Cyrene
ae50acfe40
Passwords failed on 10/16 challenges while state.json looked correct:
- only the 6 native GEMASTIK XVIII images provision 'ctfuser'; every imported
XVI/XVII image does 'echo root:${PASSWORD} | chpasswd' and logs in as root.
set_ssh_passwords() hardcoded ctfuser, so chpasswd set a password on an
account nobody uses -> 'Permission denied' everywhere.
Registry gains a per-challenge 'ssh_user'; chpasswd now targets the real
login (and ctfuser/ctf when present) and reports failures loudly.
- phew checker: chall.py block-buffers stdout through the docker exec pipe
(PYTHONUNBUFFERED now set) and leaks chall.py inside the container on
timeout (26 orphans, container saturated) -> reaps the whole exec process
group. Startup does a fresh Pailier keygen (~12 s) so crypto reads need
_CRYPTO_TIMEOUT, not the 5 s prompt default.
Adds panel/verify_ssh_creds.py (proves the state->container binding from
inside via a real login), audit_ssh_users.sh, reset_runtime.sh.
43 lines
1.2 KiB
Python
43 lines
1.2 KiB
Python
from .Challenge import Challenge
|
|
|
|
import requests
|
|
import os
|
|
|
|
|
|
class S3(Challenge):
|
|
flag_location = 'flags/s3.txt'
|
|
history_location = 'history/s3.txt'
|
|
def distribute(self, flag):
|
|
try:
|
|
with open(self.flag_location, 'w') as f:
|
|
f.write(flag)
|
|
|
|
with open(self.history_location, 'a') as f:
|
|
f.write(flag + '\n')
|
|
|
|
self.logger.info(f'Flag {flag} written to {self.flag_location}')
|
|
return True
|
|
|
|
except Exception as e:
|
|
self.logger.error(f'Could not write flag to {self.flag_location}: {e}')
|
|
return False
|
|
|
|
def check(self):
|
|
try:
|
|
filename = self.random_string(8) + ".txt"
|
|
content = self.random_string(64)
|
|
|
|
r = requests.post(self.url(f'/upload'), files={'file': (filename, content)})
|
|
assert r.status_code == 200
|
|
assert r.text == f'Download <a href="/download?filename={filename}">here</a>'
|
|
|
|
r = requests.get(self.url(f'/download?filename={filename}'))
|
|
assert r.status_code == 200
|
|
assert r.text == content
|
|
|
|
return True
|
|
|
|
except Exception as e:
|
|
self.logger.error(f'Could not check s3: {e}')
|
|
return False
|