Web Task Sample (google#37)

sirdarckcat · web-flow · commit c1af87d4e73a · 2020-02-19T09:57:32.000+01:00
* Add web task sample

* delete backup file

* make a single run statement

* fix healtcheck
diff --git a/infrastructure/kctf-samples/apache-php/.gen/.gitignore b/infrastructure/kctf-samples/apache-php/.gen/.gitignore
@@ -0,0 +1,3 @@
+# this directory is for Makefile generated outputs
+*
+!.gitignore
diff --git a/infrastructure/kctf-samples/apache-php/Makefile b/infrastructure/kctf-samples/apache-php/Makefile
@@ -0,0 +1 @@
+../kctf-conf/base/Makefile
diff --git a/infrastructure/kctf-samples/apache-php/chal.conf b/infrastructure/kctf-samples/apache-php/chal.conf
@@ -0,0 +1,4 @@
+# this file will be sourced by the deployment scripts
+DEPLOY=true
+PUBLIC=false
+HEALTHCHECK=false
diff --git a/infrastructure/kctf-samples/apache-php/challenge/Dockerfile b/infrastructure/kctf-samples/apache-php/challenge/Dockerfile
@@ -0,0 +1,31 @@
+FROM kctf-nsjail
+
+RUN apt-get -y update
+RUN apt-get -y upgrade
+
+RUN ln -s /secrets/flag /chroot/flag
+
+VOLUME /tmp
+VOLUME /var/log/apache2
+VOLUME /var/run/apache2
+
+RUN apt-get install -y apache2
+RUN chroot /chroot apt-get install -y php-cgi
+
+RUN service apache2 start
+
+RUN ln -s /etc/apache2/mods-available/cgi.load /etc/apache2/mods-enabled/cgi.load
+RUN ln -s /etc/apache2/mods-available/actions.load /etc/apache2/mods-enabled/actions.load
+
+RUN ln -s /config/apache2-nsjail-php.conf /etc/apache2/conf-enabled/nsjail-php.conf
+
+RUN rm -rf /var/www
+RUN ln -s /chroot/var/www /var/www
+
+COPY files/html/ /chroot/var/www/html/
+COPY files/cgi-bin/ /usr/lib/cgi-bin/
+COPY files/root/ /root/
+
+RUN chmod 0755 /chroot/var/www/html /usr/lib/cgi-bin/nsjail-php-cgi /root/launch-apache
+
+CMD /root/launch-apache
diff --git a/infrastructure/kctf-samples/apache-php/challenge/config/apache2-nsjail-php.conf b/infrastructure/kctf-samples/apache-php/challenge/config/apache2-nsjail-php.conf
@@ -0,0 +1,14 @@
+ServerName kctf-nsjail-php
+Listen 1337
+
+<Directory "/var/www/html">
+ Options +ExecCGI
+ Action application/x-nsjail-httpd-php /cgi-bin/nsjail-php-cgi
+ AddHandler application/x-nsjail-httpd-php php
+ Order allow,deny
+ Allow from all
+</Directory>
+
+<VirtualHost *:1337>
+ DocumentRoot "/var/www/html"
+</VirtualHost>
diff --git a/infrastructure/kctf-samples/apache-php/challenge/config/kustomization.yaml b/infrastructure/kctf-samples/apache-php/challenge/config/kustomization.yaml
@@ -0,0 +1,11 @@
+configMapGenerator:
+- name: apache-php-config
+  files:
+  - apache-nsjail-php.conf
+  - nsjail-php.cfg
+generatorOptions:
+  disableNameSuffixHash: true
+  labels:
+    type: generated
+  annotations:
+    note: generated
diff --git a/infrastructure/kctf-samples/apache-php/challenge/config/nsjail-php.cfg b/infrastructure/kctf-samples/apache-php/challenge/config/nsjail-php.cfg
@@ -0,0 +1,36 @@
+name: "php-cgi-nsjail-configuration"
+description: "PHP CGI nsjail configuration for web RCE CTF task."
+
+mode: ONCE
+chroot_dir: "/chroot"
+log_level: ERROR
+uidmap {inside_id: "1000"}
+gidmap {inside_id: "1000"}
+mount_proc: true
+keep_env: true
+rlimit_as_type: HARD
+rlimit_cpu_type: HARD
+rlimit_nofile_type: HARD
+rlimit_nproc_type: HARD
+
+mount: [
+  {
+    src: "/secrets"
+    dst: "/secrets"
+    is_bind: true
+  },
+  {
+    src: "/config"
+    dst: "/config"
+    is_bind: true
+  },
+  {
+    dst: "/tmp"
+    fstype: "tmpfs"
+    rw: true
+  }
+]
+
+exec_bin {
+    path: "/usr/lib/cgi-bin/php"
+}
diff --git a/infrastructure/kctf-samples/apache-php/challenge/files/cgi-bin/nsjail-php-cgi b/infrastructure/kctf-samples/apache-php/challenge/files/cgi-bin/nsjail-php-cgi
@@ -0,0 +1,2 @@
+#!/bin/bash
+/usr/bin/nsjail --config /config/nsjail-php.cfg -- /usr/lib/cgi-bin/php $@
diff --git a/infrastructure/kctf-samples/apache-php/challenge/files/html/eval.php b/infrastructure/kctf-samples/apache-php/challenge/files/html/eval.php
@@ -0,0 +1 @@
+<form method=POST><textarea autofocus name=eval style=height:90%;width:100%;display:block><?php echo htmlentities($_REQUEST["eval"])?></textarea><input type=submit><hr><plaintext><?php echo(eval($_REQUEST["eval"])); ?>
diff --git a/infrastructure/kctf-samples/apache-php/challenge/files/html/index.php b/infrastructure/kctf-samples/apache-php/challenge/files/html/index.php
@@ -0,0 +1 @@
+<?php phpinfo(); ?>
diff --git a/infrastructure/kctf-samples/apache-php/challenge/files/root/launch-apache b/infrastructure/kctf-samples/apache-php/challenge/files/root/launch-apache
@@ -0,0 +1,9 @@
+#!/bin/bash
+
+/usr/bin/k8s_nsjail_setup.sh
+
+service apache2 start
+
+wget -O - http://127.0.0.1:1337/?apache-is-running
+
+tail -f /var/log/apache2/*
diff --git a/infrastructure/kctf-samples/apache-php/challenge/secrets/flag b/infrastructure/kctf-samples/apache-php/challenge/secrets/flag
@@ -0,0 +1 @@
+CTF{TestFlag}
diff --git a/infrastructure/kctf-samples/apache-php/challenge/secrets/kustomization.yaml b/infrastructure/kctf-samples/apache-php/challenge/secrets/kustomization.yaml
@@ -0,0 +1,10 @@
+secretGenerator:
+- name: apache-php-secrets
+  files:
+  - flag
+generatorOptions:
+  disableNameSuffixHash: true
+  labels:
+    type: generated
+  annotations:
+    note: generated
diff --git a/infrastructure/kctf-samples/apache-php/challenge/src/Makefile b/infrastructure/kctf-samples/apache-php/challenge/src/Makefile
@@ -0,0 +1,4 @@
+# Output files should go to ../files
+
+../../.gen/src:
+	touch $@
diff --git a/infrastructure/kctf-samples/apache-php/healthcheck/.gen/.gitignore b/infrastructure/kctf-samples/apache-php/healthcheck/.gen/.gitignore
@@ -0,0 +1,3 @@
+# this directory is for Makefile generated outputs
+*
+!.gitignore
diff --git a/infrastructure/kctf-samples/apache-php/healthcheck/Dockerfile b/infrastructure/kctf-samples/apache-php/healthcheck/Dockerfile
@@ -0,0 +1,17 @@
+FROM ubuntu:19.10
+
+RUN apt-get -y update
+RUN apt-get -y upgrade
+
+RUN apt-get -y install python2.7 python-pip
+RUN pip install pwntools
+
+RUN apt-get -y install cpio
+
+COPY .gen/exploit.cpio.enc /
+
+RUN /usr/sbin/useradd --no-create-home -u 1000 user
+COPY files /home/user
+RUN mkdir /home/user/.pwntools-cache && echo never > /home/user/.pwntools-cache/update
+
+CMD openssl aes-256-cbc -d -in exploit.cpio.enc -out exploit.cpio -K "$(cat /keys/exploit.key)" -nosalt -iv 00000000000000000000000000000000 && < exploit.cpio cpio -i && rm /exploit.cpio.enc && rm /exploit.cpio && setpriv --init-groups --reuid user --regid user --inh-caps=-all -- /exploit/run.sh & /home/user/healthz.py
diff --git a/infrastructure/kctf-samples/apache-php/healthcheck/config/env b/infrastructure/kctf-samples/apache-php/healthcheck/config/env
@@ -0,0 +1,2 @@
+TIMEOUT=20
+PERIOD=30
diff --git a/infrastructure/kctf-samples/apache-php/healthcheck/config/kustomization.yaml b/infrastructure/kctf-samples/apache-php/healthcheck/config/kustomization.yaml
@@ -0,0 +1,10 @@
+configMapGenerator:
+- name: apache-php-healthcheck-config
+  files:
+  - env
+generatorOptions:
+  disableNameSuffixHash: true
+  labels:
+    type: generated
+  annotations:
+    note: generated
diff --git a/infrastructure/kctf-samples/apache-php/healthcheck/exploit/doit.py b/infrastructure/kctf-samples/apache-php/healthcheck/exploit/doit.py
@@ -0,0 +1,9 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+
+from pwn import *
+
+if "raboof1337" in wget("http://localhost:1337/eval.php?eval=echo(strrev('foobar').(1338-1));"):
+    exit(0)
+
+exit(1)
diff --git a/infrastructure/kctf-samples/apache-php/healthcheck/exploit/run.sh b/infrastructure/kctf-samples/apache-php/healthcheck/exploit/run.sh
@@ -0,0 +1,18 @@
+#!/bin/bash
+
+set -Eeuo pipefail
+
+TIMEOUT=20
+PERIOD=30
+
+while true; do
+  source /config/env
+  date
+  if timeout "${TIMEOUT}" /exploit/doit.py NOTERM; then
+    echo 'ok' | tee /tmp/healthz
+  else
+    echo -n "$? "
+    echo 'err' | tee /tmp/healthz  
+  fi
+  sleep "${PERIOD}"
+done
diff --git a/infrastructure/kctf-samples/apache-php/healthcheck/files/healthz.py b/infrastructure/kctf-samples/apache-php/healthcheck/files/healthz.py
@@ -0,0 +1,27 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+
+import BaseHTTPServer
+
+class HealthzHandler(BaseHTTPServer.BaseHTTPRequestHandler):
+    def do_GET(self):
+        if self.path != '/healthz':
+            self.send_response(404)
+            self.send_header("Content-length", "0")
+            self.end_headers()
+            return
+
+        content = 'err'
+        try:
+            with open('/tmp/healthz', 'r') as fd:
+                content = fd.read().strip()
+        except:
+            pass
+        self.send_response(200 if content == 'ok' else 400)
+        self.send_header("Content-type", "text/plain")
+        self.send_header("Content-length", str(len(content)))
+        self.end_headers()
+        self.wfile.write(content)
+
+httpd = BaseHTTPServer.HTTPServer(('', 8080), HealthzHandler)
+httpd.serve_forever()
diff --git a/infrastructure/kctf-samples/apache-php/healthcheck/secrets/kustomization.yaml b/infrastructure/kctf-samples/apache-php/healthcheck/secrets/kustomization.yaml
@@ -0,0 +1,9 @@
+secretGenerator:
+- name: apache-php-healthcheck-secrets
+  files:
+generatorOptions:
+  disableNameSuffixHash: true
+  labels:
+    type: generated
+  annotations:
+    note: generated
diff --git a/infrastructure/kctf-samples/apache-php/k8s/deployment/autoscaling.yaml b/infrastructure/kctf-samples/apache-php/k8s/deployment/autoscaling.yaml
@@ -0,0 +1,6 @@
+apiVersion: "autoscaling/v1"
+kind: "HorizontalPodAutoscaler"
+metadata:
+  name: "chal"
+#spec:
+#  maxReplicas: 3
diff --git a/infrastructure/kctf-samples/apache-php/k8s/deployment/containers.yaml b/infrastructure/kctf-samples/apache-php/k8s/deployment/containers.yaml
@@ -0,0 +1,4 @@
+apiVersion: "apps/v1"
+kind: "Deployment"
+metadata:
+  name: "chal"
diff --git a/infrastructure/kctf-samples/apache-php/k8s/deployment/kustomization.yaml b/infrastructure/kctf-samples/apache-php/k8s/deployment/kustomization.yaml
@@ -0,0 +1,6 @@
+bases:
+- ../../.gen/k8s/deployment
+
+patchesStrategicMerge:
+- autoscaling.yaml
+- containers.yaml
diff --git a/infrastructure/kctf-samples/apache-php/k8s/network/kustomization.yaml b/infrastructure/kctf-samples/apache-php/k8s/network/kustomization.yaml
@@ -0,0 +1,5 @@
+bases:
+- ../../.gen/k8s/network
+
+patchesStrategicMerge:
+- network.yaml
diff --git a/infrastructure/kctf-samples/apache-php/k8s/network/network.yaml b/infrastructure/kctf-samples/apache-php/k8s/network/network.yaml
@@ -0,0 +1,11 @@
+apiVersion: "v1"
+kind: "Service"
+metadata:
+  name: "chal"
+spec:
+  type: "LoadBalancer"
+  ports:
+  - name: "http"
+    protocol: "TCP"
+    port: 80
+    targetPort: 1337

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+# this directory is for Makefile generated outputs`
	`2`	`+*`
	`3`	`+!.gitignore`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	`+#!/bin/bash`
	`2`	`+/usr/bin/nsjail --config /config/nsjail-php.cfg -- /usr/lib/cgi-bin/php $@`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1 @@`
	`1`	`+<form method=POST><textarea autofocus name=eval style=height:90%;width:100%;display:block><?php echo htmlentities($_REQUEST["eval"])?></textarea><input type=submit><hr><plaintext><?php echo(eval($_REQUEST["eval"])); ?>`