GitCTF - Git-based CTF

项目说明

Git-based CTF

Git-based CTF is a no CTF platform that can be easily
hosted as an in-course activity proposed in our paper at USENIX ASE. This
repository contains scripts for automating . To
see how to configure and play Git-based CTF, see the followings.

**If you want to see the covered in our
paper
at USENIX ASE, please refer to ase branch.**

Setup

Requirement

1. Instructors should modify the config.json file to
start with.

1. Students need to obtain the config.json file
prepared by the instructors in Step 1.

1. Each team should prepare for a PGP public & private key pair in their own
machine. The teams' public keys should be distributed before the game begins.

1. Each student should install GPG and Docker on their own machine in
order to play CTF.

For Students

Git-based CTF consists of three major steps: preparation, injection, and
exercise. We provide a set of tools that help students play the CTF for each
step.

#### 1. Preparation Step

In this step, you need to prepare a network service running in a Docker
container. The final outcome of this step is a Git repository that contains a
Dockerfile as well as source code for the service program. We provide several
useful tools and scripts that help create such a service container.

We provide a template Dockerfile, which can be used to

prepare a service application.

You can check whether a service repository is valid or not by running:

The abo checks whether the BRANCH branch of the repository follows
the Git-based CTF con.

#### 2. Injection Step

You should inject into the service application prepared in the
previous step. You should also provide a working exploit for each injected
as a proof. An exploit in Git-based CTF is a program running in a
Docker container, and it should follow a specific format, e.g., it should be
properly encrypted and signed. We provide several tools and scripts that help
creating and injected and exploits.

You should write an exploit program/script using the template

Dockerfile we provided.

You can your exploit against a service of a specific (i.e.,

specific branch). Assume that you have a local copy of a target service at
SRVDIR, and your exploit at EXPDIR. You can then run the following command to
test whether your exploit works within a SEC seconds against the BRANCH branch of the
service:

Also, if you add the option, you can encrypt the exploit when
it gets . You should upload (i.e. commit and push) this encrypted
exploit, which will be named as in the root
directory of each branch. Here, is the corresponding branch name.

After uploading all the exploits, you can your submitted exploits

against each branch of your service, with the following command.

#### 3. Exercise Step

In this step, you finally play the actual CTF game. To attack other opponents,
you should create an issue that contains an encrypted attack described in the
previous step.

To prepare for an attack, you should create a zip file that has a directory

containing an exploit Dockerfile as well as an exploit script/program. You
then sign and encrypt the zipped directory, and submit it as an issue in the
target team's repository. Assuming that you have a local copy of a target
service at SRVDIR, and your exploit at EXPDIR, the following command will
perform these steps automatically.

You can see issues in your own repository to check whether you are attacked by

other opponents. Since each issue is encrypted with your own key, you can
download the attack and replay it in your own local machine. Especially, you
may want to analyze how an unintended is exploited. To
unintended exploit, you can use gitctf.py exploit command described
above.

You can also check your score with our tool. Assuming that the scoreboard

repository URL is properly given by config.json file, you can invoke the
following command to see the current score.

Note that the points you see from the abo may slightly differ from
the actual points computed at the instructor's machine, because this command
relies on the system time to compute the unintended points.
Also, This command automatically populates an HTML file score.html that
shows a graph representing score over time for each team or person.

For Instructors

There should be a machine that is dedicated to e the attacks in
Git-based CTF. The machine needs to be time-synchronized with an NTP server.

Create the repository of scoreboard. You can check out an example

scoreboard.

Click the Watch button in each team's service repository.

After the injection phase, you need to create a

config.json file, which describes the basic
settings for a CTF.

After the injection phase, you need to fill the commit hash of N-th injected

bug of each team, with the following command.

During the exercise phase, the machine should run the following command

assuming that you have a proper set-up for the ssh-agent and the gpg-agent,
because this command will invoke a series of ssh and gpg commands, and
such commands require a user to enter a passphrase.

This command will run in an infinite loop, automatically fetch issues from
the repositories, and update the scoreboard. This process will be killed when
CTF is finished.

Configuration

This file contains critical information for managing
Git-based CTF. This script must be created by an instructor, and distributed to
students before a CTF begins. You can check out an example configuration file

##### The config.json file requires the following fields:

1. player: Your GitHub ID.
1. player_team: Your team name.
1. score_board: The URL for the scoreboard repository.
1. repo_owner: The name of the owner of the CTF repositories.
1. intended_pts: Points for exploiting an intended .
1. unintended_pts: Points for exploiting an unintended .
1. round_frequency: How often will our system change the round? (in sec.)
1. start_time: When does the exercise phase start? You should put a string in the ISO8601
format, e.g., you can use date -Iseconds.
1. end_time: When does this CTF finish? You should put a string in the ISO8601
format.
1. exploit_timeout: Timeout for exploit. (in sec.)
1. exercise_phase: Timeout when exploit in exercise phase.
1. injection_phase: Timeout when exploit in injection phase.
1. teams: Participating teams' information.
1. repo_name: The URL for each team's service repository.
1. pub_key_id: The public key ID of the team.
1. bugN: The commit hash of the N-th injected bug of this team.
1. indi: Participating indi' information. Each field is separated
by participants' GitHub IDs.
1. pub_key_id: The public key ID of the indi.
1. team: Which team does this indi belong to?

Authors

This research project has been conducted by SoftSec Lab at KAIST.

* Seongil Wi
* Jaeseung Choi
* Sang Kil Cha

Citing Git-based CTF

To cite our paper:

License

This project is licensed under the Apache License

Acknowledgement

We thank GitHub for pro unlimited free plan for organizing classes. We also thank HyungSeok Han and anonymous re for their constructi. This work was supported by Institute for Information & communications Technology Promotion (IITP) grant funded by the Korea go (MSIT)

项目信息

开发语言：Python

Star 数：64

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Git-based CTF展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。