├── README.md ├── files ├── ctf.html ├── robots.txt └── solvers.txt ├── install ├── install.sh └── rlyserver.service ├── rlyserver.go └── static ├── gophers.png └── lynx.png /README.md: -------------------------------------------------------------------------------- 1 | # rlyCTF 2 | rlyCTF (relay CTF) is a simple capture the flag challenge to emulate real-world SSRF attacks. 3 | 4 | # installation: 5 | ``` 6 | git clone https://github.com/lc/rlyCTF 7 | cd rlyCTF & vim rlyserver.go 8 | ``` 9 | change the line 10 | `path := "/root/rlyCTF"` 11 | 12 | to 13 | `path := "//rlyCTF"` 14 | 15 | 16 | ``` 17 | cd install && chmod +x install.sh 18 | ./install.sh 19 | service rlyserver start 20 | ``` 21 | 22 | ## Solution: 23 | https://www.youtube.com/watch?v=6u3XYGDuI7U 24 | -------------------------------------------------------------------------------- /files/ctf.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | rlyCTF 11 | 12 | 14 | 15 | 28 | 29 | 30 | 31 | 32 | 41 | 42 |

43 | 44 |

45 |

rlyCTF:

46 |

47 | there's a flag somewhere on the server - find it. 48 |

49 | 50 |

rules:
no bruteforcing (no dirsearch)
no flag-sharing

55 |

56 |

Submit flag & solution to corben.leo[at]trojans.dsu.edu 57 |

58 | 59 |

60 | 61 |

62 | 64 | 66 | 68 | 72 | 73 | 74 | 75 | 76 | 77 | -------------------------------------------------------------------------------- /files/robots.txt: -------------------------------------------------------------------------------- 1 | User-agent: * 2 | Disallow: / 3 | Disallow /img 4 | -------------------------------------------------------------------------------- /files/solvers.txt: -------------------------------------------------------------------------------- 1 | 2 | __ ___ _ _ ____ ___ __ 3 | ( (` / / \ | | \ \ / | |_ | |_) ( (` 4 | _)_) \_\_/ |_|__ \_\/ |_|__ |_| \ _)_) 5 | 6 | 7 | - rewzilla (https://twitter.com/rewzilla) 8 | - jarebear (https://twitter.com/JarodKeene) 9 | 10 | 11 | -------------------------------------------------------------------------------- /install/install.sh: -------------------------------------------------------------------------------- 1 | sudo apt-get update -y && sudo apt-get upgrade -y 2 | sudo apt-get install golang 3 | cd ../ 4 | go build rlyserver.go 5 | sudo cp rlyserver /usr/bin 6 | cp install/rlyserver.service /lib/systemd/system/rlyserver.service 7 | sudo apt-get install postfix -y 8 | sudo echo 'header_checks = regexp:/etc/postfix/ctf_flag' >> /etc/postfix/main.cf 9 | sudo echo '/^Subject:(.*)/ REPLACE Subject: flag{oMg_suCh_h4x_sSrf}' > /etc/postfix/ctf_flag 10 | service postfix reload 11 | ufw allow 22 12 | ufw allow 80 13 | ufw allow from 127.0.0.1 to 127.0.0.1 port 25 proto tcp 14 | -------------------------------------------------------------------------------- /install/rlyserver.service: -------------------------------------------------------------------------------- 1 | [Unit] 2 | Description=rlyserver 3 | 4 | [Service] 5 | Type=simple 6 | Restart=always 7 | RestartSec=5s 8 | ExecStart=/usr/bin/rlyserver 9 | 10 | [Install] 11 | WantedBy=multi-user.target 12 | 13 | -------------------------------------------------------------------------------- /rlyserver.go: -------------------------------------------------------------------------------- 1 | package main 2 | 3 | import ( 4 | "fmt" 5 | "io/ioutil" 6 | "net/http" 7 | "os/exec" 8 | "strings" 9 | ) 10 | func main() { 11 | 12 | // path to this directory 13 | path := "/root/rlyCTF" 14 | errormsg := "Something went terribly wrong - Contact @hacker_" 15 | fmt.Println("CTF Server Running...") 16 | http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) { 17 | w.Header().Set("Content-Type", "text/html") 18 | file := fmt.Sprintf("%s/files/ctf.html",path) 19 | index, err := ioutil.ReadFile(file) 20 | if err != nil { 21 | fmt.Fprintf(w, errormsg) 22 | } else { 23 | fmt.Fprintf(w, string(index)) 24 | } 25 | }) 26 | http.HandleFunc("/robots.txt", func(w http.ResponseWriter, r *http.Request) { 27 | w.Header().Set("Content-Type", "text/plain") 28 | file := fmt.Sprintf("%s/files/robots.txt",path) 29 | robotstxt, err := ioutil.ReadFile(file) 30 | if err != nil { 31 | fmt.Fprintf(w, errormsg) 32 | } else { 33 | fmt.Fprintf(w, string(robotstxt)) 34 | } 35 | }) 36 | http.HandleFunc("/solvers", func(w http.ResponseWriter, r *http.Request) { 37 | w.Header().Set("Content-Type", "text/plain") 38 | file := fmt.Sprintf("%s/files/solvers.txt",path) 39 | solvers, err := ioutil.ReadFile(file) 40 | if err != nil { 41 | fmt.Fprintf(w, errormsg) 42 | } else { 43 | fmt.Fprintf(w, string(solvers)) 44 | } 45 | }) 46 | http.HandleFunc("/img", func(w http.ResponseWriter, r *http.Request) { 47 | w.Header().Set("Content-Type", "text/plain") 48 | name := r.URL.Query().Get("url") 49 | file := strings.HasPrefix(strings.ToLower(name), "file://") 50 | if file != false { 51 | fmt.Fprintf(w, "File not found.") 52 | } else { 53 | if name != "" { 54 | cmd := exec.Command("curl", "-Ls", name) 55 | out, err := cmd.CombinedOutput() 56 | if err != nil { 57 | fmt.Fprintf(w, "File not found.") 58 | } 59 | fmt.Fprintf(w, "%s", string(out)) 60 | } else { 61 | fmt.Fprintf(w, "File not found.") 62 | 63 | } 64 | } 65 | }) 66 | files := fmt.Sprintf("%s/static",path) 67 | fs := http.FileServer(http.Dir(files)) 68 | http.Handle("/static/", http.StripPrefix("/static/", fs)) 69 | 70 | http.ListenAndServe(":80", nil) 71 | } 72 | -------------------------------------------------------------------------------- /static/gophers.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/lc/rlyCTF/ba8c7722930879d627ca470ac5fafdc1350610b4/static/gophers.png -------------------------------------------------------------------------------- /static/lynx.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/lc/rlyCTF/ba8c7722930879d627ca470ac5fafdc1350610b4/static/lynx.png --------------------------------------------------------------------------------