Cyrene
ae50acfe40
Passwords failed on 10/16 challenges while state.json looked correct:
- only the 6 native GEMASTIK XVIII images provision 'ctfuser'; every imported
XVI/XVII image does 'echo root:${PASSWORD} | chpasswd' and logs in as root.
set_ssh_passwords() hardcoded ctfuser, so chpasswd set a password on an
account nobody uses -> 'Permission denied' everywhere.
Registry gains a per-challenge 'ssh_user'; chpasswd now targets the real
login (and ctfuser/ctf when present) and reports failures loudly.
- phew checker: chall.py block-buffers stdout through the docker exec pipe
(PYTHONUNBUFFERED now set) and leaks chall.py inside the container on
timeout (26 orphans, container saturated) -> reaps the whole exec process
group. Startup does a fresh Pailier keygen (~12 s) so crypto reads need
_CRYPTO_TIMEOUT, not the 5 s prompt default.
Adds panel/verify_ssh_creds.py (proves the state->container binding from
inside via a real login), audit_ssh_users.sh, reset_runtime.sh.
52 lines
1.7 KiB
Python
52 lines
1.7 KiB
Python
#!/usr/bin/env python3
|
|
"""Replace hardcoded `localhost` URLs in the imported XVI checkers with self.url().
|
|
|
|
Why: the imported checkers connect to `http://localhost:{self.port}`. The
|
|
receiver does run on the same host as the published team ports, so this happens
|
|
to work, but it is fragile (breaks the moment a receiver runs in a container or
|
|
the port is bound to a specific interface). Challenge.url() builds the URL from
|
|
self.host (default 127.0.0.1, overridable with RECEIVER_HOST) plus self.port.
|
|
|
|
Idempotent; rewrites only the f-string form, leaving class-level constants that
|
|
pin a *fixed* port (GemasNotes/Pasta/S3) alone — those are handled separately.
|
|
"""
|
|
import re
|
|
import sys
|
|
from pathlib import Path
|
|
|
|
BASE = Path("/opt/gemastik18-final/receiver/challenges/xvi")
|
|
|
|
# f"http://localhost:{self.port}/path/{expr}" -> self.url(f"/path/{expr}")
|
|
# The leading f is part of the literal being matched and must be consumed.
|
|
PAT = re.compile(
|
|
r"""f?(?P<q>["'])http://localhost:\{self\.port\}(?P<path>/[^"']*)?(?P=q)"""
|
|
)
|
|
|
|
|
|
def repl(m: "re.Match[str]") -> str:
|
|
path = m.group("path") or ""
|
|
if not path:
|
|
return "self.url()"
|
|
# the path may itself contain {expr} placeholders — keep them as an f-string
|
|
return f"self.url(f{path!r})"
|
|
|
|
|
|
def main() -> int:
|
|
changed = []
|
|
for p in sorted(BASE.glob("*.py")):
|
|
if p.name in ("Challenge.py", "config.py", "__init__.py"):
|
|
continue
|
|
src = p.read_text()
|
|
if "localhost:{self.port}" not in src:
|
|
continue
|
|
new = PAT.sub(repl, src)
|
|
if new != src:
|
|
p.write_text(new)
|
|
changed.append(p.name)
|
|
print("rewritten:", ", ".join(changed) if changed else "(none)")
|
|
return 0
|
|
|
|
|
|
if __name__ == "__main__":
|
|
raise SystemExit(main())
|