Running a Class CTF

Setup

Before starting make sure that you have the following info:

• AMAZON_ACCESS_KEY & AMAZON_SECRET_KEY ( You have to generate a new pair every time for security reasons, you can do that here ( or get the currently available one from our password manager. )

Now clone and setup the ictf-framework:

• git clone https://github.com/shellphish/ictf-framework.git
• mkvirtualenv -p $(which python3) ictf
• workon ictf
• cd ictf-framework
• sudo apt install virtualbox
• sudo -E ./install_all_requirements `echo $VIRTUAL_ENV`
• ./make_secrets.sh
  • mysql: password for the database MySQL.
  • salt: salt used for the database password.
  • secret: used to start the game and interact with the database REST API.

Configure the game

Now you need to create the game_config.json ./ictf-framework/ with all the info about the registered teams and the registered services. Follow the example file game_config.example.json located in the root directory to understand how to do that. How to organize the service's folder is described here.

Forging the machines

• cd ictf-framework/basehost/scripts
• This folder contains configuration scripts that will export the environments variable needed by packer to build the machines. In particular, you should configure the following scripts inside this folder in this way:
  • export_env_aws_us-west-1.sh
    • AWS_REGION: The AWS region where the machine will be spawned (default: "us-west-1").
    • AWS_INSTANCE_TYPE: The VM instance we are going to use for the machines (default: "t2.2xlarge").
    • AWS_ACCESS_KEY: Your AMAZON AWS access key.
    • AWS_SECRET_KEY: Your AMAZON AWS secret key.
    • AWS_VPC: This VPC is only used to build the machine in the cloud. Just put the ID of an existent VPC.
    • AWS_SUBNET: Every VPC needs a subnet to be reachable from outside. Just put the ID of an existent Subnet inside the VPC specified in AWS_VPC.
  • export_env_aws_us-west-2.sh
    • Ignore this file, it's just here if we want to spawn multiple games on multiple regions.
  • export_env_ictf.sh
    • ICTF_USER: the name of the user that will be used in the teamvm.
    • ICTF_USER_PASSWORD: the password for the user that will be used in the teamvm.
  • After you have configured all these vars you are ready to forge the machines!
• source ictf-framework/basehost/scripts/export_build_env.sh us-west-1
• cd ictf-framework/basehost
• make init
• make all -j $(nproc)
• The previous commands composed all the packer configuration files and then built the machines on AWS.
• At the end of those commands execution (this step should take between 20 and 30 mins), you should see all your AMIs here.
  • For each machine in the infrastructure you should see an entry harden_machine-name_OS_ID.

Terraforming the infrastructure

First, set up the proper environment variables.

• source ictf-framework/basehost/scripts/export_build_env.sh <AWS_REGION>

Then, if this is your first time running the ictf-framework in this AWS instance, you will need to

• Create an elastic IP in the region you want to play (e.g., us-west-1) and tag its Name as "ictf-teaminterface-ip"
• Create an elastic IP in the region you want to play (e.g., us-west-1) and tag its Name as "ictf-router-ip"
• Create an elastic IP in the region you want to play (e.g., us-west-1) and tag its Name as "ictf-scoreboard-ip"
• Create an S3 bucket called "ictf-database-bucket-us-west-1"
• Create an S3 bucket called "ictf-router-bucket-us-west-1" (us-west-1 is the region you are using in the previous config)

Now you are ready to instantiate a game.

• cd ictf-framework/ares/aws && ./full_bootstrap_game.sh "$AWS_ACCESS_KEY" "$AWS_SECRET_KEY" "$AWS_REGION" <GAME_CONFIG_JSON_PATH> [-d|--dev-mode]
  • --dev-mode: this option if set lets you run the infrastructure in developing mode (i.e. the components get deployed on cheaper instances)
• If everything worked correctly you will find:
  • SSH_CONFIG_FILE: this file contains the configuration to easily access all the machines in the game.
  • STARTING_URL_GAME: this URL will be printed in the console output
• When the CTF is done, STOP the game and then destroy the game with the following command.
• cd ictf-framework/ares/aws && ./destroy_game.py

Game lifecycle

First, you will need to distribute to every team:

1. Their flag_token, found in game_config.json (WARNING: this token MUST be secret for every team!)
2. The scoreboard IP.
3. The teaminterface IP.
4. They will need to install swpag_client using pip install swpag_client.

You can find both of the IP addresses in the output of bootstrap_game.py.

To START the game issue a GET request to: http://<DATABASE_IP>/game/insert?secret=<API_SECRET>

To STOP the game issue a GET request to: http://<DATABASE_IP>/game/delete?secret=<API_SECRET>

To RESUME the game after it has been stopped: http://<DATABASE_IP>/game/insert?secret=<API_SECRET>

Collect data from the game