[BUG FIX REPORT] Advanced badge training module challenge "Add new user" not being flagged correctly after completion.

[UsrBern]

As the title says, I noticed that even after creating the test user specified in the challenge I was not getting my flag, even after making sure that that I shut down the server appropriately before creating the user and avoiding the --fresh flag.

Because I'm stubborn and wanted my damn badge I started digging and noticed that in the conf/local.yml file, the test user's entry had changed from test: test to
test: $argon2id$v=19$m=65536,t=3,p=4$JlJcXtH7b9JxC6rHFJ7Wjw$fiektvVik+afQPvKWlRBqaQXWSkEjDtHWWLC73zljBI.

So I dug further to find wherever the flag checker is and found /plugins/training/app/flags/advanced/flag_2.py:

from plugins.training.app.c_flag import Flag


class AdvancedFlag2(Flag):
    name = 'Add new user'
    challenge = 'Add new red-team user credentials, using "test" as both the username and password.'
    extra_info = (
        'During an adversary emulation operation, multiple users may need access to the Caldera server.\n'
        'This flag requires making direct changes to the configuration file at conf/local.yml. Make sure the server is '
        'turned off before editing this file, or else changes will be overwritten.'
    )

    async def verify(self, services):
        user = services.get('auth_svc').user_map.get('test')
        return user and user.password == 'test' and 'red' in user.permissions

I wondered if user.password wasn't simply retrieving the hash and comparing it to 'test' thus always returning false. So I modified the script to this:

from plugins.training.app.c_flag import Flag
from passlib.hash import argon2

class AdvancedFlag2(Flag):
    name = 'Add new user'
    challenge = 'Add new red-team user credentials, using "test" as both the username and password.'
    extra_info = (
        'During an adversary emulation operation, multiple users may need access to the Caldera server.\n'
        'This flag requires making direct changes to the configuration file at conf/local.yml. Make sure the server is '
        'turned off before editing this file, or else changes will be overwritten.'
    )

    async def verify(self, services):
        user = services.get('auth_svc').user_map.get('test')

        is_password_valid = False
        if user.password == 'test':
            is_password_valid = True
        elif user.password.startswith('$argon2id$'):
            try:
                is_password_valid = argon2.verify('test', user.password)
            except Exception:
                is_password_valid = False

        return user and is_password_valid and 'red' in user.permissions

After adding passlib and argon2-cffi to requirements.txt, and restarting the server again I finally got my flag.
Figured I should report this as a bug and explain. Thanks for reading!

PS: yes I know it would have been enough and easier to just compare user.password to both 'test' and the hash. I literally just realized that.

... Whoops.