2018-ctf-game - Repo containing links to all CTF Challenges used i

项目说明

2018-ctf-game
=============

The following is a list of all of the challenges used for the 2018 CTF along with their description and link for con. Each of these challenges contain a README which well tell you how to stand up the challenge and the correct key to allow you to check yourself when you solve it.

Crypto

<table>
<tr>
<th>Title</th>
<th>Value</th>
<th>Repository</th>
<th>Description</th>
</tr>
<tr>
<td>Keyboard Shuffle</td>
<td>100</td>
<td><a href="
<td>To the right, to the right, to the right, to the right<br/>To the left, to the left, to the left, to the left, to the left?<br/><br/>Ut awwna U;n cwrt vS r rtoubfm rgBJAB DIE VWUBF AI YBSWEARndubf BTQt~ nxPRTOUBF)UA)ooEWBRKT)Ges{</td>
</tr>
<tr>
<td>Challenge.find(55).description.length =&gt; 374</td>
<td>150</td>
<td><a href="
<td>0‌0​0‌0‌0​0​0‌0​0‌0​0‌0‌0‌0‌0​0​0‌0​0‌0‌0‌0‌0‌0​0‌0​0​0​0​0‌0​0​0‌0​0‌0​0‌0​0​0​0‌0​0‌0‌0‌0‌0‌0‌0‌0​0​0​0‌0​0‌0‌0‌0​0​0​0‌0​0‌0‌0‌0​0​0‌0‌0‌0​0​0‌0​0​0‌0​0‌0‌0‌0‌0​0‌0​0​0‌0‌0​0‌0​0‌0‌0‌0​0‌0​0‌0​0‌0‌0‌0​0‌0​0‌0​0‌0​0​0​0​0​0‌0​0‌0‌0‌0‌0​0​0‌0​0​0‌0​0​0‌0‌0‌0‌0​0​0‌0‌0‌0​0‌0​0​0​0‌0‌0‌0‌0‌0​0‌0​0​0​​​‌​‌‌‌‌​‌‌‌​​‌‌‌‌‌‌​​‌‌‌‌‌​​​‌‌​‌‌​​‌‌​‌‌‌‌​‌‌‌‌​‌‌​‌​​​‌‌‌​​​​​​‌​​​​​‌​</td>
</tr>
<tr>
<td>Blue Codes of Death</td>
<td>200</td>
<td><a href="
<td>For some reason I can only get this to run on Windows 2003...<br/><br/>Hint: Flag format for this challenge is MCA-flag</td>
</tr>
<tr>
<td>Platform 9 and 3/4ths</td>
<td>250</td>
<td><a href="
<td>You told your friend that his online game wasn&#39;t secure enough so he added some encryption. Shouldn&#39;t be possible to beat it now, right?<br/><br/>How to Run Client: Run ./preInstall.sh which installs 32-bit libraries that the game requires. Once the script completes, the game will run automatically.</td>
</tr>
</table>

Grab Bag

<table>
<tr>
<th>Title</th>
<th>Value</th>
<th>Repository</th>
<th>Description</th>
</tr>
<tr>
<td>CTF Jams</td>
<td>150</td>
<td><a href="
<td>The white cell loves to discover and share new music. Check out our new compilation album! We put a lot of work into the album art.</td>
</tr>
<tr>
<td>Gas Pump Simulator</td>
<td>200</td>
<td><a href="
<td>Who thought we could make boring e tasks like pumping gas more fun? You might even find a few &#39;lost&#39; credit cards along the way.<br/><br/>How to Run Client: Run preInstall.sh which installs 32-bit libraries that the game requires. Once the script completes, the game will run automatically.<br /><br />Hint: The flag has nothing to do with the splash screen/loading screen.<br/><br/>Hint 2: The whole challenge can be completed through the game.</td>
</tr>
<tr>
<td>AIRGAP</td>
<td>250</td>
<td><a href="
<td>Our man on the inside was able to upload a virus to an air-gapped network. Now that we&#39; control of their security cameras, we should be able to exfiltrate the flag.<br/><br/>Hint: The key matches the following regex mca (\w+ )+mca, you can test it online using rubular.</td>
</tr>
<tr>
<td>Final Boss!</td>
<td>300</td>
<td><a href="
<td>See the score is right there, but there&#39;s also a decimal point. That&#39;s hidden.<br/><br/>How to Run Client: Run preInstall.sh which installs 32-bit libraries that the game requires. Once the script completes, the game will run automatically.<br/></td>
</tr>
<tr>
<td>FAT Chance</td>
<td>400</td>
<td><a href="
<td>Data exfiltration has been a problem in our organization recently. Just this week we saw more suspect traffic come across the wire. The problem is, information security can&#39;t figure out what was transmitted. We need your help!<br/><br/>*Here&#39;s some information that will help you during the in.* Due to employee outrage at SSL break/inspect, our information security department decided to &quot;patch&quot; the kernel and seed random with timestamps so that users don&#39;t complain about HTTPS warnings when they browse the web and they can still decrypt all the traffic. It&#39;s genius! The suspect was obsessed with snakes, and we don&#39;t have any Python experts on our team, can you take a look?</td>
</tr>
</table>

Binary

<table>
<tr>
<th>Title</th>
<th>Value</th>
<th>Repository</th>
<th>Description</th>
</tr>
<tr>
<td>Security as a Service</td>
<td>150</td>
<td><a href="
<td>We lo. And that&#39;s why, from this point forward, we are declaring all applications that import, include, or require anything monolithic! And like all great micro-services it&#39;s open source!</td>
</tr>
<tr>
<td>INTeresting binary</td>
<td>300</td>
<td><a href="
<td>I&#39;ve got 3 problems but a buffer o is 0xffffffffffffffffff....<br/><br/><br/></td>
<tr>
<tr>
<td>Janitors Keyring</td>
<td>400</td>
<td><a href="
<td>The year is 2050. It was a dark night in Fank Jr 2 the janitors house when the phone rang. There was a problem at the office and they needed him to come in and unlock the doors. Since it&#39;s the future and all the doors are ob digital, so...maybe you can give him a hand? His bed is really comfortable.</td>
</tr>
<tr>
<td>Farm Sim</td>
<td>500</td>
<td><a href="
<td>Old McDonald had a farm. 0x0E 0x01 0x0E 0x01 0x00.</td>
</tr>
</table>

Web

<table>
<tr>
<th>Title</th>
<th>Value</th>
<th>Repository</th>
<th>Description</th>
</tr>
<tr>
<td>&quot;Express&quot; Checkout</td>
<td>50</td>
<td><a href="
<td>It took a lot of courage but our great team accomplished the unthinkable. We are happy to announce a fantastic new express checkout experience. Our customers are going to love it! This new workflow has your items delivered to someone else in no time flat!</td>
</tr>
<tr>
<td>Adverse Reaction</td>
<td>100</td>
<td><a href="
<td>We see you&#39;re running an ad-blocker. To view this content consider opening yourself up to malware. You can also subscribe for $9.99/month and still receive ads!</td>
</tr>
<tr>
<td>Click Me</td>
<td>100</td>
<td><a href="
<td>No really, go for it.</td>
</tr>
<tr>
<td>Two Problems</td>
<td>100</td>
<td><a href="
<td>I lost my phone and I can&#39;t log in to my fa website. Can you help me get access?</td>
</tr>
<tr>
<td>Scoreboard v2</td>
<td>200</td>
<td><a href="
<td>Okay, we admit it. Rails is bad. Can you help us test our new login page written in Flask? It&#39;s running live here. We think its 512x better than the old one. </td>
</tr>
<tr>
<td>Super Degreaser</td>
<td>200</td>
<td><a href="
<td>Cleanup on aisle 1.</td>
</tr>
</table>

Linux

<table>
<tr>
<th>Title</th>
<th>Value</th>
<th>Repository</th>
<th>Description</th>
</tr>
<tr>
<td>Back to the Future</td>
<td>100</td>
<td><a href="
<td>Get in the pipe Marty! We gotta get all the way to Bendigo! We gotta get me keys back!</td>
</tr>
<tr>
<td>It&#39;s all in the past now</td>
<td>100</td>
<td><a href="
<td>There is a flag stored in /flag.txt but only root can read it. Figure out how to get root access to read the flag.</td>
</tr>
<tr>
<td>Set me free</td>
<td>100</td>
<td><a href="
<td>Someone has backdoored my VM! Find the backdoor to get the flag.</td>
</tr>
<tr>
<td>How do I exit vim?</td>
<td>150</td>
<td><a href="
<td>I&#39; vim and can&#39;t exit! Can you help me?</td>
</tr>
</table>

项目信息

开发语言：未知

Star 数：62

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Repo containing links to all CTF Challenges used in the 2018 MITRE CTF. http://mitrecyberacademy.org/展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。