762 lines
30 KiB
Python
762 lines
30 KiB
Python
#!/usr/bin/env python3
|
|
"""
|
|
Gemastik A/D Panel — web UI for the gemastik18-final receiver.
|
|
Serves a dashboard at / and proxies receiver API calls server-side so the
|
|
admin credentials stay out of the browser.
|
|
"""
|
|
import os
|
|
import json
|
|
import time
|
|
import asyncio
|
|
import httpx
|
|
from pathlib import Path
|
|
from fastapi import FastAPI, Request, HTTPException, WebSocket, WebSocketDisconnect
|
|
from fastapi.responses import HTMLResponse, JSONResponse, RedirectResponse
|
|
from fastapi.staticfiles import StaticFiles
|
|
from typing import Optional
|
|
|
|
import teams as orch
|
|
|
|
RECEIVER_URL = os.environ.get("RECEIVER_URL", "http://127.0.0.1:18080")
|
|
ADMIN_USER = os.environ.get("PANEL_ADMIN_USER", "admin")
|
|
ADMIN_PASS = os.environ.get("PANEL_ADMIN_PASS", "admin")
|
|
|
|
BASE_DIR = Path(__file__).parent
|
|
|
|
app = FastAPI(title="Gemastik A/D Panel")
|
|
|
|
CHALLENGES = [
|
|
{"name": "blogpost", "port": 10000, "ssh": 10022, "category": "web", "desc": "Flask blog with exiftool + SSTI"},
|
|
{"name": "carbeat", "port": 11000, "ssh": 11022, "category": "pwn", "desc": "Binary exploitation menu"},
|
|
{"name": "cdn", "port": 12000, "ssh": 12022, "category": "web", "desc": "CDN/image proxy SSTI"},
|
|
{"name": "phew", "port": 13000, "ssh": 13022, "category": "crypto","desc": "Paillier crypto oracle"},
|
|
{"name": "sheesh", "port": 14000, "ssh": 14022, "category": "crypto","desc": "AES padding oracle"},
|
|
{"name": "warmup", "port": 15000, "ssh": 15022, "category": "warmup","desc": "Go file viewer (path traversal)"},
|
|
]
|
|
|
|
# Simple in-memory session tokens (good enough for a CTF ops panel)
|
|
_sessions = {}
|
|
|
|
def _check_basic(req: Request):
|
|
auth = req.headers.get("authorization", "")
|
|
if not auth.startswith("Basic "):
|
|
return None
|
|
import base64
|
|
try:
|
|
decoded = base64.b64decode(auth.split(" ", 1)[1]).decode()
|
|
user, _, pw = decoded.partition(":")
|
|
return (user, pw)
|
|
except Exception:
|
|
return None
|
|
|
|
def _authorized(req: Request) -> bool:
|
|
creds = _check_basic(req)
|
|
if creds and creds[0] == ADMIN_USER and creds[1] == ADMIN_PASS:
|
|
return True
|
|
# session token via cookie
|
|
token = req.cookies.get("panel_token")
|
|
return token in _sessions and _sessions[token] > time.time()
|
|
|
|
def _receiver_auth() -> tuple:
|
|
# Load receiver admin creds from its .env (single source of truth)
|
|
env_path = Path("/opt/gemastik18-final/receiver/.env")
|
|
u = p = ""
|
|
try:
|
|
for line in env_path.read_text().splitlines():
|
|
if line.startswith("ADMIN_USERNAME="):
|
|
u = line.split("=", 1)[1]
|
|
elif line.startswith("ADMIN_PASSWORD="):
|
|
p = line.split("=", 1)[1]
|
|
except Exception:
|
|
pass
|
|
return (u, p)
|
|
|
|
async def _proxy(method: str, path: str, body: dict = None):
|
|
u, p = _receiver_auth()
|
|
async with httpx.AsyncClient(timeout=20) as client:
|
|
resp = await client.request(method, f"{RECEIVER_URL}{path}",
|
|
auth=(u, p), json=body if body is not None else None)
|
|
return resp
|
|
|
|
@app.get("/", response_class=HTMLResponse)
|
|
async def index(req: Request):
|
|
host = (req.headers.get("host") or "").split(":")[0]
|
|
# Team portal domains: <slug>.gemastik.imrnes.team -> their team portal (no admin login)
|
|
if host.endswith(".gemastik.imrnes.team") and host != "gemastik.imrnes.team" and host != "panel.gemastik.imrnes.team":
|
|
slug = host.split(".")[0]
|
|
for t in orch.list_teams():
|
|
if t.get("slug") == slug:
|
|
html = (BASE_DIR / "static" / "team.html").read_text()
|
|
html = html.replace('name="team-id" content="0"', f'name="team-id" content="{t["index"]}"')
|
|
html = html.replace('href="/team/0/guide"', f'href="/team/{t["index"]}/guide"')
|
|
return HTMLResponse(html)
|
|
return HTMLResponse("<h2 style='font-family:sans-serif;color:#888;padding:40px'>Team tidak ditemukan: " + slug + "</h2>", status_code=404)
|
|
if not _authorized(req):
|
|
return RedirectResponse("/login")
|
|
html = (BASE_DIR / "static" / "index.html").read_text()
|
|
return HTMLResponse(html)
|
|
|
|
@app.get("/login", response_class=HTMLResponse)
|
|
async def login_page(req: Request):
|
|
if _authorized(req):
|
|
return RedirectResponse("/")
|
|
return HTMLResponse((BASE_DIR / "static" / "login.html").read_text())
|
|
|
|
@app.get("/submit", response_class=HTMLResponse)
|
|
async def submit_page(req: Request):
|
|
"""Public flag submission page for teams (no login)."""
|
|
return HTMLResponse((BASE_DIR / "static" / "submit.html").read_text())
|
|
|
|
|
|
# ============ Per-team portal (public via <slug>.gemastik.imrnes.team) ============
|
|
|
|
@app.get("/team/{idx}", response_class=HTMLResponse)
|
|
async def team_portal(idx: int, req: Request):
|
|
"""Public portal page for a team. Must be accessed via that team's own domain."""
|
|
td = orch.TEAMS_DIR / f"team{idx}"
|
|
if not (td / "state.json").exists():
|
|
raise HTTPException(404, "Team not found")
|
|
st = json.loads((td / "state.json").read_text())
|
|
if not _check_team_host(req, st):
|
|
raise HTTPException(403, "Akses team lain tidak diizinkan")
|
|
if _team_authorized(req, idx): # logged in -> show portal directly
|
|
html = (BASE_DIR / "static" / "team.html").read_text()
|
|
html = html.replace('name="team-id" content="0"', f'name="team-id" content="{idx}"')
|
|
# server-side: fix guide link so non-JS / pre-JS clicks never hit /team/0
|
|
html = html.replace('href="/team/0/guide"', f'href="/team/{idx}/guide"')
|
|
return HTMLResponse(html)
|
|
# not logged in -> show a stripped landing/login page (no admin info)
|
|
html = (BASE_DIR / "static" / "team.html").read_text()
|
|
html = html.replace('name="team-id" content="0"', f'name="team-id" content="{idx}"')
|
|
html = html.replace('href="/team/0/guide"', f'href="/team/{idx}/guide"')
|
|
return HTMLResponse(html)
|
|
|
|
|
|
@app.get("/team/{idx}/guide", response_class=HTMLResponse)
|
|
async def team_guide(idx: int, req: Request):
|
|
"""Public SSH/attack guide for a team. Must be accessed via that team's own domain."""
|
|
td = orch.TEAMS_DIR / f"team{idx}"
|
|
if not (td / "state.json").exists():
|
|
raise HTTPException(404, "Team not found")
|
|
st = json.loads((td / "state.json").read_text())
|
|
if not _check_team_host(req, st):
|
|
raise HTTPException(403, "Akses team lain tidak diizinkan")
|
|
html = (BASE_DIR / "static" / "guide.html").read_text()
|
|
html = html.replace('name="team-id" content="0"', f'name="team-id" content="{idx}"')
|
|
return HTMLResponse(html)
|
|
|
|
# ---- Team portal login (separate from admin; password = team ssh_pass) ----
|
|
_team_sessions: dict[str, tuple[int, float]] = {} # token -> (idx, expiry)
|
|
|
|
@app.post("/api/team/{idx}/login")
|
|
async def api_team_login(idx: int, req: Request):
|
|
td = orch.TEAMS_DIR / f"team{idx}"
|
|
if not (td / "state.json").exists():
|
|
raise HTTPException(404, "Team not found")
|
|
st = json.loads((td / "state.json").read_text())
|
|
if not _check_team_host(req, st):
|
|
raise HTTPException(403, "Akses team lain tidak diizinkan")
|
|
data = await req.json()
|
|
pw = data.get("pass", "")
|
|
if pw != st.get("ssh_pass"):
|
|
raise HTTPException(401, "Password salah")
|
|
token = os.urandom(16).hex()
|
|
_team_sessions[token] = (idx, time.time() + 12 * 3600)
|
|
resp = JSONResponse({"ok": True, "team": idx})
|
|
resp.set_cookie("team_token", token, httponly=True, samesite="lax", max_age=12 * 3600)
|
|
return resp
|
|
|
|
@app.post("/api/team/logout")
|
|
async def api_team_logout(req: Request):
|
|
token = req.cookies.get("team_token")
|
|
if token:
|
|
_team_sessions.pop(token, None)
|
|
return {"ok": True}
|
|
|
|
def _team_authorized(req: Request, idx: int) -> bool:
|
|
token = req.cookies.get("team_token")
|
|
if not token:
|
|
return False
|
|
e = _team_sessions.get(token)
|
|
if not e or e[0] != idx or e[1] < time.time():
|
|
_team_sessions.pop(token, None)
|
|
return False
|
|
return True
|
|
|
|
def _check_team_host(req: Request, st: dict) -> bool:
|
|
"""IDOR guard: host must be this team's own domain (or localhost).
|
|
panel.gemastik / gemastik.imrnes.team only allowed with a valid ADMIN session."""
|
|
host = (req.headers.get("host") or "").split(":")[0]
|
|
if host == st.get("domain"):
|
|
return True
|
|
if host.startswith("127.0.0.1") or host.startswith("localhost"):
|
|
return True
|
|
if host in ("panel.gemastik.imrnes.team", "gemastik.imrnes.team"):
|
|
return _authorized(req) # admin preview only
|
|
return False
|
|
|
|
@app.get("/api/team/{idx}/session")
|
|
async def api_team_session(idx: int, req: Request):
|
|
"""True when this browser has a valid team session for idx."""
|
|
return {"authed": _team_authorized(req, idx)}
|
|
|
|
@app.get("/api/team/{idx}/targets")
|
|
async def api_team_targets(idx: int, req: Request):
|
|
"""Team targets — requires team login + own host. Only domain + port."""
|
|
td = orch.TEAMS_DIR / f"team{idx}"
|
|
if not (td / "state.json").exists():
|
|
raise HTTPException(404, "Team not found")
|
|
st_self = json.loads((td / "state.json").read_text())
|
|
if not _check_team_host(req, st_self):
|
|
raise HTTPException(403, "Akses team lain tidak diizinkan")
|
|
if not _team_authorized(req, idx):
|
|
raise HTTPException(401, "Login portal team dulu")
|
|
out = []
|
|
for d in sorted(orch.TEAMS_DIR.glob("team*")):
|
|
if not (d / "state.json").exists():
|
|
continue
|
|
st = json.loads((d / "state.json").read_text())
|
|
if st.get("index") == idx:
|
|
continue # skip self
|
|
for name, coff, soff in orch.CHALLENGES:
|
|
p = st["ports"].get(name)
|
|
if not p:
|
|
continue
|
|
out.append({
|
|
"team_idx": st.get("index"),
|
|
"team_label": st.get("label", f"Team {st.get('index')}"),
|
|
"domain": st.get("domain") or (st.get("slug", f"team{st.get('index')}") + ".gemastik.imrnes.team"),
|
|
"port": p["chall"],
|
|
})
|
|
return {"targets": out}
|
|
|
|
@app.get("/api/team/{idx}/info")
|
|
async def api_team_info(idx: int, req: Request):
|
|
"""Team portal info — requires team login + own host; no admin secrets."""
|
|
td = orch.TEAMS_DIR / f"team{idx}"
|
|
if not (td / "state.json").exists():
|
|
raise HTTPException(404, "Team not found")
|
|
st = json.loads((td / "state.json").read_text())
|
|
if not _check_team_host(req, st):
|
|
raise HTTPException(403, "Akses team lain tidak diizinkan")
|
|
if not _team_authorized(req, idx):
|
|
raise HTTPException(401, "Login portal team dulu")
|
|
return {"team": {
|
|
"index": st.get("index"),
|
|
"label": st.get("label"),
|
|
"slug": st.get("slug"),
|
|
"domain": st.get("domain"),
|
|
"status": st.get("status"),
|
|
"ports": st.get("ports"),
|
|
"ssh_user": st.get("ssh_user"),
|
|
"ssh_pass": st.get("ssh_pass"), # same password used to login portal + SSH
|
|
}}
|
|
|
|
|
|
@app.get("/api/team/{idx}/status")
|
|
async def api_team_status(idx: int, req: Request):
|
|
"""SLA status for a team's challenges (read-only health, own-host only)."""
|
|
td = orch.TEAMS_DIR / f"team{idx}"
|
|
if not (td / "state.json").exists():
|
|
raise HTTPException(404, "Team not found")
|
|
st = json.loads ((td / "state.json").read_text())
|
|
if not _check_team_host(req, st):
|
|
raise HTTPException(403, "Akses team lain tidak diizinkan")
|
|
recv_port = st["ports"]["receiver"]
|
|
# use team's receiver admin creds (server-side only; never sent to browser)
|
|
au, ap = st.get("admin_user", ""), st.get("admin_pass", "")
|
|
results = []
|
|
for name, coff, soff in orch.CHALLENGES:
|
|
try:
|
|
async with httpx.AsyncClient(timeout=8) as client:
|
|
resp = await client.get(f"http://127.0.0.1:{recv_port}/check/{name}",
|
|
auth=(au, ap))
|
|
ok = bool(resp.json().get("success")) if resp.status_code == 200 else False
|
|
except Exception:
|
|
ok = False
|
|
results.append({"name": name, "port": st["ports"][name]["chall"],
|
|
"ssh": st["ports"][name]["ssh"], "alive": ok})
|
|
return {"results": results}
|
|
|
|
@app.get("/api/team/{idx}/activity")
|
|
async def api_team_activity(idx: int, req: Request):
|
|
"""Team-scoped activity feed: attack events where this team is attacker or
|
|
target (i.e. "ada serangan ke service kita" / "kita menyerang"), plus a
|
|
snapshot of own service health. Requires team login + own host."""
|
|
td = orch.TEAMS_DIR / f"team{idx}"
|
|
if not (td / "state.json").exists():
|
|
raise HTTPException(404, "Team not found")
|
|
st_self = json.loads((td / "state.json").read_text())
|
|
if not _check_team_host(req, st_self):
|
|
raise HTTPException(403, "Akses team lain tidak diizinkan")
|
|
if not _team_authorized(req, idx):
|
|
raise HTTPException(401, "Login portal team dulu")
|
|
|
|
# live label lookup (rename team = activity updates everywhere)
|
|
def label(i):
|
|
try:
|
|
s = json.loads((orch.TEAMS_DIR / f"team{i}" / "state.json").read_text())
|
|
return s.get("label") or f"Team {i}"
|
|
except Exception:
|
|
return f"Team {i}"
|
|
|
|
ap = orch.TEAMS_DIR / "attacks.json"
|
|
try:
|
|
events = json.loads(ap.read_text()).get("events", []) if ap.exists() else []
|
|
except Exception:
|
|
events = []
|
|
mine = []
|
|
for e in reversed(events): # newest first
|
|
if e.get("attacker") == idx or e.get("target") == idx:
|
|
e = dict(e)
|
|
e["attacker_label"] = label(e.get("attacker"))
|
|
e["target_label"] = label(e.get("target"))
|
|
mine.append(e)
|
|
return {"events": mine[:100], "team_label": st_self.get("label") or f"Team {idx}"}
|
|
|
|
@app.post("/api/login")
|
|
async def api_login(req: Request):
|
|
data = await req.json()
|
|
if data.get("user") == ADMIN_USER and data.get("pass") == ADMIN_PASS:
|
|
token = os.urandom(16).hex()
|
|
_sessions[token] = time.time() + 8 * 3600
|
|
resp = JSONResponse({"ok": True})
|
|
resp.set_cookie("panel_token", token, httponly=True, samesite="lax", max_age=8 * 3600)
|
|
return resp
|
|
raise HTTPException(401, "Invalid credentials")
|
|
|
|
@app.post("/api/logout")
|
|
async def api_logout(req: Request):
|
|
token = req.cookies.get("panel_token")
|
|
if token:
|
|
_sessions.pop(token, None)
|
|
return {"ok": True}
|
|
|
|
def require_login(req: Request):
|
|
if not _authorized(req):
|
|
raise HTTPException(401, "Not authorized")
|
|
|
|
# ---- receiver proxy endpoints (server-side, keeps admin creds secret) ----
|
|
|
|
@app.get("/api/challenges")
|
|
async def api_challenges(req: Request):
|
|
require_login(req)
|
|
return {"challenges": CHALLENGES}
|
|
|
|
@app.get("/api/status")
|
|
async def api_status(req: Request):
|
|
require_login(req)
|
|
results = []
|
|
for ch in CHALLENGES:
|
|
try:
|
|
resp = await _proxy("GET", f"/check/{ch['name']}")
|
|
ok = bool(resp.json().get("success")) if resp.status_code == 200 else False
|
|
except Exception as e:
|
|
ok = False
|
|
# read host flag file
|
|
flag = ""
|
|
try:
|
|
fp = Path(f"/opt/gemastik18-final/receiver/flags/{ch['name']}.txt")
|
|
if fp.exists():
|
|
flag = fp.read_text().strip()
|
|
except Exception:
|
|
pass
|
|
results.append({**ch, "alive": ok, "flag": flag})
|
|
return {"results": results, "ts": int(time.time())}
|
|
|
|
@app.post("/api/flag")
|
|
async def api_flag(req: Request):
|
|
require_login(req)
|
|
data = await req.json()
|
|
challenge = data.get("challenge", "")
|
|
flag = data.get("flag", "")
|
|
if challenge not in [c["name"] for c in CHALLENGES]:
|
|
raise HTTPException(400, "Unknown challenge")
|
|
if not flag:
|
|
raise HTTPException(400, "Flag is empty")
|
|
resp = await _proxy("POST", "/flag", {"challenge": challenge, "flag": flag})
|
|
return {"receiver_status": resp.status_code, "receiver_body": resp.text}
|
|
|
|
@app.post("/api/restart/{challenge}")
|
|
async def api_restart(challenge: str, req: Request):
|
|
require_login(req)
|
|
resp = await _proxy("GET", f"/restart/{challenge}")
|
|
return {"receiver_status": resp.status_code, "receiver_body": resp.text}
|
|
|
|
@app.post("/api/rollback/{challenge}")
|
|
async def api_rollback(challenge: str, req: Request):
|
|
require_login(req)
|
|
resp = await _proxy("GET", f"/rollback/{challenge}")
|
|
return {"receiver_status": resp.status_code, "receiver_body": resp.text}
|
|
|
|
@app.post("/api/activate/{challenge}")
|
|
async def api_activate(challenge: str, req: Request):
|
|
require_login(req)
|
|
resp = await _proxy("GET", f"/activate/{challenge}")
|
|
return {"receiver_status": resp.status_code, "receiver_body": resp.text}
|
|
|
|
@app.post("/api/deactivate/{challenge}")
|
|
async def api_deactivate(challenge: str, req: Request):
|
|
require_login(req)
|
|
resp = await _proxy("GET", f"/deactivate/{challenge}")
|
|
return {"receiver_status": resp.status_code, "receiver_body": resp.text}
|
|
|
|
@app.get("/api/credential/{challenge}")
|
|
async def api_credential(challenge: str, req: Request):
|
|
require_login(req)
|
|
resp = await _proxy("GET", f"/credential/{challenge}")
|
|
if resp.status_code == 200:
|
|
return resp.json()
|
|
return {"error": resp.text}
|
|
|
|
@app.get("/api/history")
|
|
async def api_history(req: Request):
|
|
require_login(req)
|
|
try:
|
|
lines = (BASE_DIR.parent / "history" / "command.txt").read_text().splitlines()
|
|
except Exception:
|
|
lines = []
|
|
return {"lines": lines[-200:]}
|
|
|
|
# ============ Multi-team orchestrator endpoints ============
|
|
|
|
@app.get("/api/teams")
|
|
async def api_teams(req: Request):
|
|
require_login(req)
|
|
return {"teams": orch.list_teams()}
|
|
|
|
@app.post("/api/teams/set")
|
|
async def api_teams_set(req: Request):
|
|
"""Set/create N teams (idempotent: creates missing, keeps existing).
|
|
|
|
body: {count, labels: {"1": "Tim Satu"}, domains: {"1": "tim-satu"}}"""
|
|
require_login(req)
|
|
data = await req.json()
|
|
n = int(data.get("count", 0))
|
|
if n < 0 or n > 50:
|
|
raise HTTPException(400, "Team count must be 0-50")
|
|
labels = data.get("labels") or {} # { "1": "Tim Satu", ... }
|
|
domains = data.get("domains") or {} # { "1": "mycustom", ... }
|
|
created = []
|
|
for i in range(1, n + 1):
|
|
td = orch.TEAMS_DIR / f"team{i}"
|
|
if not td.exists():
|
|
label = labels.get(str(i)) or labels.get(i) or f"Tim {i}"
|
|
dom = domains.get(str(i)) or domains.get(i) or None
|
|
st = orch.create_team(i, label, domain=dom)
|
|
created.append(st["index"])
|
|
else:
|
|
# team exists: apply any label/domain overrides
|
|
label = labels.get(str(i)) or labels.get(i)
|
|
dom = domains.get(str(i)) or domains.get(i)
|
|
if label or dom:
|
|
orch.update_team(i, label=label, domain=dom)
|
|
orch.ensure_team_domains()
|
|
return {"created": created, "total": len(orch.list_teams())}
|
|
|
|
@app.put("/api/teams/{idx}")
|
|
async def api_team_update(idx: int, req: Request):
|
|
"""Update a team's custom name and/or domain (applies live)."""
|
|
require_login(req)
|
|
if not (orch.TEAMS_DIR / f"team{idx}" / "state.json").exists():
|
|
raise HTTPException(404, "Team not found")
|
|
data = await req.json()
|
|
try:
|
|
st = orch.update_team(idx, label=data.get("label"), domain=data.get("domain"))
|
|
return {"ok": True, "team": st}
|
|
except FileNotFoundError as e:
|
|
raise HTTPException(404, str(e))
|
|
|
|
@app.post("/api/teams/start")
|
|
async def api_teams_start(req: Request):
|
|
require_login(req)
|
|
data = await req.json()
|
|
idx = data.get("index")
|
|
if idx is None:
|
|
# start all
|
|
results = []
|
|
for t in orch.list_teams():
|
|
try:
|
|
results.append({"team": t["index"], "ok": True})
|
|
orch.start_team(t["index"])
|
|
except Exception as e:
|
|
results.append({"team": t["index"], "ok": False, "err": str(e)})
|
|
return {"results": results}
|
|
try:
|
|
st = orch.start_team(int(idx))
|
|
return {"ok": True, "team": st}
|
|
except Exception as e:
|
|
raise HTTPException(500, str(e))
|
|
|
|
@app.post("/api/teams/stop")
|
|
async def api_teams_stop(req: Request):
|
|
require_login(req)
|
|
data = await req.json()
|
|
idx = data.get("index")
|
|
if idx is None:
|
|
results = []
|
|
for t in orch.list_teams():
|
|
try:
|
|
orch.stop_team(t["index"])
|
|
results.append({"team": t["index"], "ok": True})
|
|
except Exception as e:
|
|
results.append({"team": t["index"], "ok": False, "err": str(e)})
|
|
return {"results": results}
|
|
try:
|
|
st = orch.stop_team(int(idx))
|
|
return {"ok": True, "team": st}
|
|
except Exception as e:
|
|
raise HTTPException(500, str(e))
|
|
|
|
@app.get("/api/teams/{idx}/logs")
|
|
async def api_team_logs(idx: int, req: Request, service: Optional[str] = None, tail: int = 100):
|
|
require_login(req)
|
|
try:
|
|
logs = orch.team_logs(idx, service, tail)
|
|
return {"team": idx, "logs": logs}
|
|
except Exception as e:
|
|
raise HTTPException(500, str(e))
|
|
|
|
@app.get("/api/teams/{idx}/creds")
|
|
async def api_team_creds(idx: int, req: Request):
|
|
require_login(req)
|
|
try:
|
|
td = orch.TEAMS_DIR / f"team{idx}"
|
|
st = json.loads((td / "state.json").read_text())
|
|
return {"team": st}
|
|
except Exception as e:
|
|
raise HTTPException(404, str(e))
|
|
|
|
@app.get("/api/topology")
|
|
async def api_topology(req: Request):
|
|
"""Return topology graph data (nodes + edges) for the UI."""
|
|
require_login(req)
|
|
teams = orch.list_teams()
|
|
nodes = [
|
|
{"id": "panel", "label": "Panel A/D", "type": "panel", "url": "https://panel.gemastik.imrnes.team"},
|
|
{"id": "traefik", "label": "Traefik / Coolify", "type": "infra"},
|
|
{"id": "dns", "label": "*.imrnes.team → 43.134.105.109", "type": "infra"},
|
|
]
|
|
edges = [{"from": "dns", "to": "traefik"}, {"from": "traefik", "to": "panel"}]
|
|
for t in teams:
|
|
nid = f"team{t['index']}"
|
|
nodes.append({
|
|
"id": nid, "label": t.get("label", f"Team {t['index']}"),
|
|
"type": "team", "index": t["index"], "status": t.get("status", "unknown"),
|
|
"receiver_port": t["ports"]["receiver"], "ssh_pass": t.get("ssh_pass", ""),
|
|
})
|
|
edges.append({"from": "traefik", "to": nid, "label": f":{t['ports']['receiver']}"})
|
|
for name, coff, soff in orch.CHALLENGES:
|
|
cn = f"team{t['index']}-{name}"
|
|
nodes.append({"id": cn, "label": f"{name}", "type": "challenge",
|
|
"port": t["ports"][name]["chall"], "ssh": t["ports"][name]["ssh"]})
|
|
edges.append({"from": nid, "to": cn, "label": f":{t['ports'][name]['chall']}"})
|
|
return {"nodes": nodes, "edges": edges}
|
|
|
|
|
|
# ============ Flag randomization + team submission ============
|
|
|
|
@app.post("/api/teams/{idx}/randomize")
|
|
async def api_randomize(idx: int, req: Request):
|
|
"""Randomize all flags for a team (recreates containers to pick up new flags)."""
|
|
require_login(req)
|
|
try:
|
|
mapping = orch.randomize_flags(idx)
|
|
return {"ok": True, "team": idx, "flags": mapping}
|
|
except Exception as e:
|
|
raise HTTPException(500, str(e))
|
|
|
|
|
|
@app.post("/api/reset/scores")
|
|
async def api_reset_scores(req: Request):
|
|
"""Admin: wipe leaderboard (all solves)."""
|
|
require_login(req)
|
|
return orch.reset_scores()
|
|
|
|
@app.post("/api/reset/environment")
|
|
async def api_reset_environment(req: Request):
|
|
"""Admin: full environment reset (stop all, remove teams/containers/receivers)."""
|
|
require_login(req)
|
|
return orch.reset_environment()
|
|
|
|
|
|
@app.post("/api/flag/submit")
|
|
async def api_flag_submit(req: Request):
|
|
"""Public endpoint: teams submit flags. No login needed.
|
|
body: {team: attacker, target?: victim, challenge, flag}"""
|
|
data = await req.json()
|
|
team = int(data.get("team", 0)) # attacker (tim yang submit)
|
|
target = int(data.get("target") or 0) or team # victim team (flag dicuri dari sini)
|
|
chall = data.get("challenge", "")
|
|
flag = data.get("flag", "").strip()
|
|
team_name = data.get("team_name", "").strip()[:64] or f"Team {team}"
|
|
if team <= 0:
|
|
return {"success": False, "error": "Select your team"}
|
|
if chall not in [c[0] for c in orch.CHALLENGES]:
|
|
return {"success": False, "error": "Challenge not found"}
|
|
if not flag:
|
|
return {"success": False, "error": "Flag is required"}
|
|
return orch.submit_flag(target, chall, flag, attacker_idx=team, attacker_name=team_name)
|
|
|
|
@app.get("/api/attacks")
|
|
async def api_attacks(req: Request):
|
|
"""Admin: recent attack events (attacker -> target) for the topology visualizer."""
|
|
require_login(req)
|
|
ap = orch.TEAMS_DIR / "attacks.json"
|
|
if ap.exists():
|
|
log = json.loads(ap.read_text())
|
|
else:
|
|
log = {"events": []}
|
|
return {"events": log.get("events", [])}
|
|
|
|
|
|
@app.get("/api/leaderboard")
|
|
async def api_leaderboard(req: Request):
|
|
"""Leaderboard of solves so far. Team names resolved LIVE from state.json
|
|
so renaming a team updates leaderboard + topology everywhere."""
|
|
lb_path = orch.TEAMS_DIR / "leaderboard.json"
|
|
if lb_path.exists():
|
|
lb = json.loads(lb_path.read_text())
|
|
else:
|
|
lb = {"solves": []}
|
|
# live name lookup: state.json label fallback to snapshot
|
|
def team_name(idx):
|
|
try:
|
|
st = json.loads((orch.TEAMS_DIR / f"team{idx}" / "state.json").read_text())
|
|
return st.get("label") or f"Team {idx}"
|
|
except Exception:
|
|
return f"Team {idx}"
|
|
# aggregate per team
|
|
teams = {}
|
|
for e in lb["solves"]:
|
|
name = team_name(e["team"])
|
|
t = teams.setdefault(e["team"], {"team": e["team"], "name": name, "solves": 0, "challs": []})
|
|
t["name"] = name
|
|
t["solves"] += 1
|
|
t["challs"].append(e["challenge"])
|
|
return {"solves": lb["solves"], "teams": sorted(teams.values(), key=lambda x: -x["solves"])}
|
|
|
|
|
|
@app.get("/api/public/teams")
|
|
async def api_public_teams():
|
|
"""Public list of team names (for the submit dropdown)."""
|
|
return {"teams": [{"index": t["index"], "label": t.get("label", f"Team {t['index']}")} for t in orch.list_teams()]}
|
|
|
|
@app.get("/api/targets")
|
|
async def api_admin_targets(req: Request):
|
|
"""Admin: matrix of every team's service domain:port (public targets)."""
|
|
require_login(req)
|
|
out = []
|
|
for d in sorted(orch.TEAMS_DIR.glob("team*")):
|
|
if not (d / "state.json").exists():
|
|
continue
|
|
st = json.loads((d / "state.json").read_text())
|
|
dom = st.get("domain") or (st.get("slug", f"team{st.get('index')}") + ".gemastik.imrnes.team")
|
|
for name, coff, soff in orch.CHALLENGES:
|
|
p = st["ports"].get(name)
|
|
if not p:
|
|
continue
|
|
out.append({
|
|
"team": st.get("index"),
|
|
"team_label": st.get("label", f"Team {st.get('index')}"),
|
|
"challenge": name,
|
|
"domain": dom,
|
|
"port": p["chall"],
|
|
})
|
|
return {"targets": out}
|
|
|
|
|
|
# ============ WebSocket SSH terminal (team portal) ============
|
|
import paramiko
|
|
import websockets
|
|
|
|
@app.websocket("/api/team/{idx}/ssh/ws")
|
|
async def team_ssh_ws(ws: WebSocket, idx: int):
|
|
chall = ws.query_params.get("chall", "")
|
|
# auth: team session cookie must match this team
|
|
token = ws.cookies.get("team_token")
|
|
e = _team_sessions.get(token or "")
|
|
if not e or e[0] != idx or e[1] < time.time():
|
|
await ws.close(code=4001, reason="unauthorized")
|
|
return
|
|
td = orch.TEAMS_DIR / f"team{idx}"
|
|
st = json.loads((td / "state.json").read_text())
|
|
# host check (IDOR): only this team's domain can open its SSH
|
|
host = (ws.headers.get("host") or "").split(":")[0]
|
|
if not (host == st.get("domain") or host.startswith("127.0.0.1") or host.startswith("localhost")):
|
|
await ws.close(code=4003, reason="wrong host")
|
|
return
|
|
if chall not in st.get("ports", {}):
|
|
await ws.close(code=4002, reason="unknown challenge")
|
|
return
|
|
recv_port = st["ports"][chall]["ssh"]
|
|
user = st.get("ssh_user", "ctfuser")
|
|
# each challenge container has its own password (chall_passwords);
|
|
# ssh_pass is the portal login password (may differ).
|
|
pw = st.get("chall_passwords", {}).get(chall) or st.get("ssh_pass", "")
|
|
await ws.accept()
|
|
chan = client = None
|
|
try:
|
|
client = paramiko.SSHClient()
|
|
client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
|
|
loop = asyncio.get_event_loop()
|
|
await loop.run_in_executor(
|
|
None, lambda: client.connect("127.0.0.1", port=recv_port, username=user,
|
|
password=pw, timeout=10, allow_agent=False,
|
|
look_for_keys=False))
|
|
chan = client.invoke_shell(term="xterm-256color", width=120, height=32)
|
|
|
|
async def ws_to_ssh():
|
|
while True:
|
|
try:
|
|
msg = await ws.receive_text()
|
|
except Exception:
|
|
break
|
|
if msg.startswith("__resize__"):
|
|
try:
|
|
_, cols, rows = msg.split(":", 2)
|
|
chan.resize_pty(int(cols), int(rows))
|
|
except Exception:
|
|
pass
|
|
else:
|
|
try:
|
|
chan.send(msg)
|
|
except Exception:
|
|
break
|
|
|
|
async def ssh_to_ws():
|
|
# non-blocking poll: chan.recv() di dalam async task akan
|
|
# memblokir seluruh event loop (deadlock) — jadi poll recv_ready.
|
|
while True:
|
|
try:
|
|
if chan.recv_ready():
|
|
data = chan.recv(4096)
|
|
if not data:
|
|
break
|
|
await ws.send_text(data.decode("utf-8", "replace"))
|
|
elif chan.closed:
|
|
break
|
|
except Exception:
|
|
break
|
|
await asyncio.sleep(0.03)
|
|
|
|
t1 = asyncio.create_task(ws_to_ssh())
|
|
t2 = asyncio.create_task(ssh_to_ws())
|
|
done, pending = await asyncio.wait({t1, t2}, return_when=asyncio.FIRST_COMPLETED)
|
|
for t in pending:
|
|
t.cancel()
|
|
except Exception as e:
|
|
try:
|
|
await ws.send_text(f"\r\n[ssh error] {e}\r\n")
|
|
except Exception:
|
|
pass
|
|
finally:
|
|
try:
|
|
if chan: chan.close()
|
|
except Exception: pass
|
|
try:
|
|
if client: client.close()
|
|
except Exception: pass
|
|
try:
|
|
await ws.close()
|
|
except Exception: pass |