9 |
12 |
18 |
19 |
58 |
--------------------------------------------------------------------------------
/lib/CS/Controller/Api.pm:
--------------------------------------------------------------------------------
1 | package CS::Controller::Api;
2 | use Mojo::Base 'Mojolicious::Controller';
3 |
4 | use Sereal::Dclone 'dclone';
5 |
6 | sub info {
7 | my $c = shift;
8 |
9 | my $info = {
10 | contestName => $c->app->ctf_name,
11 | roundsCount => int($c->model('util')->game_duration)
12 | };
13 |
14 | my $teams = $c->pg->db->select('teams', [qw/id name network host details/])->expand->hashes;
15 | for my $team (@$teams) {
16 | $info->{teams}{$team->{id}} = {%{$team->{details}}, %$team};
17 | }
18 | $info->{services}{$_->{id}} = $_->{name} for values %{$c->app->services};
19 |
20 | my $time = $c->model('util')->game_time;
21 |
22 | $c->render(json => {%$info, %$time});
23 | }
24 |
25 | sub events {
26 | my $c = shift;
27 | $c->tx->with_compression;
28 | $c->inactivity_timeout(300);
29 | my $pubsub = $c->pg->pubsub;
30 |
31 | my $cb1 = $pubsub->json('scoreboard')->listen(
32 | scoreboard => sub {
33 | my $value = $c->model('scoreboard')->generate;
34 | $c->send({json => {type => 'state', value => $value}});
35 | }
36 | );
37 |
38 | my $cb2 = $pubsub->json('flag')->listen(
39 | flag => sub {
40 | my $data = dclone(pop);
41 | $data->{attacker_id} = delete $data->{team_id};
42 | $c->send({json => {type => 'attack', value => $data}});
43 | }
44 | );
45 |
46 | my $cb3 = $pubsub->listen(
47 | message => sub {
48 | my $msg = pop;
49 | $c->send({json => {type => 'message', value => $msg}});
50 | }
51 | );
52 |
53 | my $cb4 = $pubsub->listen(reload => sub { $c->send({json => {type => 'reload'}}) });
54 |
55 | $c->on(finish => sub { $pubsub->unlisten(scoreboard => $cb1)->unlisten(flag => $cb2)->unlisten(message => $cb3)->unlisten(reload => $cb4) });
56 |
57 | my $data = $c->model('scoreboard')->generate;
58 | $c->send({json => {type => 'state', value => $data}});
59 | }
60 |
61 | sub teams {
62 | my $c = shift;
63 |
64 | my $teams = $c->pg->db->query('select id, name, network from teams')->hashes->reduce(sub {
65 | $a->{$b->{id}} = {
66 | id => $b->{id},
67 | name => $b->{name},
68 | network => $b->{network}
69 | };
70 | $a
71 | }, {});
72 |
73 | $c->render(json => $teams);
74 | }
75 |
76 | sub services {
77 | my $c = shift;
78 |
79 | $c->render(json => $c->model('util')->get_active_services);
80 | }
81 |
82 | 1;
83 |
--------------------------------------------------------------------------------
/deploy/docker-compose.yml:
--------------------------------------------------------------------------------
1 | version: "2.4"
2 |
3 | x-cs: &cs-common
4 | build: .
5 | image: checksystem:latest
6 | cpu_shares: 1024
7 | init: true
8 | restart: unless-stopped
9 | volumes:
10 | - "./cs.conf:/app/cs.conf"
11 | environment:
12 | - POSTGRES_USER
13 | - POSTGRES_PASSWORD
14 | - POSTGRES_DB
15 | - POSTGRES_URI
16 | - MOJO_CONFIG=/app/cs.conf
17 |
18 | services:
19 | cs-manager:
20 | <<: *cs-common
21 | depends_on:
22 | - init
23 | command:
24 | - /bin/bash
25 | - -xc
26 | - >-
27 | while true; do
28 | perl script/cs check_db
29 | if [[ $$? == 0 ]]; then break; fi
30 | sleep 2
31 | done &&
32 | perl script/cs manager
33 |
34 | cs-web:
35 | <<: *cs-common
36 | depends_on:
37 | - init
38 | ports:
39 | - "80:8080"
40 | command:
41 | - /bin/bash
42 | - -xc
43 | - >-
44 | while true; do
45 | perl script/cs check_db
46 | if [[ $$? == 0 ]]; then break; fi
47 | sleep 2
48 | done &&
49 | hypnotoad -f script/cs
50 |
51 | cs-workers:
52 | <<: *cs-common
53 | depends_on:
54 | - init
55 | scale: 4
56 | command:
57 | - /bin/bash
58 | - -xc
59 | - >-
60 | while true; do
61 | perl script/cs check_db
62 | if [[ $$? == 0 ]]; then break; fi
63 | sleep 2
64 | done &&
65 | perl script/cs minion worker -q default -q checker -j 64
66 |
67 | init:
68 | <<: *cs-common
69 | restart: "no"
70 | depends_on:
71 | - pg
72 | command:
73 | - /bin/bash
74 | - -xc
75 | - >-
76 | while true; do
77 | perl script/cs check_db
78 | if [[ $$? == 0 ]]; then break; fi
79 |
80 | perl script/cs init_db
81 | if [[ $$? == 0 ]]; then break; fi
82 |
83 | sleep 2
84 | done
85 |
86 | pg:
87 | image: postgres
88 | cpu_shares: 1024
89 | volumes:
90 | - "cs_pg_data:/var/lib/postgresql/data"
91 | environment:
92 | - POSTGRES_USER
93 | - POSTGRES_PASSWORD
94 | - POSTGRES_DB
95 | command:
96 | - -c
97 | - shared_buffers=4GB
98 | - -c
99 | - work_mem=8MB
100 | - -c
101 | - max_connections=1024
102 |
103 | volumes:
104 | cs_pg_data:
105 |
--------------------------------------------------------------------------------
/lib/CS/Command/init_db.pm:
--------------------------------------------------------------------------------
1 | package CS::Command::init_db;
2 | use Mojo::Base 'Mojolicious::Command';
3 |
4 | has description => 'Init db schema';
5 |
6 | sub run {
7 | my $app = shift->app;
8 | my $db = $app->pg->db;
9 |
10 | # Teams
11 | for my $team (@{$app->config->{teams}}) {
12 | my $values = {
13 | name => delete $team->{name},
14 | network => delete $team->{network},
15 | host => delete $team->{host},
16 | token => delete $team->{token}
17 | };
18 | $values->{id} = delete $team->{id} if defined $team->{id};
19 | my $details = {details => {-json => $team}};
20 | $db->insert(teams => {%$values, %$details});
21 | }
22 |
23 | # Services
24 | for my $service (@{$app->config->{services}}) {
25 | my $service_info = $app->model('checker')->info($service);
26 |
27 | my $service_data = {
28 | name => $service->{name},
29 | timeout => $service->{timeout},
30 | path => $service->{path},
31 | vulns => $service_info->{vulns}{distribution},
32 | public_flag_description => $service_info->{public_flag_description}
33 | };
34 | $service_data->{id} = $service->{id} if defined $service->{id};
35 | if (my $active = $service->{active}) {
36 | $service_data->{ts_start} = $active->[0];
37 | $service_data->{ts_end} = $active->[1];
38 | }
39 | my $service_id = $db->insert(services => $service_data, {returning => 'id'})->hash->{id};
40 |
41 | $db->insert(vulns => {service_id => $service_id, n => $_}) for 1 .. $service_info->{vulns}{count};
42 | }
43 |
44 | # Scores
45 | $db->insert(rounds => {n => 0});
46 | $db->query(q{
47 | insert into service_activity (round, service_id, active, phase)
48 | select 0, id, false, 'NOT_RELEASED' from services
49 | });
50 | $db->query('
51 | insert into flag_points (round, team_id, service_id, amount)
52 | select 0, teams.id, services.id, 0 from teams cross join services
53 | ');
54 | my $teams = $db->select('teams', ['id', 'details'])->expand->hashes;
55 | for my $team (@$teams) {
56 | for my $service_id (keys %{$team->{details}{initial_flag_points} // {}}) {
57 | $db->query('
58 | update flag_points set amount = ?
59 | where round = 0 and team_id = ? and service_id = ?
60 | ', $team->{details}{initial_flag_points}{$service_id}, $team->{id}, $service_id);
61 | }
62 | }
63 | $db->query('
64 | insert into sla (round, team_id, service_id, successed, failed)
65 | select 0, teams.id, services.id, 0, 0 from teams cross join services
66 | ');
67 | $app->model('score')->scoreboard($db, 0);
68 | }
69 |
70 | 1;
71 |
--------------------------------------------------------------------------------
/CONFIGURE.md:
--------------------------------------------------------------------------------
1 | # Intro
2 |
3 | Config file for the checksystem is a just [Perl file](https://docs.mojolicious.org/Mojolicious/Plugin/Config) which returning a hash object. You can found example at [cs.conf.example](cs.conf.example).
4 |
5 | # Available options:
6 |
7 | - `hypnotoad`: this hash describe the settings about hypnotoad web server. You can read details in the [official documentation](https://docs.mojolicious.org/Mojo/Server/Hypnotoad).
8 | - `postgres_uri`: [connection string](https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-CONNSTRING) for postgres database. You can override this option by `POSTGRES_URI` environmental variable.
9 | - `base_url`: base `url` which used to create a right redirect urls. Useful if you publish scoreboard in the Internet.
10 | - `cs.time`: list of the game's periods. You must specify the time in the same time zone as the server that runs the checksystem. If you use [docker deploy](deploy/README.md) then specify time in `UTC` time zone. If you don't specify `cs.time` option, then the game will be endless, which can be convenient for trainings.
11 | - `cs.round_length`: length of round in seconds. Default value is `60`
12 | - `cs.flag_life_time`: time of flag's life in rounds. Doesn't persist after any breaks in the game. Default value is `15`.
13 | - `cs.flags_secret`: secret key for HMAC in flag's data.
14 | - `cs.checkers.hostname`: an optional callback function to detect an address of vuln's service which passed to the checkers.
15 | - `cs.ctf_name`: a name of the CTF, displayed in the scoreboard. Default vaule is `CTF`.
16 | - `cs.admin_auth`: a basic auth creadentials of admin page (which can be accessed by `/admin` route).
17 | - `cs.scoring`: this hash object describe the settings about the [scoring](https://docs.google.com/document/d/1uU9f38UpxdsMeuAsM5TAnp_i4T-DhM-Ur9JOxUeTc8M/preview#heading=h.xdi2syovqugn).
18 | - `teams`: a list of the [teams](#teams).
19 | - `services`: a list of the [services](#services).
20 |
21 | ## teams
22 |
23 | - `name`:
24 | - `network`:
25 | - `host`:
26 | - `logo`:
27 | - `token`:
28 | - `tags`:
29 |
30 | ## services
31 |
32 | Available attributes of the service's hash:
33 |
34 | - `name`: a name of the service.
35 | - `path`: a path (absolute or relative to the root catalog of this project) to the service's main executable file.
36 | - `timeout`: an amount in seconds of checker's timeout. The service will have the status `down` in the current round if there is a timeout. An actual timeout for current stage (`check`, `put`, `get`) in the round is calculated as miniumum of the `timeout` from config and time prior to the start of the next round.
37 | - `tcp_port`: a main tcp port of the service.
38 |
--------------------------------------------------------------------------------
/ansible/roles/web/templates/cs.nginx.conf.j2:
--------------------------------------------------------------------------------
1 | proxy_cache_path /var/cache/nginx/cs keys_zone=cs:10m max_size=512m inactive=300s;
2 | proxy_cache_path /var/cache/nginx/cs_flag_ids keys_zone=cs_flag_ids:10m max_size=512m inactive=300s;
3 |
4 | log_format cs '$remote_addr - $remote_user [$time_local] "$request" '
5 | '$status $body_bytes_sent "$http_referer" '
6 | '"$http_user_agent" "$http_x_forwarded_for" '
7 | '$request_time "$upstream_addr" $upstream_response_time';
8 |
9 | upstream cs {
10 | server {{ cs_hypnotoad_listen }} max_fails=5 fail_timeout=5s;
11 | keepalive {{ cs_nginx_upstream_keepalive }};
12 | }
13 |
14 | upstream cs_flags {
15 | {% for server in cs_hypnotoad_flags_listen -%}
16 | server {{ server }} max_fails=5 fail_timeout=5s;
17 | {% endfor -%}
18 | keepalive {{ cs_nginx_upstream_keepalive }};
19 | }
20 |
21 | map $http_upgrade $connection_upgrade {
22 | '' close;
23 | default upgrade;
24 | }
25 |
26 | map $request_uri $do_not_cache {
27 | "~*scoreboard.json" "0";
28 | default "1";
29 | }
30 |
31 | server {
32 | listen {{ cs_nginx_listen }};
33 |
34 | {% if 'https' == cs_base_url|urlsplit('scheme') -%}
35 | listen 443 ssl;
36 | ssl_certificate /etc/letsencrypt/live/{{ cs_base_url|urlsplit('hostname') }}/fullchain.pem;
37 | ssl_certificate_key /etc/letsencrypt/live/{{ cs_base_url|urlsplit('hostname') }}/privkey.pem;
38 | {% endif %}
39 |
40 | access_log /var/log/nginx/cs.access.log cs;
41 |
42 | gzip on;
43 | gzip_types text/plain text/css application/javascript application/json;
44 |
45 | client_max_body_size 24m;
46 | client_body_buffer_size 8m;
47 |
48 | proxy_http_version 1.1;
49 |
50 | proxy_max_temp_file_size 0;
51 |
52 | proxy_connect_timeout 5s;
53 |
54 | proxy_set_header X-Real-IP $remote_addr;
55 | proxy_set_header Host $http_host;
56 | proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
57 |
58 | proxy_set_header Upgrade $http_upgrade;
59 | proxy_set_header Connection $connection_upgrade;
60 |
61 | location / {
62 | proxy_pass http://cs;
63 |
64 | proxy_cache cs;
65 | proxy_no_cache $do_not_cache;
66 | proxy_cache_valid 15s;
67 | }
68 |
69 | location /flag_ids {
70 | proxy_pass http://cs;
71 |
72 | proxy_cache cs_flag_ids;
73 | proxy_cache_valid 15s;
74 | proxy_cache_key "$uri$is_args$args$http_x_team_token";
75 | }
76 |
77 | location /flags {
78 | proxy_pass http://cs_flags;
79 | proxy_next_upstream non_idempotent error timeout;
80 | proxy_next_upstream_timeout 20ms;
81 | }
82 |
83 | location /data {
84 | alias /var/www;
85 | }
86 |
87 | location = /basic_status {
88 | stub_status;
89 | }
90 | }
91 |
--------------------------------------------------------------------------------
/public/css/default.css:
--------------------------------------------------------------------------------
1 | /* Statuses */
2 | .status_up {
3 | background-color: #6fd6a6;
4 | }
5 |
6 | .status_corrupt {
7 | background-color: #ffef65;
8 | }
9 |
10 | .status_mumble {
11 | background-color: #f9a963;
12 | }
13 |
14 | .status_down {
15 | background-color: #e97c7c;
16 | }
17 |
18 | /* Statuses descriptions */
19 | .status_descriptions tbody tr td {
20 | padding: 10px 0px;
21 | color: #500A0A;
22 | }
23 |
24 | #scoreboard_wrapper {
25 | text-align: center;
26 | }
27 |
28 | /* Scoreboard */
29 | #scoreboard .table-bordered > tbody > tr > th,
30 | #scoreboard .table-bordered > thead > tr > th,
31 | #scoreboard .table-bordered > tbody > tr > td,
32 | #scoreboard .table-bordered > thead > tr > td {
33 | border-right-width: 0px;
34 | border-left-width: 0px;
35 | border-bottom: 1px solid #ddd;
36 | }
37 |
38 | /* Gold, silve and bronze places */
39 | #scoreboard table.scoreboard tr.team:nth-child(1) td:not(.team_service) {
40 | background-color: #FFE8A7;
41 | }
42 |
43 | #scoreboard table.scoreboard tr.team:nth-child(2) td:not(.team_service) {
44 | background-color: #D8D8D8;
45 | }
46 |
47 | #scoreboard table.scoreboard tr.team:nth-child(3) td:not(.team_service) {
48 | background-color: #E3B689;
49 | }
50 |
51 | #scoreboard table.scoreboard tr.team:nth-child(3) td:not(.team_service) .team_server {
52 | color: white;
53 | }
54 |
55 | /* Scoreboard's team and service */
56 | .team .score,
57 | .team .team_info,
58 | .team .team_logo,
59 | .team .place {
60 | vertical-align: middle;
61 | }
62 |
63 | .team .team_logo {
64 | padding: 0px;
65 | text-align: center;
66 | }
67 |
68 | #scoreboard table tr.team:nth-child(-n+3) .team_logo img {
69 | box-shadow: 0px 0px 5px 0px rgba(212, 212, 212, 0.75);
70 | }
71 |
72 | .team .team_info {
73 | padding-left: 10px;
74 | }
75 |
76 | .team .place,
77 | #scoreboard th.place {
78 | text-align: center;
79 | }
80 |
81 | #scoreboard th.service_name {
82 | padding-left: 10px;
83 | white-space: nowrap;
84 | }
85 |
86 | .team .team_info .team_name {
87 | color: #222;
88 | font-weight: bold;
89 | max-width: 250px;
90 | }
91 |
92 | .team_name a {
93 | color: #222;
94 | text-decoration: underline;
95 | }
96 |
97 | .team .team_info .team_server {
98 | color: #999;
99 | max-width: 250px;
100 | }
101 |
102 | .team .team_service {
103 | text-align: left;
104 | font-size: 9pt;
105 | padding: 10px 10px !important;
106 | }
107 |
108 | .team .team_service > div {
109 | display: table-row;
110 | }
111 |
112 | .team .team_service .param_name,
113 | .team .team_service .param_value {
114 | display: table-cell;
115 | }
116 |
117 | .team .team_service .param_name {
118 | font-weight: bold;
119 | }
120 |
121 | .team .team_service .param_value {
122 | padding-left: 3px;
123 | }
124 |
125 | #scoreboard table tr:last-child td {
126 | border-bottom: 1px solid #ddd;
127 | }
128 |
--------------------------------------------------------------------------------
/lib/CS/Controller/Flags.pm:
--------------------------------------------------------------------------------
1 | package CS::Controller::Flags;
2 | use Mojo::Base 'Mojolicious::Controller';
3 |
4 | sub put {
5 | my $c = shift->render_later;
6 |
7 | my ($game_status) = $c->app->model('util')->game_status;
8 | unless ($game_status == 1) {
9 | return $c->render(json => {status => \0, msg => 'Game is not active for now'}, status => 400);
10 | }
11 |
12 | if ($c->req->body_size > 16 * 1024) {
13 | return $c->render(json => {status => \0, msg => 'Message is too big'}, status => 400);
14 | }
15 |
16 | my $token = $c->req->headers->header('X-Team-Token') // '';
17 | return $c->render(json => {status => \0, msg => "Invalid token '$token'"}, status => 400)
18 | unless my $team = $c->pg->db->select('teams', ['id'], {token => $token})->hash;
19 |
20 | my $flags = $c->req->json;
21 | return $c->render(json => {status => \0, msg => 'Invalid format'}, status => 400)
22 | unless ref $flags eq 'ARRAY';
23 |
24 | my $results = [];
25 |
26 | my $do;
27 | $do = sub {
28 | my $flag = shift @$flags;
29 |
30 | unless ($flag) {
31 | undef $do;
32 | $c->render(json => $results);
33 | return;
34 | }
35 |
36 | $c->model('flag')->accept(
37 | $team->{id}, $flag,
38 | sub {
39 | my $msg = $_[0]->{ok} ? $_[0]->{message} : $_[0]->{error};
40 | push @$results, {flag => $flag, status => \$_[0]->{ok}, msg => $msg};
41 | $do->();
42 | }
43 | );
44 | };
45 |
46 | $do->();
47 | }
48 |
49 | sub list {
50 | my $c = shift;
51 |
52 | my $token = $c->req->headers->header('X-Team-Token') // '';
53 | return $c->render(json => {status => \0, msg => 'Invalid token'}, status => 400)
54 | unless my $team = $c->pg->db->select('teams', ['id'], {token => $token})->hash;
55 |
56 | return $c->render(json => {status => \0, msg => 'Invalid service_id'}, status => 400)
57 | unless my $service = $c->app->services->{$c->param('service_id') // $c->param('service')};
58 |
59 | my $flags = $c->pg->db->query(q{
60 | select
61 | t.id,
62 | json_build_object(
63 | 'id', t.id,
64 | 'name', name,
65 | 'network', network,
66 | 'host', host,
67 | 'details', details
68 | ) as team,
69 | array_agg(public_id) filter (where public_id is not null) as flag_ids
70 | from (
71 | select * from flags
72 | where
73 | service_id = ? and team_id != ? and
74 | public_id is not null and not expired
75 | ) as f
76 | right join teams as t on t.id = f.team_id
77 | group by t.id
78 | }, $service->{id}, $team->{id});
79 | my $flag_ids = $flags->expand->hashes->reduce(sub {
80 | $a->{$b->{id}}{host} = $c->model('util')->get_service_host($b->{team}, $service);
81 | $a->{$b->{id}}{flag_ids} = $b->{flag_ids} // [];
82 | $a;
83 | }, {});
84 |
85 | $c->render(json => {
86 | flag_id_description => $service->{public_flag_description},
87 | flag_ids => $flag_ids
88 | });
89 | }
90 |
91 | 1;
92 |
--------------------------------------------------------------------------------
/templates/scoreboard.html.ep:
--------------------------------------------------------------------------------
1 | % my $checker = app->model('checker');
2 | <%= $team->{name} %>
10 | 11 || <%= uc $status->[0] %> | 15 | % } 16 |
20 |
21 |
22 |
56 |
57 | | # | 24 |round | 25 |score | 26 | % for my $sid (sort { $a <=> $b } keys %{app->services}) { 27 |<%= app->services->{$sid}{name} %> | 28 | % } 29 |
|---|---|---|---|
| <%= $team->{n} %> | 35 |<%= $team->{round} %> | 36 |<%= $team->{score} %> | 37 | % for my $service (@{$team->{services}}) { 38 |
42 | SLA <%= $service->{sla} %>% FP <%= $service->{fp} %> ⚑
45 | <%= $service->{flags} %>
46 | % if (my $sflags = $service->{sflags}) {
47 | / -<%= $service->{sflags} %>
48 | % }
49 | |
51 | % }
52 |
3 |
4 |
10 |
64 |
--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | # Checksystem
2 |
3 | It's a scalable competition platform for attack-defense [CTF](https://en.wikipedia.org/wiki/Capture_the_flag_(cybersecurity)).
4 |
5 | It's written in [Perl](https://www.perl.org/) with [Mojolicious](https://www.mojolicious.org/) framework.
6 |
7 | ## Architecture
8 |
9 | - `cs-manager`: a component that is responsible for the beginning and ending of the game, for managing breaks, for generating rounds. After the start of the round it puts tasks in the queue for launching checkers and also puts the task in the queue for calculating the scoreboard for the past rounds.
10 |
11 | - `cs-watcher`: an optional component which periodically (several times per round) checks the availability of the TCP port for each service and team and skips launching the checkers if the port is not available.
12 |
13 | - `postgres`: the [database](https://www.postgresql.org/) which used to store all the data required for the checksystem. It's also used as a backend for the [Minion](https://docs.mojolicious.org/Minion) job queue.
14 |
15 | - `cs-worker`: the minion workers which runs the checkers for teams and services.
16 |
17 | - `cs-web`: the [hypnotoad](https://docs.mojolicious.org/hypnotoad) which serves checksystem's web components: scoreboars, API, flags.
18 |
19 | ## Useful URLs
20 |
21 | - `/board`: a built-in scoreboard with simple html table with teams, services and scores.
22 | - `/admin`: an admin page for the game which allows to view checker's logs.
23 | - `/admin/info`: an admin page with useful game statistics.
24 | - `/admin/minion`: an admin page with jobs statistics.
25 | - `/ctftime/scoreboard.json`: a scoreboard in [CTFtime](https://ctftime.org/) format.
26 |
27 | ## HTTP API
28 |
29 | ### For scoreboard
30 |
31 | ### For teams
32 |
33 | ## API between checkers and checksystem
34 |
35 | Checker is an executable file that get input from the checksystem via args and `STDIN` and return output via exit code and `STDOUT/STDERR`.
36 |
37 | Checksystem runs checkers with that format: `/path/to/checker mode host id flag`
38 |
39 | ### Modes
40 |
41 | #### INFO
42 |
43 | Cheker must return `101` exit code and print to `STDOUT` lines with `key: value` format. Supported keys:
44 |
45 | - `public_flag_description`: description of flag in the service for teams.
46 | - `vulns`: number of vulns in the service, must be set to `1`.
47 |
48 | ##### CHECK
49 |
50 | The checker must check the general functionality of the service at `host`.
51 |
52 | ##### PUT
53 |
54 | The checker must put the `flag` to the service at `host` by `id`. If exit code is 101 then checker should print to `STDOUT` a `JSON object` with `public_flag_id` field wich will be accessible to the teams. You can add any additional fields to the object. This `JSON object` will be passed to the `GET` mode in the future.
55 |
56 | ##### GET
57 |
58 | The checker must try to get `flag` from the service at `host` by `id`.
59 | ### Exit codes
60 |
61 | - `101` OK.
62 | - `102` CORRUPT: The service works fine, but there is no requested flag (only in `get` mode)
63 | - `103` MUMBLE: The service works incorrect
64 | - `104` DOWN: The service doesn't work.
65 | - `110` CHECKER ERROR: Internal error of checker.
66 |
--------------------------------------------------------------------------------
/templates/admin/view.html.ep:
--------------------------------------------------------------------------------
1 | % layout 'default';
2 | % title '[admin] ' . app->ctf_name;
3 |
4 | % my $view_line = begin
5 | % my ($name, $data) = @_;
6 | % if ($data) {
7 | | <%== uc $status->[0] %> | 7 | % } 8 |
11 |
12 |
13 |
62 |
63 | | # | 15 |team | 16 |score | 17 | % for my $sid (sort { $a <=> $b } keys %{app->services}) { 18 |<%== app->services->{$sid}{name} %> | 19 | % } 20 ||
|---|---|---|---|---|
| <%== $team->{n} %><%== $suffix %> | 27 | |
28 |
29 |
32 | <%== $team->{host} %>
33 | |
34 | <%== $team->{score} %> | 35 | % for my $service (@{$team->{services}}) { 36 |
40 | % if (current_route eq 'admin_index') {
41 |
42 |
44 |
45 |
46 |
47 | % }
48 | SLA <%== $service->{sla} %>% FP <%== $service->{fp} %> ⚑
51 | <%== $service->{flags} %>
52 | % if (my $sflags = $service->{sflags}) {
53 | / -<%== $service->{sflags} %>
54 | % }
55 | |
57 | % }
58 |
25 |
48 |
79 |
80 | %= $paging->();
81 |
82 |
--------------------------------------------------------------------------------
/ansible/cs-start.yml:
--------------------------------------------------------------------------------
1 | - hosts: master
2 | tasks:
3 | - name: start web
4 | docker_container:
5 | name: cs_web
6 | image: "{{ cs_docker_image }}"
7 | command: "hypnotoad -f script/cs"
8 | init: true
9 | container_default_behavior: no_defaults
10 | restart_policy: unless-stopped
11 | detach: yes
12 | published_ports:
13 | - "{{ private_ip }}:{{ cs_hypnotoad_listen.split(':') | last }}:{{ cs_hypnotoad_listen.split(':') | last }}"
14 | env:
15 | POSTGRES_URI: "postgresql://{{ pg_cs_user }}:{{ pg_cs_pass }}@{{ pg_cs_host }}/{{ pg_cs_db }}"
16 |
17 | - name: start manager
18 | docker_container:
19 | name: cs_manager
20 | image: "{{ cs_docker_image }}"
21 | command: "perl script/cs manager"
22 | init: true
23 | container_default_behavior: no_defaults
24 | restart_policy: unless-stopped
25 | detach: yes
26 | env:
27 | POSTGRES_URI: "postgresql://{{ pg_cs_user }}:{{ pg_cs_pass }}@{{ pg_cs_host }}/{{ pg_cs_db }}"
28 |
29 | - name: start default worker
30 | docker_container:
31 | name: cs_default_worker
32 | image: "{{ cs_docker_image }}"
33 | command: "perl script/cs minion worker -q default -j {{ cs_worker_default_jobs }}"
34 | init: true
35 | container_default_behavior: no_defaults
36 | restart_policy: unless-stopped
37 | detach: yes
38 | env:
39 | POSTGRES_URI: "postgresql://{{ pg_cs_user }}:{{ pg_cs_pass }}@{{ pg_cs_host }}/{{ pg_cs_db }}"
40 |
41 | - name: start watcher
42 | docker_container:
43 | name: cs_watcher
44 | image: "{{ cs_docker_image }}"
45 | command: "perl script/cs watcher"
46 | init: true
47 | container_default_behavior: no_defaults
48 | restart_policy: unless-stopped
49 | detach: yes
50 | ulimits:
51 | - "nofile:{{ cs_limit_nofile }}"
52 | env:
53 | POSTGRES_URI: "postgresql://{{ pg_cs_user }}:{{ pg_cs_pass }}@{{ pg_cs_host }}/{{ pg_cs_db }}"
54 |
55 | - hosts: flags
56 | tasks:
57 | - name: start web flags
58 | docker_container:
59 | name: cs_web_flags
60 | image: "{{ cs_docker_image }}"
61 | command: "hypnotoad -f script/cs"
62 | init: true
63 | container_default_behavior: no_defaults
64 | restart_policy: unless-stopped
65 | detach: yes
66 | published_ports:
67 | - "{{ private_ip }}:{{ cs_hypnotoad_flags_port }}:{{ cs_hypnotoad_flags_port }}"
68 | env:
69 | POSTGRES_URI: "postgresql://{{ pg_cs_user }}:{{ pg_cs_pass }}@{{ pg_cs_host }}/{{ pg_cs_db }}"
70 |
71 | - hosts: checkers
72 | tasks:
73 | - name: start checkers
74 | docker_container:
75 | name: "cs_checker_worker_{{ item }}"
76 | image: "{{ cs_docker_image }}"
77 | command: "perl script/cs minion worker {{ cs_worker_checkers_queues }} -j {{ cs_worker_checkers_jobs }}"
78 | init: true
79 | container_default_behavior: no_defaults
80 | restart_policy: unless-stopped
81 | detach: yes
82 | env:
83 | POSTGRES_URI: "postgresql://{{ pg_cs_user }}:{{ pg_cs_pass }}@{{ pg_cs_host }}/{{ pg_cs_db }}"
84 | with_sequence: count={{ cs_worker_instance }}
85 |
--------------------------------------------------------------------------------
/lib/CS/Command/manager.pm:
--------------------------------------------------------------------------------
1 | package CS::Command::manager;
2 | use Mojo::Base 'Mojolicious::Command';
3 |
4 | use List::Util 'max';
5 | use Mojo::Collection 'c';
6 |
7 | has description => 'Run CTF game';
8 |
9 | has round => sub { $_[0]->app->pg->db->select(rounds => 'max(n)')->array->[0] };
10 |
11 | sub run {
12 | my $self = shift;
13 | my $app = $self->app;
14 |
15 | my $start = $app->model('util')->game_time->{start} // 0;
16 |
17 | my $sleep;
18 | if (time < $start) { $sleep = $start - time }
19 | else {
20 | my $round_start =
21 | $app->round_length + $app->pg->db->select(rounds => 'extract(epoch from max(ts))')->array->[0];
22 | $sleep = time > $round_start ? 0 : $round_start - time;
23 | }
24 |
25 | Mojo::IOLoop->timer(
26 | $sleep => sub {
27 | Mojo::IOLoop->recurring($app->round_length => sub { $self->start_round });
28 | $self->start_round;
29 | }
30 | );
31 | Mojo::IOLoop->start;
32 | }
33 |
34 | sub start_round {
35 | my $self = shift;
36 | my $app = $self->app;
37 |
38 | # Check end of game
39 | my ($game_status, $init_round) = $app->model('util')->game_status;
40 | $app->minion->enqueue(scoreboard => [$self->round]) if $game_status == -1;
41 | return unless $game_status == 1;
42 |
43 | my $db = $app->pg->db;
44 | my $round = $db->insert('rounds', {n => \'(select max(n)+1 from rounds)'}, {returning => 'n'})->hash->{n};
45 | $self->round($round);
46 | $app->minion->enqueue(scoreboard => [] => {delay => 10});
47 | $app->log->debug("Start new round #$round");
48 |
49 | my $status = $self->get_monitor_status;
50 | my $active_services = $app->model('util')->update_service_phases($round);
51 |
52 | my $check_round = $round - $app->flag_life_time;
53 | if ($init_round && $init_round > 1) {
54 | $check_round = max($check_round, $init_round - 1);
55 | }
56 | $db->query(q{
57 | update flags set expired = true
58 | where expired = false and round <= ?
59 | }, $check_round);
60 |
61 | my $alive_flags = $db->query(q{
62 | select team_id, vuln_id, json_agg(json_build_object('id', id, 'data', data)) as flags
63 | from flags
64 | where ack = true and expired = false
65 | group by team_id, vuln_id
66 | })->expand->hashes->reduce(sub { $a->{$b->{team_id}}{$b->{vuln_id}} = $b->{flags}; $a; }, {});
67 |
68 | my $teams = $db->select('teams', ['id'])->arrays->flatten;
69 | for my $team_id (@$teams) {
70 | for my $service (values %{$app->services}) {
71 | my $service_id = $service->{id};
72 | my $n = $service->{vulns}->[$round % @{$service->{vulns}}];
73 | my $vuln_id = $app->vulns->{$service_id}{$n};
74 |
75 | if (!$active_services->{$service_id}) {
76 | $self->skip_check({team_id => $team_id, service_id => $service_id, vuln_id => $vuln_id}, 111, 'Service was disabled.');
77 | $app->log->debug("Skip service #$service_id in round #$round for team #$team_id");
78 | next;
79 | }
80 |
81 | if (my $s = $status->{$team_id}{$service_id}) {
82 | if ($round - $s->{round} <= 1 && !$s->{status}) {
83 | $self->skip_check({team_id => $team_id, service_id => $service_id, vuln_id => $vuln_id});
84 | next;
85 | }
86 | }
87 |
88 | my $flag = $app->model('flag')->create($team_id);
89 | my $old_flag = c(@{$alive_flags->{$team_id}{$vuln_id}})->shuffle->first;
90 |
91 | $app->minion->enqueue(
92 | check => [$round, $team_id, $service_id, $flag, $old_flag, {n => $n, id => $vuln_id}], {queue => 'checker'}
93 | );
94 | }
95 | }
96 | }
97 |
98 | sub get_monitor_status {
99 | my $self = shift;
100 |
101 | return $self->app->pg->db->query(
102 | 'select distinct on (team_id, service_id) *
103 | from monitor order by team_id, service_id, ts desc'
104 | )->hashes->reduce(
105 | sub { $a->{$b->{team_id}}{$b->{service_id}} = {round => $b->{round}, status => $b->{status}}; $a }, {}
106 | );
107 | }
108 |
109 | sub skip_check {
110 | my ($self, $info, $code, $message) = @_;
111 | $code //= 104;
112 | $message //= 'Checker did not run, connect on port was failed.';
113 |
114 | $self->app->pg->db->query(
115 | 'insert into runs (round, team_id, service_id, vuln_id, status, result) values (?, ?, ?, ?, ?, ?)',
116 | $self->round, $info->{team_id}, $info->{service_id}, $info->{vuln_id}, $code,
117 | {json => {error => $message}}
118 | );
119 | }
120 |
121 | 1;
122 |
--------------------------------------------------------------------------------
/lib/CS/Model/Scoreboard.pm:
--------------------------------------------------------------------------------
1 | package CS::Model::Scoreboard;
2 | use Mojo::Base 'MojoX::Model';
3 |
4 | sub generate {
5 | my ($self, $round, $limit) = @_;
6 | my $db = $self->app->pg->db;
7 |
8 | $round //= $db->query('select max(round) from scores')->array->[0];
9 |
10 | my $scoreboard = $db->query('
11 | select
12 | t.host, t.network, t.name, t.details, s1.n - s.n as d, s.*, s1.services as old_services, s1.score as old_score
13 | from scoreboard as s
14 | join teams as t on s.team_id = t.id
15 | left join (
16 | select * from scoreboard where round = case when $1-1<0 then 0 else $1-1 end
17 | ) as s1 using (team_id)
18 | where s.round = $1 order by n limit $2', $round, $limit)
19 | ->expand->hashes;
20 |
21 | my $services = $db->query('
22 | select
23 | s.id, name, active,
24 | extract(epoch from ts_end - now())::float8 as disable_interval,
25 | phase, flag_base_amount,
26 | extract(epoch from (
27 | select now() - ts
28 | from service_activity
29 | where phase = sa.phase and service_id = s.id
30 | order by round limit 1
31 | ))::float8 as phase_duration
32 | from service_activity as sa join services as s on sa.service_id = s.id
33 | where round = ?
34 | ', $round)->hashes->reduce(sub {
35 | $a->{$b->{id}} = {
36 | name => $b->{name},
37 | active => $b->{active},
38 | disable_interval => $b->{disable_interval},
39 | phase => $b->{phase},
40 | phase_duration => $b->{phase_duration},
41 | flag_base_amount => $b->{flag_base_amount}
42 | };
43 | $a
44 | }, {});
45 |
46 | my ($game_status) = $self->app->model('util')->game_status;
47 |
48 | return {
49 | scoreboard => $scoreboard->to_array,
50 | round => $round,
51 | services => $services,
52 | game_status => $game_status
53 | };
54 | }
55 |
56 | sub generate_history {
57 | my ($self, $round) = @_;
58 | my $db = $self->app->pg->db;
59 |
60 | $round //= $db->query('select max(round) from scores')->array->[0];
61 |
62 | my $scoreboard = $db->query(q{
63 | with a as (
64 | select *, jsonb_array_elements(services) s
65 | from scoreboard where round <= $1
66 | ),
67 | b as (
68 | select round, team_id, max(score) score,
69 | json_agg(json_build_object('flags', s->'flags', 'sflags', s->'sflags', 'fp', s->'fp', 'status', s->'status') order by s->'id') services
70 | from a
71 | group by round, team_id
72 | )
73 | select round, json_agg(json_build_object('id', team_id, 'score', score, 'services', services)) scoreboard
74 | from b
75 | group by round order by round
76 | }, $round)->expand->hashes;
77 |
78 | return $scoreboard->to_array;
79 | }
80 |
81 | sub generate_for_team {
82 | my ($self, $team_id) = @_;
83 | my $db = $self->app->pg->db;
84 |
85 | my $round = $db->query('select max(round) from scores')->array->[0];
86 | my $scoreboard = $db->query(
87 | q{
88 | select t.host, t.name, s.*
89 | from scoreboard as s
90 | join teams as t on s.team_id = t.id
91 | where team_id = $1 order by round desc
92 | }, $team_id
93 | )->expand->hashes;
94 |
95 | return {scoreboard => $scoreboard->to_array, round => $round};
96 | }
97 |
98 | sub generate_ctftime {
99 | return shift->app->pg->db->query(<<%= app->services->{param('service_id')}{name} // '*' %> on <%= $team_name %>
26 | 27 | 42 | 43 | %= $paging->(); 44 | 45 | % my $checker = app->model('checker'); 46 | 47 || round | 50 |status | 51 |result | 52 |
| <%= $result->{round} %> | 56 |<%= $result->{status} %> | 57 |
58 | %= $view_line->('Error', $result->{result}{error});
59 | % for my $state (qw/check put get_1 get_2/) {
60 | % my $r = $result->{result}{$state};
61 | % next unless $r->{command};
62 | % my $status = $checker->status2name->{$result->{status} // ''} // '';
63 | <%= $state %> [vuln_<%= $result->{result}{vuln}{n} %>] (<%= $result->{result}{$state}{ts} %>)
64 |
|
76 |