-
- {% block content %}{% endblock %}
-
-
-
-
-
-
-
\ No newline at end of file
diff --git a/flask-instanced-alpine3.21/deployment/.symlink-canary b/flask-instanced-alpine3.21/deployment/.symlink-canary
deleted file mode 120000
index d0b0e8e..0000000
--- a/flask-instanced-alpine3.21/deployment/.symlink-canary
+++ /dev/null
@@ -1 +0,0 @@
-../Makefile
\ No newline at end of file
diff --git a/flask-instanced-alpine3.21/deployment/ctfd-entry.yml.template b/flask-instanced-alpine3.21/deployment/ctfd-entry.yml.template
deleted file mode 100644
index 6270a4a..0000000
--- a/flask-instanced-alpine3.21/deployment/ctfd-entry.yml.template
+++ /dev/null
@@ -1,23 +0,0 @@
-name: "${FULLNAME}"
-author: "${AUTHOR}"
-category: "${CATEGORY}"
-attribution: "Author: ${AUTHOR}"
-description: "${DESCBR}"
-
-type: "dynamic"
-value: 500
-extra:
- initial: 500
- decay: 50
- minimum: 50
-
-files:
- - "${NAME}.tar.gz"
-flags:
- - "${FLAG}"
-${COND_TAG}
-
-state: "visible"
-version: "0.1"
-
-ops:
diff --git a/flask-instanced-alpine3.21/dist/deploy.sh.template b/flask-instanced-alpine3.21/dist/deploy.sh.template
deleted file mode 100644
index 9b0c1ff..0000000
--- a/flask-instanced-alpine3.21/dist/deploy.sh.template
+++ /dev/null
@@ -1,42 +0,0 @@
-#!/bin/sh
-
-check() {
- echo -e "\e[1;34m[+] Verifying Challenge Integrity\e[0m"
- sha256sum -c sha256sum
-}
-
-build_container() {
- echo -e "\e[1;34m[+] Building Challenge Docker Container\e[0m"
- ${RUNTIME_DIST} build -t localhost/chall-${NAME} ${BARGS} .
-}
-
-run_container() {
- echo -e "\e[1;34m[+] Running Challenge Docker Container on ${HOST}:${PORT}\e[0m"
- ${RUNTIME_DIST} run --name chall-${NAME} --rm ${RARGS} localhost/chall-${NAME}
-}
-
-kill_container() {
- ${RUNTIME_DIST} ps --filter "name=chall-${NAME}" --format "{{.ID}}" \
- | tr '\n' ' ' \
- | xargs ${RUNTIME_DIST} stop -t 0 \
- || true
-}
-
-case "${1}" in
- "check")
- check
- ;;
- "build")
- build_container
- ;;
- "run")
- run_container
- ;;
- "kill")
- kill_container
- ;;
- *)
- check
- build_container && run_container
- ;;
-esac
diff --git a/flask-instanced-alpine3.21/dist/flag.txt b/flask-instanced-alpine3.21/dist/flag.txt
deleted file mode 100644
index 33c7b8d..0000000
--- a/flask-instanced-alpine3.21/dist/flag.txt
+++ /dev/null
@@ -1 +0,0 @@
-gctf{FAKE_FAKE_FAKE_FAKE_FAKE_FAKE}
diff --git a/flask-instanced-alpine3.21/dist/requirements.txt b/flask-instanced-alpine3.21/dist/requirements.txt
deleted file mode 120000
index 3bdc466..0000000
--- a/flask-instanced-alpine3.21/dist/requirements.txt
+++ /dev/null
@@ -1 +0,0 @@
-../challenge/requirements.txt
\ No newline at end of file
diff --git a/flask-instanced-alpine3.21/dist/src b/flask-instanced-alpine3.21/dist/src
deleted file mode 120000
index b0fe497..0000000
--- a/flask-instanced-alpine3.21/dist/src
+++ /dev/null
@@ -1 +0,0 @@
-../challenge/src
\ No newline at end of file
diff --git a/flask-instanced-alpine3.21/helper/Caddyfile b/flask-instanced-alpine3.21/helper/Caddyfile
deleted file mode 100644
index bcd4845..0000000
--- a/flask-instanced-alpine3.21/helper/Caddyfile
+++ /dev/null
@@ -1,10 +0,0 @@
-{
- http_port 8080
- https_port 8081
- auto_https off
-}
-
-# Ignore
-http://123981239081231283901283091023.localhost:8080 {
- reverse_proxy http://127.0.0.1:8080
-}
diff --git a/flask-instanced-alpine3.21/helper/Dockerfile b/flask-instanced-alpine3.21/helper/Dockerfile
deleted file mode 100644
index ccb3963..0000000
--- a/flask-instanced-alpine3.21/helper/Dockerfile
+++ /dev/null
@@ -1,40 +0,0 @@
-# Ubuntu 24.04
-# GCC 13.2.0
-# Clang 18.0
-# GLIBC 2.39
-
-##################
-# Builder system #
-##################
-
-# Builds are complex and its better to manage them separatedly than to include
-# buildroot & linux-kernel into docker
-
-#################
-# Runner system #
-#################
-FROM quay.io/podman/stable:v5.2.0 as base
-
-# Install dnf dependencies if needed
-RUN dnf -y install socat caddy iproute && dnf clean all
-
-#RUN DEBIAN_FRONTEND=noninteractive apt-get update && apt-get install -y socat podman fuse-overlayfs curl jq && apt-get clean
-
-# Copy the actual challenge container image
-COPY ./challenge.tar /app/
-RUN chown 1000:1000 /app/challenge.tar
-
-COPY Caddyfile /app/Caddyfile
-
-# Copy helper scripts
-COPY run.sh /app/run.sh
-RUN chmod +x /app/run.sh
-COPY cleaner.sh /app/cleaner.sh
-RUN chmod +x /app/cleaner.sh
-COPY entrypoint.sh /app/entrypoint.sh
-RUN chmod +x /app/entrypoint.sh
-
-USER 1000
-
-SHELL ["/bin/sh", "-c"]
-CMD /app/entrypoint.sh
diff --git a/flask-instanced-alpine3.21/helper/cleaner.sh b/flask-instanced-alpine3.21/helper/cleaner.sh
deleted file mode 100755
index 0ca6105..0000000
--- a/flask-instanced-alpine3.21/helper/cleaner.sh
+++ /dev/null
@@ -1,28 +0,0 @@
-#!/usr/bin/env bash
-
-while true;
-do
- for f in /tmp/tmp.*--glacier-nginx; do
-
- if [ "${f}" == "/tmp/tmp.*--glacier-nginx" ]
- then
- echo "[+] Nothing to clean"
- continue
- fi
-
- # We can't use the PIDfile as PIDs can be reused by a new process
- out=`podman ps --format "{{.CIDFile}}" | grep ${f} | grep -v grep`
- if [ -z "${out}" ]
- then
- DOMAIN=$(cat ${f}/domain)
- echo "[+] Removing subdomain $DOMAIN from caddy"
- curl -X DELETE "http://localhost:2019/id/$DOMAIN"
- echo "[+] Cleaning up ${f} as its dangling"
- rm -rf ${f}
- else
- echo "[+] Not cleaning up ${f} as its being used"
- fi
- done
-
- sleep ${TIMEOUT}
-done
diff --git a/flask-instanced-alpine3.21/helper/entrypoint.sh b/flask-instanced-alpine3.21/helper/entrypoint.sh
deleted file mode 100755
index 96a05d4..0000000
--- a/flask-instanced-alpine3.21/helper/entrypoint.sh
+++ /dev/null
@@ -1,15 +0,0 @@
-#!/bin/sh
-
-echo "[+] Running in context $(id)"
-echo "[+] Loading challenge container image"
-podman load -i /app/challenge.tar
-
-echo "[+] Running cleaner in the background"
-/app/cleaner.sh &
-
-echo "[+] Running caddy proxy server"
-caddy run --config /app/Caddyfile &
-
-touch /home/podman/port.lock
-echo "0" > /home/podman/port
-socat TCP-LISTEN:1337,fork,nodelay,reuseaddr,pktinfo EXEC:"/usr/bin/timeout -k 5 ${TIMEOUT} /app/run.sh"
diff --git a/flask-instanced-alpine3.21/helper/run.sh b/flask-instanced-alpine3.21/helper/run.sh
deleted file mode 100755
index c83f5f8..0000000
--- a/flask-instanced-alpine3.21/helper/run.sh
+++ /dev/null
@@ -1,49 +0,0 @@
-#!/usr/bin/env bash
-
-# Generate temporary directory per connection
-DIR=$(mktemp -d --suffix=--glacier-nginx)
-cd ${DIR}
-
-echo -e "Press [ENTER] to start a new instance"
-read -n1
-
-SUBDOMAIN=$(echo $RANDOM | sha1sum | head -c 32)
-echo "${SUBDOMAIN}" > domain
-
-exec 100>/home/podman/port.lock || (echo "Could not spawn instance, please contact an administrator!"; exit -1)
-flock -x -w 10 100
-CURRENT_PORT=`cat /home/podman/port`
-expr \( $CURRENT_PORT + 1 \) % \( $PUBPORTEND - $PUBPORTSTART \) > /home/podman/port
-flock -u 100
-
-PORT=`expr $CURRENT_PORT + $PUBPORTSTART`
-
-# PORT=`shuf -i ${PUBPORTSTART}-${PUBPORTEND} -n1`
-echo "${PORT}" > port
-
-
-HOSTNAME=$(echo $RANDOM | md5sum | head -12)
-podman run -d --uts=private --hostname "${HOSTNAME}" --timeout ${TIMEOUT} --cidfile=${DIR}/cid -p "127.0.0.1:${PORT}:1337" --network=pasta ${REGISTRY}/${NAME}-challenge 2>/dev/null 1>/dev/null
-
-FQDN=${SUBDOMAIN}.${DOMAIN}
-
-PAYLOAD="{\"@id\": \"${SUBDOMAIN}\", \"handle\":[{\"handler\":\"subroute\",\"routes\":[{\"handle\":[{\"handler\":\"reverse_proxy\",\"upstreams\":[{\"dial\":\"127.0.0.1:${PORT}\"}]}]}]}],\"match\":[{\"host\":[\"${FQDN}\"]}],\"terminal\":true}"
-curl -X PUT -H "Content-Type: application/json" -d "${PAYLOAD}" "http://localhost:2019/config/apps/http/servers/srv0/routes/0"
-
-if [[ ! -z "${DOMAIN_PORT}" ]]; then
- FQDN=${FQDN}:${DOMAIN_PORT}
-fi
-
-echo -e "\e[1;34m[+] ${DOMAIN_PROT}://${FQDN}\e[0m"
-echo -e "\e[1;34m[+] Wait some time until the challenge is fully booted up\e[0m"
-
-echo -e "\e[1;34m[+] You have ${TIMEOUT} seconds to solve it. Avoid timeouts by running it locally.\e[0m"
-
-echo ""
-echo -e "Press [ENTER] to stop the instance"
-read -n1
-
-CID=`cat cid`
-podman stop -t 0 ${CID} 2>&1 >/dev/null
-
-echo -e "Instance stopped"
diff --git a/flask-instanced-alpine3.21/solution/Dockerfile b/flask-instanced-alpine3.21/solution/Dockerfile
deleted file mode 100644
index db9b550..0000000
--- a/flask-instanced-alpine3.21/solution/Dockerfile
+++ /dev/null
@@ -1,28 +0,0 @@
-# Ubuntu 24.04
-FROM docker.io/library/ubuntu@sha256:1e622c5f073b4f6bfad6632f2616c7f59ef256e96fe78bf6a595d1dc4376ac02
-COPY --from=ghcr.io/astral-sh/uv:0.7.2 /uv /uvx /bin/
-
-# Install apt dependencies if needed
-# RUN DEBIAN_FRONTEND=noninteractive apt-get update && apt-get install -y ... && apt-get clean
-
-WORKDIR /app
-COPY pyproject.toml requirements.txt* uv.lock* .python-version* ./
-
-# Install python dependencies
-ENV UV_COMPILE_BYTECODE=1
-ENV UV_CACHE_DIR=/root/.cache/uv/
-# If author uses requirements.txt, respect it and port it to uv (not recommended)
-RUN [ -s "requirements.txt" ] && (uv add --link-mode=copy -r requirements.txt && \
- echo "\e[1;33m--> Consider porting requirements.txt to pyproject.toml with: uv add -r requirements.txt && rm requirements.txt\e[0m") \
- || true
-# Install uv dependencies and respect the lockfile
-RUN uv sync --locked --compile-bytecode --link-mode=copy && uv tree --locked && uv python list --only-installed
-
-# Copy exploit(s) /app
-COPY exploit .
-RUN chmod 755 /app/exploit
-
-ENV PWNLIB_NOTERM=1 PYTHONUNBUFFERED=1 UV_COMPILE_BYTECODE=0 UV_OFFLINE=1 UV_LOCKED=1
-
-SHELL ["/bin/sh", "-c"]
-CMD /usr/bin/timeout --foreground -k 5 ${TIMEOUT} ./exploit REMOTE HOST=${HOST} PORT=${PORT}
diff --git a/flask-instanced-alpine3.21/solution/exploit b/flask-instanced-alpine3.21/solution/exploit
deleted file mode 100755
index be7f1cb..0000000
--- a/flask-instanced-alpine3.21/solution/exploit
+++ /dev/null
@@ -1,85 +0,0 @@
-#!/usr/bin/env -S uv run --script
-# -*- coding: utf-8 -*-
-# This exploit template was generated via:
-import re
-import os
-import time
-import requests
-from pwn import *
-
-# Find flag by exact match or format
-# log.success(find_flag(io.recvall()))
-real_flag = open("./flag.txt", "r").readline().strip()
-fake_flag = open("./flag-fake.txt", "r").readline().strip()
-regx_flag = re.compile(r"gctf{.*}")
-def find_flag(output):
- if not isinstance(output, str):
- output = output.decode(errors="ignore")
- # Match real flag
- if real_flag in output:
- return real_flag
- # Match fake flag
- if fake_flag in output:
- return fake_flag
- # Match possible local flag
- with open("/flag.txt", "r") as local:
- locl_flag = local.readline().strip()
- if locl_flag in output:
- return locl_flag
- # Match regex flag
- m = regx_flag.search(output)
- if m is not None:
- return m.group(0)
- # Definitely no flag found
- return None
-
-# Infra team here, always print the flag. Use find_flag(out) for convenience
-# make solve expects ./flag.txt or ./flag-fake.txt in the output
-
-protocol = os.environ.get("PROTOCOL", "http")
-domain = os.environ.get("DOMAIN", "localhost")
-host = os.environ.get("HOST", "localhost")
-
-port = int(os.environ.get("PORT", "1337"))
-
-def get_subdomain_from_instance():
- print(f"[+] If you run distrun this might take a bit")
- io = connect(host, port)
- io.sendlineafter(b"start a new instance\n", b"", timeout=5)
- data = io.recvuntil(b"Wait some time", timeout=5).decode().strip()
- res_ins = re.search("\[\+\] http.*\/\/([a-zA-Z:\/\.\d]*)", data)
- res = re.search("\[\+\] (http[a-zA-Z:\/\.\d]*)", data)
- return res[1].strip(), res_ins[1].strip()
-
-try:
- url, instance_url = get_subdomain_from_instance()
- print(f"[+] Created new instance: {instance_url}")
- print("[+] Waiting 5 seconds until instance is up")
- time.sleep(5)
-except:
- subdomain = ""
- url = f"{protocol}://{host}:{port}"
- instance_url = f"{host}:{port}"
- print(f"[+] URL: {url}")
-
-print("[+] Running exploit")
-
-def log(message):
- print("[+] " + message, flush=True)
-
-base_domain = url
-if base_domain.endswith(".localhost:8080"):
- base_domain = "http://127.0.0.1:8080"
-print(f"[+] Base domain {base_domain}")
-
-res = requests.get(f"{base_domain}/flag", headers={"Host": instance_url}) # Headers are required for testing locally
-body = res.content.decode()
-flag = find_flag(body)
-if flag:
- print(f"\033[93m[+] Flag: {flag}\033[0m", flush=True)
- exit(0)
-
-print("[+] Flag could not be found", flush=True)
-exit(255)
-
-# vim: filetype=python
diff --git a/flask-nojail-alpine3.21/Makefile b/flask-nojail-alpine3.21/Makefile
index 4579793..f34bba8 100644
--- a/flask-nojail-alpine3.21/Makefile
+++ b/flask-nojail-alpine3.21/Makefile
@@ -1,31 +1,12 @@
-.PHONY: all run build solve solve-sequential solve-parallel kill dist distrun clean deploy version lint test shell
+.PHONY: all run build solve kill dist distrun clean version test shell
# Targets
all: build run
run: crun
build: cbuild
solve: sbuild srun
-solve-sequential: sbuild srun-sequential
-solve-parallel: sbuild srun-parallel
kill: ckill skill
-######################
-# CTFd Configuration #
-######################
-
-export FULLNAME = CTFd challenge name
-export AUTHOR = LosFuzzys
-export CATEGORY = pwn
-define DESC
-This is a multiline challenge description!
-
-Feel free to add more lines.
-endef
-export DESC
-export FLAG = $(shell cat challenge/flag.txt)
-export FAKE_FLAG = $(shell cat dist/flag.txt)
-export TAGS = tag1, tag2, tag with space
-
############################
# Deployment Configuration #
############################
@@ -44,11 +25,19 @@ MKPATH:=$(shell dirname $(realpath $(firstword $(MAKEFILE_LIST))))
UNCLEAN_NAME=$(notdir ${MKPATH})
export NAME=$(shell echo ${UNCLEAN_NAME} | tr "[:upper:]" "[:lower:]")
+export RUNTIME ?= docker
+export RUNTIME_DIST ?= docker
+# PULL_POLICY_RUN options: always, missing, never
+export PULL_POLICY_RUN = never
+# PULL_POLICY_BUILD options in docker: true, false
+# PULL_POLICY_BUILD options in podman: true, false, always, missing, never
+export PULL_POLICY_BUILD = true
+
# DO NOT TOUCH
# Major: Big features & breakage of interfaces (in sync)
# Minor: Small functionality changes w/ backward compatibility (in sync)
# Patch: Small fixes specific to this template (not in sync)
-export _VERSION = 1.0.1
+export _VERSION = 1.0.0
export _TEMPLATE = flask-nojail-alpine3.19
########################
@@ -59,7 +48,7 @@ CACHEBUST=$(shell date +%s)
IT=$$([ -t 0 ] && echo "-it")
# Docker Run Args
-export RARGS ?= -p ${HOST}:${PORT}:1337 -e HOST=${HOST} -e PORT=${PORT} \
+export RARGS ?= -p ${HOST}:${PORT}:1337 -e HOST=${HOST} -e PORT=${PORT} -e FLAG="flag{dummy}\
--user 1337:1337 --platform linux/amd64 --pull=${PULL_POLICY_RUN}
# Docker Build Args
export BARGS ?= --platform linux/amd64 --pull=${PULL_POLICY_BUILD}
@@ -165,18 +154,6 @@ srun:
"${HOST}:${PORT}\e[0m"
@$(call run_check,,-it)
-TIMES=10
-srun-sequential:
- @echo -e "\e[1;34m[+] Running Sequential Container against" \
- "${HOST}:${PORT}\e[0m"
- @parallel --line-buffer --jobs 1 '$(call run_check,-sequential-{},)' \
- ::: `seq -s' ' 1 1 ${TIMES}`
-
-JOBS=4
-srun-parallel:
- @echo -e "\e[1;34m[+] Running Parallel Container against ${HOST}:${PORT}\e[0m"
- @parallel --jobs ${JOBS} '$(call run_check,-parallel-{},)' \
- ::: `seq -s' ' 1 1 ${TIMES}`
skill:
@echo -e "\e[1;34m[+] Killing Solution Container/s\e[0m"
@@ -185,71 +162,6 @@ skill:
| xargs -r ${RUNTIME} stop -t 0 \
|| true
-########################
-# Challenge Deployment #
-########################
-deploy: deploy-registry
-
-DESCBR=$(subst $(newline),