Cyrene
ae50acfe40
Passwords failed on 10/16 challenges while state.json looked correct:
- only the 6 native GEMASTIK XVIII images provision 'ctfuser'; every imported
XVI/XVII image does 'echo root:${PASSWORD} | chpasswd' and logs in as root.
set_ssh_passwords() hardcoded ctfuser, so chpasswd set a password on an
account nobody uses -> 'Permission denied' everywhere.
Registry gains a per-challenge 'ssh_user'; chpasswd now targets the real
login (and ctfuser/ctf when present) and reports failures loudly.
- phew checker: chall.py block-buffers stdout through the docker exec pipe
(PYTHONUNBUFFERED now set) and leaks chall.py inside the container on
timeout (26 orphans, container saturated) -> reaps the whole exec process
group. Startup does a fresh Pailier keygen (~12 s) so crypto reads need
_CRYPTO_TIMEOUT, not the 5 s prompt default.
Adds panel/verify_ssh_creds.py (proves the state->container binding from
inside via a real login), audit_ssh_users.sh, reset_runtime.sh.
21 lines
891 B
Bash
21 lines
891 B
Bash
#!/usr/bin/env bash
|
|
# Final end-to-end health + registry toggle verification for the unified
|
|
# attack-defense platform (no secrets echoed; cookie jar in /tmp).
|
|
set -u
|
|
PASS_CAPTURE=/tmp/captured.env
|
|
USER=$(grep -oP '^PANEL_ADMIN_USER=\K.*' /opt/gemastik18-final/panel/.env)
|
|
PW=$(grep -oP '^PANEL_ADMIN_PASS=\K.*' /opt/gemastik18-final/panel/.env)
|
|
LOGIN=$(curl -sS -c /tmp/ejc -X POST -H 'Content-Type: application/json' \
|
|
-d "{\"user\":\"$USER\",\"pass\":\"$PW\"}" \
|
|
https://panel.attackdefense.imrnes.team/api/login -w '\n%{http_code}')
|
|
echo "login: $LOGIN"
|
|
CH=$(curl -sS -b /tmp/ejc https://panel.attackdefense.imrnes.team/api/challenges)
|
|
python3 - "$CH" <<'EOF'
|
|
import sys, json
|
|
d = json.loads(sys.argv[1])
|
|
cs = d.get('challenges', [])
|
|
print('challenges:', len(cs))
|
|
print('sets:', sorted({c.get('set') for c in cs}))
|
|
print('enabled count:', sum(1 for c in cs if c.get('enabled')))
|
|
EOF
|