defcon-vm - Files from my DEFCON CTF VM.

项目说明

DEFCON CTF #

This repository contains the files necessary for the DEFCON CTF VM that I created. You can grab a copy of the VM
itself from my blog.

To use this start it up in and do the following to connect to a gi:

*NOTE: Your network settings may not resolve "defcon.local" as a hostname. You can log in and run ifconfig from
inside the VM to get its IP address. You can also try using just "defcon" or "defcon.<your local domain>" and see if
those work.*

Getting the flag for each service is, ob, an exercise left to the reader.

List of Services ##

DEFCON 13 (2005) ###

* Organizers: Kenshoto
* Operating System: FreeBSD 5.4

*NOTE: Check /root/kinit.py for how to run these services! Many of these were xinetd services that don't contain
their own ser code.*

| Service Name | User | Port | Protocol | Notes |
| ----------------- | ------------- | ----- | --------- | -------------------------------------------- |
| apachectl | ????? | ????? | ?????? | NOT RUNNING |
| befunge | bfg | ????? | ?????? | NOT RUNNING: Requires the PyFunge library |
| bparkd | bparkd | ????? | ?????? | NOT RUNNING: Requires enigma and .bpconfig to run |
| echod | ????? | ????? | ?????? | NOT RUNNING |
| fingerd | ????? | ????? | ?????? | NOT RUNNING |
| fucktcpd | ????? | ????? | ?????? | NOT RUNNING |
| HowAreYouToday.py | frat | ????? | ?????? | NOT RUNNING |
| inetd | ????? | ????? | ?????? | NOT RUNNING |
| kmud.py | kmud | ????? | ?????? | NOT RUNNING |
| kpub.py | pub | ????? | ?????? | NOT RUNNING |
| named | ????? | ????? | ?????? | NOT RUNNING |
| postfix | ????? | ????? | ?????? | NOT RUNNING |
| tomcat50ctl | www | ????? | ?????? | NOT RUNNING |
| transformd | transform | ????? | ?????? | NOT RUNNING: Requires joshua to run? |
| UserAdder.py | ????? | ????? | ?????? | NOT RUNNING |
| wumpus | wumpus | ????? | ?????? | NOT RUNNING |

Other binaries I've come across that may have been part of this year:

* alice
* b16
* kstrings
* nettoe
* readmail
* smtpd
*

DEFCON 14 (2006) ###

* Organizers: Kenshoto
* Operating System: Solaris ???

Notably absent from the VM are the services from DEFCON 14. These challenges were built for and ran on Solaris.
Since I haven't created a Solaris VM to host them (and a Solaris translation layer for FreeBSD doesn't appear to exist),
I can't get them running. I do, however, have what I *think* are all of the services if anyone would like to play with
them. Their names are:

* CookieMonster
* CustomHeap
* FingerLickinGood
* FuckTcpd2
* Heisenberg
* IFallDown
* InMyMemory
* KuFtpd
* NPComplete
* OhShitD
* SpamMe
*
* YouHadMeAtHello

DEFCON 15 (2007) ###

* Organizers: Kenshoto
* Operating System: FreeBSD 6.3?

*NOTE: Many of the following services require the compat6x-i386 package to be installed.*

| Service Name | User | Port | Protocol | Notes |
| ----------------- | ------------- | ----- | --------- | -------------------------------------------- |
| arpsd | arps | 1331 | TCPv4 | |
| blowlogd | blowlog | 1500 | UDPv4 | |
| hfd | hfd | 1024 | TCPv4 | Needs server.pem, dh1024.pem, root.pem in /home/hfd |
| kftpd | kftp | 2121 | TCPv4 | |
| kimjong | kimjong | 9999 | TCPv4 | |
| kuftpd | kuftpd | 21 | TCPv4 | |
| madlibd | madlib | 4042 | TCPv4 | Needs articles.txt, nouns.txt, objects.txt, verbs.txt in /home/madlib |
| menageatrois | menageatrois | 3339 | TCPv4 | |
| neurod | wintermute | 5953 | TCPv4 | Requires the dlmalloc package to be installed |
| perudo | perudo | 3822 | TCPv4 | |
| rolodex | rolodex | 8224 | TCPv4 | |
| sammichd | sammich | 8365 | TCPv4 | |
| shellcat | shellcat | 7890 | TCPv4 | |
| sor | sor | 9051 | TCPv4 | |
| supd | sup | ????? | ????? | NOT RUNNING: Requires python2.5 and the socket module (also may actually have been from DEFCON 16..? need to confirm with someone) |

Other binaries I've come across that may have been part of this year:

* xserver (looks like a web challenge...drops to user "xserver")
* UserAdder and makeuser? (looks like just a way to create users...drops to user "makeuser")
* I have a "serverd" somehow that I ha as being from this year, but honestly no idea where this is from or what it's for

DEFCON 16 (2008) ###

* Organizers: Kenshoto
* Operating System: FreeBSD 6.3

| Service Name | User | Port | Protocol | Notes |
| ----------------- | ------------- | ----- | --------- | -------------------------------------------- |
| antipastod | antipasto | 7482 | TCPv4 | |
| aspd | asp | ????? | ????? | NOT RUNNING: Won't run for some reason...just prints "Done" |
| bakalakadakaChat | durka | 15641 | TCPv4 | |
| barista | barista | ????? | ????? | NOT RUNNING: 1: Syntax error: ")" unexpected |
| catdoord | catdoor | 4341 | TCPv4 | |
| duckshootd | duckshoot | 3888 | TCPv4 | |
| EmergencyBrake | EmergencyBrake| 2028 | TCPv4 | |
| grimcreeper.d | grimcreeper | 9001 | TCPv4 | |
| hashpiped | hashpipe | 5641 | TCPv4 | |
| iMagick | iMagick | 4141 | TCPv4 | |
| kdnsd | kdns | ????? | ????? | NOT RUNNING: Requires kdns.conf, python2.5, and the socket module to run |
| kmaild | kmail | 17722 | TCPv4 | |
| kmsgd | kmsg | 10001 | TCPv4 | |
| kryptod | krypto | 20020 | TCPv4 | |
| lockstep | lockstep | ????? | ????? | NOT RUNNING: Requires python2.5 and the md5 module |
| moatd | moat | 6810 | TCPv4 | |
| roflcode | roflcode | 4000 | TCPv4 | |
| sockringd | sockring | 14340 | TCPv4 | |
| supd | sup | ????? | ????? | NOT RUNNING |
| superd | super | 8126 | TCPv4 | |

Other binaries I've come across that may have been part of this year:

* SupaFlyTNT
* Something that would have used a user named "nubbin"?

DEFCON 17 (2009) ###

* Organizers: DDTEK
* Operating System: FreeBSD 7.2

| Service Name | User | Port | Protocol | Notes |
| ----------------- | ------------- | ----- | --------- | -------------------------------------------- |
| baaaad | sheepc | ????? | ????? | NOT RUNNING: Unable to register (MESSAGEPROG, MESSAGEVERS, udp) |
| casino | casino | ????? | ????? | NOT RUNNING: syntax error on line 1 |
| cheese.pl | cheese | ????? | ????? | NOT RUNNING: Some web service..? Not sure I even have this on the now... |
| cmd | cm | 4546 | TCPv4 | Requires cjd in /usr/local/sbin |
| deltad | delta | 1787 | TCPv4 | |
| deuced | deuce | 2056 | TCPv4 | |
| elfd | buddy | 7331 | TCPv4 | |
| lazrus | lazrus | 1905 | TCPv4 | |
| magicd | magic | 4343 | TCPv4 | |
| mdljserver | mdlj | ????? | ????? | NOT RUNNING: Requires a .pem, .crt, and .key file, fails to load private key, and subsequently dies with SSL ERROR (certs are currently in /home/mdlj but don't work) |
| mymqld | mymql | 4242 | TCPv4 | |
| nickd | nickster | 2337 | TCPv4 | |
| rsatesp | rsatesp | 5500 | TCPv4 | Requires sqlite3 package and has an auth.db created by createdb.sh in /home/rsatesp that don't appear to work |
| tucod | tuco | 57005 | TCPv4 | |
| wwcd | wwcd | 6977 | TCPv4 | |

DEFCON 18 (2010) ###

* Organizers: DDTEK
* Operating System: FreeBSD 8.0

| Service Name | User | Port | Protocol | Notes |
| ----------------- | ------------- | ----- | --------- | -------------------------------------------- |
| cohend | cohend | 7532 | TCPv4 | |
| ddftpd | ddftp | 1776 | UDPv4 | |
| diablo | diablo | ????? | ???? | NOT RUNNING: Requires diablo-jvm 1.6.10 or something (might also require Launcher.class and a few other things?) |
| food | food | ????? | ???? | NOT RUNNING: Requires libutil.so.8 (and is a frozen python2.6 service that complains about no module named "_socket") |
| houdini | houdini | ????? | ???? | NOT RUNNING: This is a PE binary and I have no idea how it ever ran (WINE as a custom kernel module?) - very aptly named service |
| libra | libra | 1495 | TCPv4 | |
| mashup | mashup | 5539 | TCPv4 | |
| memix | memix | 9911 | ???? | NOT RUNNING: Appears to not be able to read a "local auth file" and is also missing the patch it downloaded from DDTEK's servers to make it |
| mqdbd | mqdb | 2001 | TCPv4 | |
| nadel | nadel | 3248 | TCPv4 | |
| natord | nator | 2985 | TCPv4 | |
| noprotas | noprotas | 23945 | UDPv4 | |
| santad | santa | ????? | ???? | NOT RUNNING: Won't run for some reason...just prints "Done" |
| slickd | slick | 7391 | TCPv4 | |
| spelunk | spelunk | 8362 | TCPv4 | Requires adv.key and adv.rec in /home/spelunk |
| sushid | sushi | | RAWv4 | |

DEFCON 19 (2011) ###

* Organizers: DDTEK
* Operating System: FreeBSD 8.2

*NOTE: In addition to the services below, there was also a service called "finch" that interacted with some remote
control cars in a chicken coop. To my knowledge, no team e out how to score successfully (you were supposed
to drive your car into the lighted area matching your car's color). Since "finch" was a Linux binary that was meant to
run on your own machine, it isn't included below.*

| Service Name | User | Port | Protocol | Notes |
| ----------------- | ------------- | ----- | --------- | -------------------------------------------- |
| bowser | bowser | NONE | TCPv6 | Local service with usage: /usr/local/sbin/bowser <host> |
| bunny | bunny | 15323 | TCPv6 | |
| castle | castle | 7629 | TCPv6 | Requires sandy in /usr/local/sbin |
| cleaner | cleaner | 26987 | TCPv6 | |
| forgetu | forgetu | 3128 | TCPv6 | |
| gold | gold | 2069 | TCPv6 | |
| hiver | hiver | 44366 | TCPv6 | |
| htlame | htlame | 42737 | TCPv6 | |
| pisa | pisa | 6765 | TCPv6 | |
| rotary | rotary | 3375 | TCPv6 | |
| sheepster | sheepster | 5775 | TCPv6 | |
| telephone | bell | 1477 | TCPv6 | |
| tomato | tomato | 6391 | TCPv6 | |
| war | war | 14273 | TCPv6 | |

DEFCON 20 (2012) ###

* Organizers: DDTEK
* Operating System: FreeBSD 9.0

*NOTE: All these services bound the interface em1 in the game, but I patched them to bind em0 for the VM to work.*

| Service Name | User | Port | Protocol | Notes |
| ----------------- | ------------- | ----- | --------- | -------------------------------------------- |
| cashew | cashew | 7979 | TCPv6 | |
| cherry | cherry | 24359 | TCPv6 | |
| coney | coney | 65214 | TCPv6 | |
| desheepd | desheepd | 547 | UDPv6 | |
| dog | dog | ????? | ???v6 | NOT RUNNING: Cannot open /usr/local/ctp/lib/perl5/5.16.0/i386-freebsd/CORE/libperl.so |
| gallows | gallows | 6666 | TCPv6 | |
| intception | dealer | 8888 | TCPv6 | |
| jerkin | jerkin | 63715 | TCPv6 | |
| mixology | mixology | 35575 | TCPv6 | |
| nom | nom | 7368 | TCPv6 | |
| nssds | nssds | 54339 | TCPv6 | |
| ocrd | ocrd | 31967 | TCPv6 | |
| parrot | parrot | ????? | ???v6 | NOT RUNNING: Cannot open /usr/local/ctp/lib/perl5/5.16.0/i386-freebsd/CORE/libperl.so |
| ralph | ralph | 57553 | TCPv6 | |
| scool | scool | 4637 | TCPv6 | |
| semem | semem | 6941 | TCPv6 | |
| tictactoe | tictactoe | 25375 | TCPv6 | |
| torqux | torqux | ????? | ???v6 | NOT RUNNING: Must be run with python2.7 directly (still doesn't seem to work?) |
| zul | zul | 25201 | TCPv6 | |

Setting Up Your Own VM ##

In case you don't like the VM I', here's some quick documentation on how I set up the !

Initial Setup ###

The initial setup is simple:

* Installed FreeBSD 9.1 with default options from the i386 install media
* Uncommented and set "PermitRootLogin" to "yes" in /etc/ssh/sshd_config with vi
* Ran /etc/rc.d/sshd restart so I could SSH/SCP

*NOTE: In the real CTF, each team would actually get a FreeBSD jail, rather than a VM. For simplicity, I've set
e up outside of a jail. I hope to find my documentation on jails and include it here in the future if anyone
wants to set things up more authentically. For now, you'll just have to make do with this approximation.*

Service Setup ##

Setting up services was a little more in. In order to run a gi, you will generally have to create a
user and home directory for that user. This is because most DEFCON CTF services will "drop" pri from root to an
unpri user specific to the service, just like real services. The ownership of the binary will also need to be
changed to prevent unwanted modifications. To do this:

Binaries before DEFCON 19 were located inside each service's home folder. Starting in DEFCON 19, however, they were
moved to /usr/local/sbin. Either approach is fine, but I found it easier to place all the services in
/usr/local/sbin.

Flags were typically stored in a file called "key" inside of each user's home directory. A kernel module was used to
change these out periodically (about once every 2-5 minutes or so). Since I don't have a similar kernel module, I just
placed the sha1sum of the service into the flag file:

At this point, running the service should be as easy as:

You can check if it is running/listening by doing:

If that doesn't work, check the table above to see if there are any caveats for a particular service. Some services
require extra stuff to be installed, configured, or otherwise present in order for it to function. Some were also not
actually network services and had to be run locally.

Once a service is running, you should be able to use netcat to connect to it:

Note that services won't start up by default unless you create an /etc/rc.d startup script for them. The template I
created for these, if you'd like to develop your own, is called rc_d_template in the top level of this repository.

项目信息

开发语言：Perl

Star 数：273

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Files from my DEFCON CTF VM.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。