├── app
├── sqlite.db
├── init.py
├── Dockerfile
├── schema.sql
├── templates
│ ├── activity.html
│ ├── base.html
│ ├── index.html
│ └── notes.html
└── app.py
├── admin
├── flag.txt
├── Dockerfile
└── admin.py
├── .gitattributes
├── screenshot.png
├── DO_NOT_ACCESS
└── README.md
├── docker-compose.yaml
├── README.md
├── chrome
└── Dockerfile
└── .gitignore
/app/sqlite.db:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/admin/flag.txt:
--------------------------------------------------------------------------------
1 | CSCG{TESTFLAGTESTFLAGTESTFLAG}
--------------------------------------------------------------------------------
/.gitattributes:
--------------------------------------------------------------------------------
1 | # Auto detect text files and perform LF normalization
2 | * text=auto
3 |
--------------------------------------------------------------------------------
/screenshot.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/LiveOverflow/ctf-screenshotter/HEAD/screenshot.png
--------------------------------------------------------------------------------
/DO_NOT_ACCESS/README.md:
--------------------------------------------------------------------------------
1 | # Solution
2 |
3 | The [`DO_NOT_ACCESS`](/DO_NOT_ACCESS) folder contains the solution when you checkout the `solution` branch with `git checkout solution`.
--------------------------------------------------------------------------------
/app/init.py:
--------------------------------------------------------------------------------
1 | import sqlite3
2 | import uuid
3 | from app import DATABASE
4 |
5 | db = sqlite3.connect(DATABASE)
6 |
7 | with open('schema.sql', 'r') as f:
8 | db.cursor().executescript(f.read())
9 | db.commit()
10 |
11 | with open('secret', 'wb') as f:
12 | f.write(uuid.uuid4().bytes)
--------------------------------------------------------------------------------
/app/Dockerfile:
--------------------------------------------------------------------------------
1 | FROM python:3-alpine
2 |
3 | RUN apk update
4 | RUN apk add py-pip
5 | RUN pip install flask gunicorn requests pyppeteer logzero
6 | ENV LIBRARY_PATH=/lib:/usr/lib
7 |
8 | ADD . /app/
9 | WORKDIR /app/
10 |
11 | ENV PORT=1024 BIND_ADDR=0.0.0.0
12 |
13 | RUN python init.py
14 | ENTRYPOINT gunicorn -w 8 -b "${BIND_ADDR}:${PORT}" --access-logfile - --error-logfile - app:app
--------------------------------------------------------------------------------
/docker-compose.yaml:
--------------------------------------------------------------------------------
1 | version: '3.7'
2 | services:
3 | chrome:
4 | platform: linux/x86_64
5 | build:
6 | context: chrome/
7 | #ports:
8 | # - 9222:9222
9 |
10 | screenshotter:
11 | build:
12 | context: app/
13 | depends_on:
14 | - "chrome"
15 | ports:
16 | - 5000:1024
17 |
18 | admin:
19 | platform: linux/x86_64
20 | build:
21 | context: admin/
22 | depends_on:
23 | - "screenshotter"
--------------------------------------------------------------------------------
/admin/Dockerfile:
--------------------------------------------------------------------------------
1 | FROM debian
2 |
3 | RUN apt-get update && apt-get install -yq gnupg curl
4 | RUN curl -fsSL https://dl.google.com/linux/linux_signing_key.pub | apt-key add - && \
5 | echo "deb http://dl.google.com/linux/chrome/deb/ stable main" >> /etc/apt/sources.list && \
6 | # Cypress dependencies
7 | apt-get update && apt-get install -yq google-chrome-stable
8 |
9 |
10 | RUN apt-get install -yq python3 python3-pip
11 | RUN python3 -m pip install pyppeteer logzero
12 |
13 | ADD . /app/
14 | WORKDIR /app/
15 |
16 | ENTRYPOINT python3 admin.py
--------------------------------------------------------------------------------
/app/schema.sql:
--------------------------------------------------------------------------------
1 | CREATE TABLE `users` (
2 | `uuid` varchar(36) PRIMARY KEY NOT NULL,
3 | `username` varchar(32) NOT NULL default '',
4 | `password` varchar(64) NOT NULL default ''
5 | );
6 | CREATE UNIQUE INDEX `useruuid` ON `users`(`uuid`);
7 |
8 | CREATE TABLE `notes` (
9 | `uuid` varchar(36) PRIMARY KEY NOT NULL,
10 | `timestamp` DATETIME DEFAULT CURRENT_TIMESTAMP,
11 | `user` varchar(36) NOT NULL,
12 | `title` varchar(64) NOT NULL default '',
13 | `body` TEXT NOT NULL default '',
14 | `data` TEXT NOT NULL default ''
15 | );
16 | CREATE UNIQUE INDEX `noteuuid` ON `notes`(`uuid`);
17 | CREATE INDEX `noteuser` ON `notes`(`user`);
18 |
19 | CREATE TABLE `logs` (
20 | `id` INTEGER PRIMARY KEY,
21 | `msg` varchar(512) NOT NULL default '',
22 | `timestamp` DATETIME DEFAULT CURRENT_TIMESTAMP
23 | );
24 | CREATE UNIQUE INDEX `logid` ON `logs`(`id`);
--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | # screenshotter (web)
2 |
3 | A CTF web challenge about making screenshots. It is inspired by a bug found in real life.
4 | The challenge was created by [@LiveOverflow](https://twitter.com/LiveOverflow) for [https://cscg.de/](https://cscg.de/).
5 |
6 | Watch the video writeup here: https://www.youtube.com/watch?v=FCjMoPpOPYI
7 |
8 | 
9 |
10 | ## Run the challenge
11 |
12 | To run the challenge you have to install [`docker-compose`](https://docs.docker.com/compose/install/):
13 |
14 | ```
15 | docker-compose up
16 | ```
17 |
18 | Once the servicses are running, you should be able to access [http://127.0.0.1:5000](http://127.0.0.1:5000).
19 |
20 | ## Solution
21 |
22 | The [`DO_NOT_ACCESS`](/DO_NOT_ACCESS) folder contains the solution when you checkout the `solution` branch with `git checkout solution`.
23 |
--------------------------------------------------------------------------------
/app/templates/activity.html:
--------------------------------------------------------------------------------
1 |
2 | {% extends "base.html" %}
3 | {% block content %}
4 |
5 |
6 | {% for log in logs %}
7 |
8 |
9 | {{ log.timestamp|timesince }}
10 | {{ log.msg }}
11 |
12 |
13 | {% endfor %}
14 | {% if len_logs == 15 %}
15 |
20 | {% endif %}
21 |
33 | {% block content %}
34 |
35 | {% endblock %}
36 |
37 |
38 |
--------------------------------------------------------------------------------
/.gitignore:
--------------------------------------------------------------------------------
1 | # Byte-compiled / optimized / DLL files
2 | __pycache__/
3 | *.py[cod]
4 | *$py.class
5 |
6 | # C extensions
7 | *.so
8 |
9 | # Distribution / packaging
10 | .Python
11 | build/
12 | develop-eggs/
13 | dist/
14 | downloads/
15 | eggs/
16 | .eggs/
17 | lib/
18 | lib64/
19 | parts/
20 | sdist/
21 | var/
22 | wheels/
23 | *.egg-info/
24 | .installed.cfg
25 | *.egg
26 | MANIFEST
27 |
28 | # PyInstaller
29 | # Usually these files are written by a python script from a template
30 | # before PyInstaller builds the exe, so as to inject date/other infos into it.
31 | *.manifest
32 | *.spec
33 |
34 | # Installer logs
35 | pip-log.txt
36 | pip-delete-this-directory.txt
37 |
38 | # Unit test / coverage reports
39 | htmlcov/
40 | .tox/
41 | .nox/
42 | .coverage
43 | .coverage.*
44 | .cache
45 | nosetests.xml
46 | coverage.xml
47 | *.cover
48 | .hypothesis/
49 | .pytest_cache/
50 |
51 | # Translations
52 | *.mo
53 | *.pot
54 |
55 | # Django stuff:
56 | *.log
57 | local_settings.py
58 | db.sqlite3
59 |
60 | # Flask stuff:
61 | instance/
62 | .webassets-cache
63 |
64 | # Scrapy stuff:
65 | .scrapy
66 |
67 | # Sphinx documentation
68 | docs/_build/
69 |
70 | # PyBuilder
71 | target/
72 |
73 | # Jupyter Notebook
74 | .ipynb_checkpoints
75 |
76 | # IPython
77 | profile_default/
78 | ipython_config.py
79 |
80 | # pyenv
81 | .python-version
82 |
83 | # celery beat schedule file
84 | celerybeat-schedule
85 |
86 | # SageMath parsed files
87 | *.sage.py
88 |
89 | # Environments
90 | .env
91 | .venv
92 | env/
93 | venv/
94 | ENV/
95 | env.bak/
96 | venv.bak/
97 |
98 | # Spyder project settings
99 | .spyderproject
100 | .spyproject
101 |
102 | # Rope project settings
103 | .ropeproject
104 |
105 | # mkdocs documentation
106 | /site
107 |
108 | # mypy
109 | .mypy_cache/
110 | .dmypy.json
111 | dmypy.json
112 |
113 | # Pyre type checker
114 | .pyre/
115 |
--------------------------------------------------------------------------------
/app/templates/index.html:
--------------------------------------------------------------------------------
1 | {% extends "base.html" %}
2 | {% block content %}
3 |
4 |
5 |
31 |
32 |
33 |
34 |
35 |
36 | Demo version:
will only process screenshots for http://cscg.de
37 |
38 |
39 |
40 |
42 |
43 |
44 |
45 |
46 |
47 | {% endblock %}
--------------------------------------------------------------------------------
/app/templates/notes.html:
--------------------------------------------------------------------------------
1 | {% extends "base.html" %}
2 | {% block content %}
3 |
4 |
5 |
23 |
24 | {% for note in notes %}
25 |
26 |
36 |
37 |
38 | {% if note.data.startswith('data:image/') %}
39 |
40 | {% else %}
41 |
{{ note.body }}
42 | {% endif %}
43 |
44 |
45 |
46 |
47 |
48 | {{ note.title }}
49 |
50 |
51 |
52 |
53 |