Challenges in Informatics: Patching, Hacking and Exploiting - Gameserver

















More on the organizor

Last updated on 06.11.10 20:24

Gameserver for CTF-style contests

This gameserver was written to support the CIPHER contest of the RWTH Aachen on July 22nd 2005. The gameserver was entirely designed and written by Lexi Pimenidis.

A capture-the-flag exercise, short: CTF, consists of multiple teams, each hosting a server that has multiple services running, like e.g. a webserver, a mail server, or customized services. The services contain typical security vulnerabilities that allow to compromise the server to a certain extend.

The goal of these challenges is to maintain the services up, functional and uncompromised for the duration of the game. Additional scores can usualy be gained by patching the vulnerabilities of the services and exploiting the knowledge of the found weaknesses at the other team's servers.

The main task of the gameserver is to periodically check whether the services are working and functional. This gameserver is designed to do this task for a number of parallel games, services and teams.

The gameserver is designed to be as stateless as possible. If the process is killed or terminated it can simply be restarted without major problems. The complete process and status of the game is stored in the mysql database. Thus, killing the gameserver does at maximum stops all transactions that are currently done. But besides the actions that were active when the gameserver was killed, everything else should continue working as if it were never restarted.

Software prerequisites

To make full use of this piece of software, you need
  • Perl, for the Gameserver, the Submitserver, and the Scoreserver themselves
  • mySQL, for the Database
  • a php-enabled Webserver


This game server has been successfully deployed in (at least) the following major CTFs:


Download the Source. Below a history of versions:

  • Version 1.0413 (2008-08-11), some minor bugs fixed, esp. for drone+submitserver now take their time from the DB, therewith avoiding the need to synchronixe the clock of their boxes to that of the DB.
  • Version 1.0402 (2008-08-05), big changes in architecture: no more threading. now the software can utilize multiple computers, enhanced debugging for gamemasters
  • Version 0.0487 (2007-05-23), checked the documentation a bit and removed some debugging stuff
  • Version 0.0485 (2007-03-09), enhanced advisory editing and submission a bit
  • Version 0.0473 (2007-01-05), removed HTTP-server from scoreserver, added team/servce-templates for scoreserver, added some CGIs for advisories, added possibility to run services for single machines only
  • Version 0.0416 (2006-07-17), MAJOR CHANGES: added management console, scoreserver, and a lot of other stuff
  • Version 0.0339 (2006-05-30), adapted DOCUMENTATION to last changes, removed old way of submitting flags, enhanced safety
  • Version 0.0332 (2006-04-17), scores are now stored as floats instead of ints, removing rounding errors
  • Version 0.0315 (2006-04-06), fixed bug in the submit server (resetting a connection lead to DoS of a thread)
  • Version 0.0308 (2005-12-29), there's now a dedicated submit-server and some other patches from 22c3
  • Version 0.0275 (2005-12-07), flag-identifiers are now also a random-looking string
  • Version 0.0271 (2005-10-26), fixes zombie problem, added feature: submissionfrequency. Thanks to Lorenzo Martignoni for these patches :-)
  • Version 0.0270 (2005-08-11), fixes possible thread-safe-problem in
  • Version 0.0267 (2005-08-03), initial public release

This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.

The full GNU General Public License is included in this distribution in the file called LICENSE.

Valid HTML 4.01!   best viewed with telnet to port 80