Monorepo for infrastructure and challenges of SECedu CTF 2019.
Everything is behind the settings of a fictional company, Geegle. Geegle has its own BeyondCorp-like
zero-trust network via UberProxy. We have a working email server that supports
company internal emails as well as inbound and outbound emails at geemail-backend,
geemail-frontend, geemail-client, gsmtpd.
All challenge descriptions are sent to team through emails. Challenge emails are unlocked as players progress
in the CTF. Every challlenge has its own unified configuration file called
chals/pwn/geelang/challenge.libsonnet for an example. Its emails,
container services, static files, flags, etc. are all in that single file. We have a shared server that every
player connects to, as well as separate team servers for each of the team. The
clustertype in configuration
determines whether a specific service should run on the shared server or in a separate team server. This makes
it possible that some services are shared to facilitate inter-team communication while some services offer
isolation between teams.
Binary challenges are also tunneled through UberProxy with websocket. See cli-relay, cli-static, and uberproxy/websocket.go. Static files are served using shared infra sffe, a general-purpose static file front-end on top of SSTable (leveldb).
Other infra services we have include: scoreboard, dns (internal DNS service used by all containers to help connect to uberproxy), gaia (internal authentication service), gae (a service like Google App Engine and Amazon Lambda), requestz (a simple network debugging service), mss (internal KV databse service integrated with Geegle services authentication).
Running Your Own CTF
If you want to use the same Geegle infrastructure to host your own CTF, we are more than happy to support you. Simply remove all challenges from chals directory and put in your own challenges, and change the root BUILD file accordingly.
Please do let us know if you use Geegle infra to host your own CTF. We can't wait to hear about the amazing work you have done :)
Building Container Images
Please build using Linux AMD64. Cuz it's hard to set up cross-compiling for C programs on mac, ceebs.
bazel build //:all_containers
Build and tag locally (so that you can use docker-compose to boot them up):
bazel run //:all_containers
Commits submitted to master branch will be automatically pushed to gcr.io/geegle, our container repo
If you are deploying your own CTF using this infra, please change BUILD file to push to a different container registry, since gcr.io/geegle is not public.
Master Server (Shared Server)
bazel build //infra/jsonnet:cluster-master-docker-compose docker-compose -f dist/bin/infra/jsonnet/cluster-master-docker-compose.json up -d
Team Server (Separate Isolated Server)
bazel build //infra/jsonnet:cluster-team-docker-compose docker-compose -f dist/bin/infra/jsonnet/cluster-team-docker-compose.json up -d
Test Server (All-in-one Server)
bazel build //infra/jsonnet:all-docker-compose docker-compose -f dist/bin/infra/jsonnet/all-docker-compose.json up -d
To check the author for an individual challenge/infra service, check CODEOWNERS.
Open-sourced with love, under Apache 2.0 License.