	Challenges in Informatics: Patching, Hacking and Exploiting - Gameserver

CaptureTheFlag FAQ Gameserver HowToPlay Player'sClosedArea ReleaseNotes Cipher1 Cipher2 Cipher3 Cipher4 Cipher5 Cipher6 Contact Email Index More on the organizor	Last updated on 21.10.08 15:42 Gameserver for CTF-style contests This gameserver was written to support the CIPHER contest of the RWTH Aachen on July 22nd 2005. The gameserver was entirely designed and written by Lexi Pimenidis. A capture-the-flag exercise, short: CTF, consists of multiple teams, each hosting a server that has multiple services running, like e.g. a webserver, a mail server, or customized services. The services contain typical security vulnerabilities that allow to compromise the server to a certain extend. The goal of these challenges is to maintain the services up, functional and uncompromised for the duration of the game. Additional scores can usualy be gained by patching the vulnerabilities of the services and exploiting the knowledge of the found weaknesses at the other team's servers. The main task of the gameserver is to periodically check whether the services are working and functional. This gameserver is designed to do this task for a number of parallel games, services and teams. The gameserver is designed to be as stateless as possible. If the process is killed or terminated it can simply be restarted without major problems. The complete process and status of the game is stored in the mysql database. Thus, killing the gameserver does at maximum stops all transactions that are currently done. But besides the actions that were active when the gameserver was killed, everything else should continue working as if it were never restarted. Software prerequisites To make full use of this piece of software, you need Perl, for the Gameserver, the Submitserver, and the Scoreserver themselves mySQL, for the Database a php-enabled Webserver Tested This game server has been successfully deployed in (at least) the following major CTFs: CIPHER op3n CTF @ 22C3 CIPHER 2 CTF @ 23C3 CIPHER 3 CIPHER 4 Downloads Download the Source. Below a history of versions: Version 1.0413 (2008-08-11), some minor bugs fixed, esp. for drone+submitserver now take their time from the DB, therewith avoiding the need to synchronixe the clock of their boxes to that of the DB. Version 1.0402 (2008-08-05), big changes in architecture: no more threading. now the software can utilize multiple computers, enhanced debugging for gamemasters Version 0.0487 (2007-05-23), checked the documentation a bit and removed some debugging stuff Version 0.0485 (2007-03-09), enhanced advisory editing and submission a bit Version 0.0473 (2007-01-05), removed HTTP-server from scoreserver, added team/servce-templates for scoreserver, added some CGIs for advisories, added possibility to run services for single machines only Version 0.0416 (2006-07-17), MAJOR CHANGES: added management console, scoreserver, and a lot of other stuff Version 0.0339 (2006-05-30), adapted DOCUMENTATION to last changes, removed old way of submitting flags, enhanced safety Version 0.0332 (2006-04-17), scores are now stored as floats instead of ints, removing rounding errors Version 0.0315 (2006-04-06), fixed bug in the submit server (resetting a connection lead to DoS of a thread) Version 0.0308 (2005-12-29), there's now a dedicated submit-server and some other patches from 22c3 Version 0.0275 (2005-12-07), flag-identifiers are now also a random-looking string Version 0.0271 (2005-10-26), fixes zombie problem, added feature: submissionfrequency. Thanks to Lorenzo Martignoni for these patches :-) Version 0.0270 (2005-08-11), fixes possible thread-safe-problem in submit.pl Version 0.0267 (2005-08-03), initial public release This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. The full GNU General Public License is included in this distribution in the file called LICENSE.

Challenges in Informatics: Patching, Hacking and Exploiting - Gameserver

Gameserver for CTF-style contests

This gameserver was written to support the CIPHER contest of the RWTH Aachen on July 22nd 2005. The gameserver was entirely designed and written by Lexi Pimenidis.

A capture-the-flag exercise, short: CTF, consists of multiple teams, each hosting a server that has multiple services running, like e.g. a webserver, a mail server, or customized services. The services contain typical security vulnerabilities that allow to compromise the server to a certain extend.

The goal of these challenges is to maintain the services up, functional and uncompromised for the duration of the game. Additional scores can usualy be gained by patching the vulnerabilities of the services and exploiting the knowledge of the found weaknesses at the other team's servers.

The main task of the gameserver is to periodically check whether the services are working and functional. This gameserver is designed to do this task for a number of parallel games, services and teams.

The gameserver is designed to be as stateless as possible. If the process is killed or terminated it can simply be restarted without major problems. The complete process and status of the game is stored in the mysql database. Thus, killing the gameserver does at maximum stops all transactions that are currently done. But besides the actions that were active when the gameserver was killed, everything else should continue working as if it were never restarted.

Software prerequisites

To make full use of this piece of software, you need

Perl, for the Gameserver, the Submitserver, and the Scoreserver themselves
mySQL, for the Database
a php-enabled Webserver

Tested

This game server has been successfully deployed in (at least) the following major CTFs:

CIPHER
op3n
CTF @ 22C3
CIPHER 2
CTF @ 23C3
CIPHER 3
CIPHER 4

Downloads

Download the Source. Below a history of versions:

Version 1.0413 (2008-08-11), some minor bugs fixed, esp. for drone+submitserver now take their time from the DB, therewith avoiding the need to synchronixe the clock of their boxes to that of the DB.
Version 1.0402 (2008-08-05), big changes in architecture: no more threading. now the software can utilize multiple computers, enhanced debugging for gamemasters
Version 0.0487 (2007-05-23), checked the documentation a bit and removed some debugging stuff
Version 0.0485 (2007-03-09), enhanced advisory editing and submission a bit
Version 0.0473 (2007-01-05), removed HTTP-server from scoreserver, added team/servce-templates for scoreserver, added some CGIs for advisories, added possibility to run services for single machines only
Version 0.0416 (2006-07-17), MAJOR CHANGES: added management console, scoreserver, and a lot of other stuff
Version 0.0339 (2006-05-30), adapted DOCUMENTATION to last changes, removed old way of submitting flags, enhanced safety
Version 0.0332 (2006-04-17), scores are now stored as floats instead of ints, removing rounding errors
Version 0.0315 (2006-04-06), fixed bug in the submit server (resetting a connection lead to DoS of a thread)
Version 0.0308 (2005-12-29), there's now a dedicated submit-server and some other patches from 22c3
Version 0.0275 (2005-12-07), flag-identifiers are now also a random-looking string
Version 0.0271 (2005-10-26), fixes zombie problem, added feature: submissionfrequency. Thanks to Lorenzo Martignoni for these patches :-)
Version 0.0270 (2005-08-11), fixes possible thread-safe-problem in submit.pl
Version 0.0267 (2005-08-03), initial public release

This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.

The full GNU General Public License is included in this distribution in the file called LICENSE.