SA-ctf_scoreboard - CTF思路相关项目

项目说明

SA-ctf_scoreboard

A capture the flag scoreboard app for Splunk.

NOTE: As of January 2022, this app has been deprecated. Please visit for hands-on experiences using Splunk security products. Splunk will no longer provide assistance or support for this app.

This app, along with its companion admin app, allows anyone to run their own jeopardy-style capture the flag (CTF) events. These are the same apps that we at Splunk use to run early of our popular Splunk Boss of the SOC (BOTS) competitions. The apps include the following features:
* User/Team management
* Scoring management
* Question/Answer management
* Hint management
* Comprehensi, dashboards, and analytics

The scoring apps run on Splunk Enterprise. If you do not have a Splunk license, these apps can run with full functionality on the Enterprise Trial of Splunk a at www.splunk.com

Related Projects

* Boss of the SOC 1 (botsv1) data set
* Boss of the SOC 1 (botsv1) questions, answers, hints. Please contact bots \<at\> splunk.com for access to these resources.

Installation

1. Install Splunk Enterprise
* The apps are designed to run on Linux and/or Mac OSX; they ha been tested on Splunk for Windows (Note: This app requires Splunk Enterprise 8.2.x)
* Download Splunk from www.splunk.com
* Refer to Splunk installation instructions for Linux and Mac OSX as necessary
* Set a strong password for the Splunk admin user
* Set the time zone for the admin user Web
* Enable HTTPS on Splunk Web

2. Set the $SPLUNK_HOME en
* The default location for Splunk is "/opt/splunk" but yours *may* be different
* Assuming the default, this command will set the en appropriately:

2. Install the following prerequisite Splunk apps and add-ons
* Lookup File Editor app (Note: Tested with 3.0.3)
* Parallel Coordinates Custom (Note: Tested with 1.2.0)
* Simple Timeseries Custom (Note: Tested with 1.0)
* Timeline Custom (Note: Tested with 1.2.0)

3. Install the CTF Scoreboard app

4. Install the CTF Scoreboard Admin app

5. Restart Splunk to recognize all the prerequisites and the scoring apps

7. Create scoreboard log directory

8. Create the CTF Answers service account in Splunk
* By con this user is called s
* Pick a good strong password, and record it. You will need it again soon. The good news is that it does not need to be easily memorized by a human.
* Assign the s user to role ctf_answers_service
* This can all be accomplished from the command line as follows:

9. Configure the custom controller

* Edit scoreboard_controller.config to reflect the following:
* The CTF Answers service account username (probably s)
* The CTF Answers service account password you chose above
* A vkey parameter which should just be a random string, 10-20 characters in length
* Note: scoreboard_controller.config is pre via .gitignore from being checked into the git repository. Only the example file is included in the repository.

10. Restart Splunk to recognize the changes to the controller configuration file.

11. Confirm the custom controller came up properly:

12. Set up an admin user
* It does not need to be *the* Splunk admin user, but it can be and often is
* In Splunk Web ensure the admin user has been assigned the following roles:
* admin
* ctf_admin
* can_delete

13. Load sample data
* Log in as the admin user created above
* Na to Capture the Flag Admin app
* Click each of the following menu items in turn:
* Data Management...->Load SAMPLE data (DANGER)->Load sample users/teams
* Data Management...->Load SAMPLE data (DANGER)->Load sample questions
* Data Management...->Load SAMPLE data (DANGER)->Load sample answers
* Data Management...->Load SAMPLE data (DANGER)->Load sample hints
* Data Management...->Load SAMPLE data (DANGER)->Load sample hint entitlements
* Data Management...->Load SAMPLE data (DANGER)->Load sample badges
* Data Management...->Load SAMPLE data (DANGER)->Load sample badge entitlements
* Data Management...->Load SAMPLE data (DANGER)->Load sample user agreements

* It's not _really_ dangerous, but it will o the data you currently ha in the game.

14. Customize your questions/answers/hints

Use the items on the Edit menu to customize the game to your liking.

Alternatively, follow these instructions to load the Splunk BOTS questions, answers, and hints
* Obtain the following three files: ctf_questions.cs.cs.csv
* Na to Capture the Flag Admin app
* Load questions
1. Edit -> Edit Questions
2. Click the Import button in the upper right
3. Click Select file to import
4. Select the ctf_questions.csv file
* Load answers
1. Edit -> Edit Answers
2. Click the Import button in the upper right
3. Click Select file to import
4. Select the ctf_answers.csv file
* Load hints
1. Edit -> Edit Hints
2. Click the Import button in the upper right
3. Click Select file to import
4. Select the ctf_hints.csv file
* Check that the questions/answers were loaded properly
1. Na to Capture the Flag Admin app
2. View -> Q & A
3. inspect the Questions and Answers

15. Set the start / end time of the questions in the competition
* Though not required, it is easiest if you set both your computer time zone, AND the Splunk time zone for the user you are logged in as to the main time zone of the event
* In the CTF Admin app Go to Edit->Time Setup
* Follow the instructions embedded in the dashboard. In Step 0, first ensure you have the proper question set loaded. Review your start and end times to determine if they need to be adjusted. This is accomplished by inspecting the bottom panel.
* If the questions look right, but the times need adjusting
* Populate the start and end dates/times in the GUI. If you set your computer and Splunk TZ as suggested in an earlier step, you will likely not have to worry about the TZ setting in the pull-down.
* Click green “Submit Changes” button.
* Check that “Question Summary” panel at the bottom for sanity.
* the start/end times by View -> Q&A and inspecting the NiceStartTime and NiceEndTime columns.

16. Disable access to the questions for the ctf_competitor role.
* Go to CTF Admin app and load Edit->Question Access dashboard.
* The current status of questions will be displayed. Disable access until immediately before you are ready to begin the competition, then enable it.

Clearing Results

To clear all activity from the scoring app, perform these steps.

WARNING: Running these commands will permanenently delete all the activity from the app and reset all scores to zero.

Authors

Written in 2016-2018 by Da and Ryan Kovar, with contributions from Brad Lindow, James Brodsky, Da, John Stoner, Ste, Jesse Trucks, Lily Lee, Jon Lebaugh, Bill Babillon, Luke Murphey, Filip Wijnholds, and others.

Copyright and License

To the extent possible under law, the author(s) ha
all copyright and related and neighboring rights to this software
to the public domain worldwide. This software is distributed
without any warranty. You should ha a copy of the CC0
Public Domain Dedication along with this software. If not, see

Special Copyright/License Notes

The following files are included from the Splunk 6.x Dashboard Examples app 6.6.1 and are subject to the licenses included therein.
* appser/custom_table_row_expansion.js
* appser/table_icons_inline.js
* appser/table_decorations.css

项目信息

开发语言：Python

Star 数：128

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕CTF思路相关项目展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。