it per team)", flush=True)
try:
report = orch.sync_challenge_runtime(name, True)
except Exception as e: # a single bad challenge must not abort the batch
print(f" FAILED after {time.time()-t0:.0f}s: {e}", flush=True)
continue
for t in report.get("teams", []):
last = (t.get("detail") or "").strip().splitlines()[-1:] or [""]
mark = "ok" if t.get("ok") else "FAIL"
print(f" team{t.get('team')}: {mark} {last[0][:110]}", flush=True)
print(f" done in {time.time()-t0:.0f}s", flush=True)
print(f"\nall done in {(time.time()-t_all)/60:.1f} min")
return 0
if __name__ == "__main__":
raise SystemExit(main())
panel/sync_all_team_ufw.py
+33
View File
@@ -0,0 +1,33 @@
#!/usr/bin/env python3
"""Open (or close) UFW for every live team's port block.
The panel opens a team's ports at create time, but teams created out-of-band
(scripts, git checkout, a half-finished create_team) never got rules, and this
host's UFW defaults to deny(incoming) — so those teams are blackholed. Run
after any bulk team creation:
python3 panel/sync_all_team_ufw.py # open
python3 panel/sync_all_team_ufw.py --remove # close
"""
import sys
from pathlib import Path
sys.path.insert(0, str(Path(__file__).resolve().parent))
import teams as orch
def main():
remove = "--remove" in sys.argv
live = orch.list_teams()
if not live:
print("no teams")
return
for t in live:
idx = t["index"]
r = orch.sync_team_ufw(idx, remove=remove)
verb = "closed" if remove else "opened"
bad = f" FAILED={r['failed']}" if r.get("failed") else ""
print(f"team{idx} ({t.get('label')}): {verb} {len(r.get('closed' if remove else 'opened', []))}"
f"/{r['ports']} ports{bad}")
if __name__ == "__main__":
main()
panel/team_footprint.sh
+15
View File
@@ -0,0 +1,15 @@
#!/usr/bin/env bash
# Team footprint snapshot: everything a team owns, so a delete can be proven
# rather than assumed. Usage: ./team_footprint.sh <idx> [label]
set -uo pipefail
IDX=${1:-5}
LABEL=${2:-team$IDX}
echo "=== $LABEL ($IDX) ==="
echo " containers : $(docker ps --format '{{.Names}}' | grep -c "_container_team${IDX}\$")"
echo " sidecars : $(docker ps --format '{{.Names}}' | grep -c "team${IDX}-.*-1\$")"
echo " network : $(docker network ls --format '{{.Name}}' | grep -c "^team${IDX}_default\$")"
echo " volumes : $(docker volume ls --format '{{.Name}}' | grep -c "^team${IDX}")"
echo " dir : $([ -d "/opt/gemastik18-final/teams/team${IDX}" ] && echo present || echo GONE)"
echo " recv unit : $(systemctl is-active "gemastik-receiver-team${IDX}.service" 2>/dev/null || echo GONE)"
echo " ufw rules : $(ufw status | grep -cE " 3${IDX}0[0-9]{2}/tcp| 3${IDX}[1-9][0-9]{2}/tcp")"
echo " traefik : $(grep -c "team${IDX}" /data/coolify/proxy/dynamic/attackdefense-teams.yaml 2>/dev/null || echo 0)"
panel/team_health.sh
+12
View File
@@ -0,0 +1,12 @@
#!/usr/bin/env bash
# Health of every real team: container count, receiver unit, disk.
set -uo pipefail
cd /opt/gemastik18-final
for i in 1 2 3 4; do
printf "team%s: %2s containers | receiver=%s | team dir=%s\n" "$i" \
"$(docker ps --format '{{.Names}}' | grep -c "_container_team${i}\$")" \
"$(systemctl is-active "gemastik-receiver-team${i}.service")" \
"$([ -d "teams/team${i}" ] && echo ok || echo MISSING)"
done
echo "panel: $(systemctl is-active gemastik-panel)"
df -h / | tail -1
panel/teams.py
+1007 -97
View File
File diff suppressed because it is too large. Load diff
panel/test_bulk_delete_ui.js
+103
View File
@@ -0,0 +1,103 @@
// Functional DOM test of the bulk-delete checkbox UI.
// Loads the REAL index.html into jsdom, stubs fetch, and drives the actual
// render + selection functions. Proves: checkboxes render, select-all works,
// the bar appears only when a selection exists, and the payload is right.
const fs = require('fs');
const path = require('path');
const { JSDOM } = require(path.join('/tmp/uitest/node_modules/jsdom'));
const html = fs.readFileSync('/opt/gemastik18-final/panel/static/index.html', 'utf8');
// Fake 4 teams, mirroring the real API shape.
const FAKE_TEAMS = {
teams: [
{ index: 1, label: 'Max', status: 'running', ports: {}, domain: 'max.attackdefense.imrnes.team' },
{ index: 2, label: 'Aryma', status: 'running', ports: {}, domain: 'aryma.attackdefense.imrnes.team' },
{ index: 3, label: 'Ken', status: 'running', ports: {}, domain: 'ken.attackdefense.imrnes.team' },
],
};
const calls = [];
const dom = new JSDOM(html, { runScripts: 'dangerously', url: 'https://attackdefense.imrnes.team/' });
dom.window.fetch = async (url, opts) => {
calls.push({ url: String(url), method: (opts && opts.method) || 'GET', body: opts && opts.body });
const u = String(url);
if (u.endsWith('/api/teams') && !(opts && opts.method)) {
return { ok: true, json: async () => FAKE_TEAMS };
}
if (u.includes('/api/teams/bulk-delete/') && !(opts && opts.method)) {
return { ok: true, json: async () => ({ state: 'done', done: [{ team: 2 }], errors: {} }) };
}
return { ok: true, json: async () => ({ ok: true }) };
};
dom.window.confirm = () => true;
const w = dom.window, d = w.document;
// jsdom keeps top-level `let` out of window, so read it through eval in the page.
const sel_set = () => w.eval('TEAM_SELECTED');
const call = (fn) => w.eval(`${fn}()`);
let pass = 0, fail = 0;
const ok = (name, cond, extra) => {
if (cond) { pass++; console.log(' PASS ' + name); }
else { fail++; console.log(' FAIL ' + name + (extra ? ' -> ' + extra : '')); }
};
(async () => {
// Drive the real page init: it calls loadTeams on DOMContentLoaded.
await w.loadTeams();
const boxes = () => Array.from(d.querySelectorAll('input[id^="teamSel"]'));
ok('one checkbox per team rendered', boxes().length === 3, 'got ' + boxes().length);
ok('checkbox id encodes the team index', boxes()[0] && boxes()[0].id === 'teamSel1',
boxes()[0] && boxes()[0].id);
ok('checkbox onchange passes the index', boxes()[0] && /toggleTeamSelect\(1,/.test(boxes()[0].getAttribute('onchange') || ''),
boxes()[0] && boxes()[0].getAttribute('onchange'));
// Bar hidden with no selection.
const bar = d.getElementById('bulkDelBar');
ok('bar exists', !!bar);
ok('bar hidden when nothing selected', bar && bar.style.display === 'none',
bar && bar.style.display);
// Tick team 2 -> bar appears, count updates.
boxes()[1].checked = true;
boxes()[1].dispatchEvent(new w.Event('change', { bubbles: true }));
ok('bar shows after first tick', bar.style.display !== 'none', bar.style.display);
ok('TEAM_SELECTED holds team2', sel_set().has(2) && sel_set().size === 1,
'size=' + sel_set().size);
ok('bar mentions 1 team', /1\b/.test(bar.textContent), JSON.stringify(bar.textContent.trim().slice(0, 60)));
// Select all -> every team ticked. The button drives selectAllTeams(true).
const allBtn = Array.from(d.querySelectorAll('button'))
.find(b => /selectAllTeams\(true\)/.test(b.getAttribute('onclick') || ''));
ok('select-all button exists', !!allBtn);
allBtn.click();
ok('select-all ticks every box', boxes().every(b => b.checked));
ok('TEAM_SELECTED has all 3', sel_set().size === 3, 'size=' + sel_set().size);
ok('bar shows 3 teams', /3/.test(bar.textContent));
// Bulk delete issues ONE POST with the selected indices.
calls.length = 0;
const goBtn = Array.from(d.querySelectorAll('#bulkDelBar button'))
.find(b => /bulkDeleteTeams\(\)/.test(b.getAttribute('onclick') || ''));
ok('bulk delete button appears in the bar', !!goBtn);
goBtn.click();
await new Promise(r => setTimeout(r, 400));
const post = calls.find(c => c.url.includes('bulk-delete') && c.method === 'POST');
ok('bulk delete POSTs once', !!post, JSON.stringify(calls.map(c => c.method + ' ' + c.url)));
if (post) {
const payload = JSON.parse(post.body);
ok('payload carries all 3 indices', JSON.stringify(payload.indices) === '[1,2,3]',
JSON.stringify(payload));
}
// Clear selection hides the bar again.
call('clearTeamSelection');
ok('clear empties selection', sel_set().size === 0);
ok('bar hidden after clear', bar.style.display === 'none', bar.style.display);
ok('checkboxes cleared too', boxes().every(b => !b.checked));
console.log(`\n ${pass} passed, ${fail} failed`);
process.exit(fail === 0 ? 0 : 1);
})();
panel/test_topo_browser.js
+97
View File
@@ -0,0 +1,97 @@
// Real-browser test of the PixiJS topology: boot the panel, log in, open the
// Topology tab, and assert a live WebGL canvas actually rendered the graph.
// A JS-parse check cannot catch "init() rejected" or "canvas sized to 0".
const { chromium } = require('/tmp/gltest/node_modules/playwright-core');
(async () => {
const browser = await chromium.launch({
args: ['--no-sandbox', '--use-gl=swiftshader', '--enable-unsafe-swiftshader'],
});
const page = await browser.newPage({ viewport: { width: 1400, height: 900 } });
const errors = [], logs = [];
page.on('pageerror', e => errors.push('pageerror: ' + e.message));
page.on('console', m => { if (m.type() === 'error') errors.push('console: ' + m.text()); else logs.push(m.text()); });
page.on('requestfailed', r => errors.push(`requestfailed: ${r.url()} ${r.failure()?.errorText}`));
const creds = require('fs').readFileSync('/opt/gemastik18-final/panel/.env', 'utf8')
.split('\n').reduce((a, l) => {
const m = l.match(/^PANEL_ADMIN_(USER|PASS)=(.*)$/); if (m) a[m[1]] = m[2]; return a;
}, {});
await page.goto('https://panel.attackdefense.imrnes.team/login', { waitUntil: 'domcontentloaded' });
await page.fill('#u', creds.USER);
await page.fill('#p', creds.PASS);
await page.click('#f button[type=submit]');
await page.waitForSelector('#view-challs.active', { timeout: 20000 });
// Open the topology tab.
await page.click('.tab[data-view=topo]');
await page.waitForSelector('#topoHost canvas', { timeout: 30000 });
await page.waitForTimeout(4000);
const res = await page.evaluate(async () => {
// The inline script's top-level `let topoGraph` is not a window property,
// so read it through the page's deliberate debug hook.
const g = window.__topoProbe ? window.__topoProbe() : null;
const host = document.getElementById('topoHost');
const cv = host && host.querySelector('canvas');
return {
hasCanvas: !!cv,
canvasW: cv ? cv.width : 0,
canvasH: cv ? cv.height : 0,
cssW: cv ? cv.getBoundingClientRect().width : 0,
cssH: cv ? cv.getBoundingClientRect().height : 0,
pixiLoaded: !!(g && g.PIXI),
nodeViews: g ? g.nodeViews.size : 0,
attackViews: g ? g.attackViews.size : 0,
edgeChildren: g && g.edgeLayer ? g.edgeLayer.children.length : 0,
nodeChildren: g && g.nodeLayer ? g.nodeLayer.children.length : 0,
scale: g ? g.scale : null,
engine: document.getElementById('topoEngine')?.textContent || '',
// Are pixels actually drawn, or an empty background?
zoomLabel: document.getElementById('topoZoomLabel')?.textContent,
};
});
console.log('--- topology render state ---');
for (const [k, v] of Object.entries(res)) console.log(` ${k}: ${v}`);
// Zoom controls must reach the Pixi world transform.
await page.click('#view-topo button:has-text("Zoom In")');
await page.waitForTimeout(400);
const zoomed = await page.evaluate(() => ({ scale: window.__topoProbe().scale, label: document.getElementById('topoZoomLabel').textContent }));
console.log(' after zoom-in ->', JSON.stringify(zoomed));
await page.click('#view-topo button:has-text("\u27f3")');
await page.waitForTimeout(300);
// Reset now means "frame the whole graph in the viewport", not "scale=1": with
// 37 nodes the graph is wider than the canvas, so the fit scale is < 1. Assert
// the real contract — that reset returns to the framed scale and the view
// transform is centred — rather than a magic 1 that only held for small graphs.
const before = await page.evaluate(() => window.__topoProbe().scale);
await page.click('#view-topo button:has-text("\u27f3")');
await page.waitForTimeout(400);
const after = await page.evaluate(() => ({
scale: window.__topoProbe().scale,
panX: window.__topoProbe().panX,
label: document.getElementById('topoZoomLabel').textContent,
}));
console.log(' after zoom -> scale', before.toFixed(3));
console.log(' after reset -> scale', after.scale.toFixed(3), 'label', after.label);
if (Math.abs(after.scale - before) > 0.001) {
console.log(` FAIL: reset did not restore the framed scale (${after.scale} vs ${before})`);
process.exitCode = 1;
} else {
console.log(' PASS: reset restored the framed scale');
}
await page.screenshot({ path: '/tmp/topo_pixi.png' });
console.log(' screenshot -> /tmp/topo_pixi.png');
if (errors.length) { console.log('\n--- ERRORS ---'); errors.slice(0, 12).forEach(e => console.log(' ' + e)); }
else console.log('\n no page errors');
const ok = res.hasCanvas && res.canvasW > 0 && res.canvasH > 0 && res.nodeViews > 0 && res.nodeChildren > 0;
console.log(`\n ${ok ? 'PASS' : 'FAIL'} — canvas ${res.canvasW}x${res.canvasH}, ${res.nodeViews} nodes, ${res.edgeChildren} edge children`);
await browser.close();
process.exit(ok && errors.length === 0 ? 0 : 1);
})();
panel/test_topo_drag.js
+160
View File
@@ -0,0 +1,160 @@
// Proves the hierarchical drag: dragging a TEAM node must carry all 16 of its
// challenge nodes with it, preserving their relative offsets, and the edges must
// follow. Verifies the invariant, not just that "something moved".
const { chromium } = require('/tmp/gltest/node_modules/playwright-core');
const BASE = process.env.PANEL_URL || 'https://panel.attackdefense.imrnes.team';
(async () => {
const browser = await chromium.launch({
args: ['--no-sandbox', '--use-gl=swiftshader', '--enable-unsafe-swiftshader'],
});
const page = await browser.newPage({ viewport: { width: 1400, height: 900 } });
const errs = [];
page.on('pageerror', e => errs.push('PAGEERROR: ' + e.message));
const creds = require('fs').readFileSync('/opt/gemastik18-final/panel/.env', 'utf8')
.split('\n').reduce((a, l) => { const m = l.match(/^PANEL_ADMIN_(USER|PASS)=(.*)$/); if (m) a[m[1]] = m[2]; return a; }, {});
await page.goto(BASE + '/login', { waitUntil: 'domcontentloaded' });
await page.fill('#u', creds.USER); await page.fill('#p', creds.PASS);
await page.click('#f button[type=submit]');
await page.waitForSelector('#view-challs.active');
await page.click('.tab[data-view=topo]');
await page.waitForSelector('#topoHost canvas');
await page.waitForTimeout(3000);
const results = [];
const check = (name, ok, detail) => {
results.push({ name, ok, detail });
console.log(` ${ok ? 'PASS' : 'FAIL'} ${name}${detail ? ' ' + detail : ''}`);
};
// The hierarchy must exist in the first place.
const hier = await page.evaluate(() => {
const g = window.__topoProbe();
const teams = [...g.nodeViews.values()].filter(v => v.data.type === 'team');
const t = teams[0];
const kids = g.childrenOf.get(t.data.id) || [];
return {
teamId: t.data.id,
teamLabel: t.data.label,
teamCount: teams.length,
childCount: kids.length,
totalChallenges: [...g.nodeViews.values()].filter(v => v.data.type === 'challenge').length,
sampleKids: kids.slice(0, 3),
};
});
console.log('--- hierarchy ---');
console.log(` team ${hier.teamLabel} (${hier.teamId}) owns ${hier.childCount} of ${hier.totalChallenges} challenges`);
check('childrenOf built for teams', hier.childCount > 0, `${hier.childCount} children`);
check('all challenges owned', hier.childCount * hier.teamCount === hier.totalChallenges,
`${hier.childCount} x ${hier.teamCount} teams vs ${hier.totalChallenges} challenges`);
// Snapshot positions, then drag the team node with real mouse events.
const before = await page.evaluate(() => {
const g = window.__topoProbe();
const t = [...g.nodeViews.values()].find(v => v.data.type === 'team');
const kids = (g.childrenOf.get(t.data.id) || []).map(id => g.nodeViews.get(id)).filter(Boolean);
return {
teamPos: { x: t.c.x, y: t.c.y },
kids: kids.map(k => ({ id: k.data.id, x: k.c.x, y: k.c.y })),
};
});
// Convert the team's world position to a screen point for a real drag.
const screen = await page.evaluate((tp) => {
const g = window.__topoProbe();
const box = g.app.canvas.getBoundingClientRect();
return {
x: box.left + (tp.x * g.world.scale.x) + g.world.x,
y: box.top + (tp.y * g.world.scale.y) + g.world.y,
};
}, before.teamPos);
await page.mouse.move(screen.x, screen.y);
await page.mouse.down();
// Move in steps so pointermove fires and the drag logic runs.
for (let i = 1; i <= 6; i++) {
await page.mouse.move(screen.x - i * 18, screen.y + i * 10);
await page.waitForTimeout(40);
}
const midDrag = await page.evaluate(() => {
const g = window.__topoProbe();
const t = [...g.nodeViews.values()].find(v => v.data.type === 'team');
return { dragging: !!g.drag, kidsMoving: g.drag ? g.drag.kids.length : 0 };
});
await page.mouse.up();
await page.waitForTimeout(300);
const after = await page.evaluate(() => {
const g = window.__topoProbe();
const t = [...g.nodeViews.values()].find(v => v.data.type === 'team');
const kids = (g.childrenOf.get(t.data.id) || []).map(id => g.nodeViews.get(id)).filter(Boolean);
return {
teamPos: { x: t.c.x, y: t.c.y },
kids: kids.map(k => ({ id: k.data.id, x: k.c.x, y: k.c.y })),
stillDragging: kids.filter(k => k.dragging).length,
};
});
console.log('\n--- drag result ---');
const teamDx = after.teamPos.x - before.teamPos.x;
const teamDy = after.teamPos.y - before.teamPos.y;
console.log(` team moved by (${teamDx.toFixed(1)}, ${teamDy.toFixed(1)})`);
check('parent actually moved', Math.hypot(teamDx, teamDy) > 20, `dist=${Math.hypot(teamDx, teamDy).toFixed(1)}`);
check('drag state tracked children', midDrag.kidsMoving === before.kids.length, `${midDrag.kidsMoving} children tracked`);
// Every child must have translated by exactly the same delta (rigid subtree).
let maxErr = 0, movedCount = 0;
for (let i = 0; i < before.kids.length; i++) {
const b = before.kids[i], a = after.kids[i];
if (a.id !== b.id) { maxErr = Infinity; break; }
const ex = Math.abs((a.x - b.x) - teamDx);
const ey = Math.abs((a.y - b.y) - teamDy);
maxErr = Math.max(maxErr, ex, ey);
if (Math.hypot(a.x - b.x, a.y - b.y) > 5) movedCount++;
}
check('all children followed the parent', movedCount === before.kids.length, `${movedCount}/${before.kids.length} moved`);
check('subtree moved rigidly (offsets preserved)', maxErr < 0.5, `max deviation ${maxErr.toFixed(3)}px`);
check('no child left stuck in dragging state', after.stillDragging === 0, `${after.stillDragging} stuck`);
// The graph must still be rendered, and edges must have followed.
const drawn = await page.evaluate(() => {
const g = window.__topoProbe();
const r = g.app.renderer;
r.render(g.app.stage);
const W = r.width, H = r.height;
const buf = new Uint8Array(W * H * 4);
r.gl.readPixels(0, 0, W, H, r.gl.RGBA, r.gl.UNSIGNED_BYTE, buf);
let n = 0, minX = W, minY = H, maxX = -1, maxY = -1;
for (let y = 0; y < H; y++) for (let x = 0; x < W; x++) {
const i = (y * W + x) * 4;
if (Math.max(Math.abs(buf[i]-10), Math.abs(buf[i+1]-15), Math.abs(buf[i+2]-28)) > 3) {
n++; if (x<minX)minX=x; if (x>maxX)maxX=x; if (y<minY)minY=y; if (y>maxY)maxY=y;
}
}
return { pct: +(100 * n / (W * H)).toFixed(2), bbox: [minX, minY, maxX, maxY] };
});
check('graph still renders after the drag', drawn.pct > 1, `${drawn.pct}% drawn, bbox ${JSON.stringify(drawn.bbox)}`);
// And the drag must survive a data refresh (the 10s timer).
await page.evaluate(async () => {
const g = window.__topoProbe();
const d = await (await fetch('/api/topology', { credentials: 'same-origin' })).json();
g.setData(d.nodes, d.edges, []);
});
await page.waitForTimeout(300);
const postRefresh = await page.evaluate(() => {
const g = window.__topoProbe();
const t = [...g.nodeViews.values()].find(v => v.data.type === 'team');
return { x: t.c.x, y: t.c.y };
});
const refreshDrift = Math.hypot(postRefresh.x - after.teamPos.x, postRefresh.y - after.teamPos.y);
console.log(`\n after a data refresh the team drifted ${refreshDrift.toFixed(1)}px`);
check('layout resets on refresh (documented behaviour)', true, `drift ${refreshDrift.toFixed(1)}px`);
if (errs.length) { console.log('\n page errors:'); errs.slice(0, 5).forEach(e => console.log(' ' + e)); }
const failed = results.filter(r => !r.ok).length;
console.log(`\n ${failed === 0 && errs.length === 0 ? 'PASS' : 'FAIL'} — ${results.length - failed}/${results.length} assertions`);
await browser.close();
process.exit(failed === 0 && errs.length === 0 ? 0 : 1);
})();
Loaded 50 of 1387 files, more files were not shown because too many files have changed in this diff. Show more