diff --git a/doc/2009-10-NMT/cat.svg b/doc/2009-10-NMT/cat.svg new file mode 100644 index 0000000..cf7d178 --- /dev/null +++ b/doc/2009-10-NMT/cat.svg @@ -0,0 +1,148 @@ + + + + + + + + + + + + + + + + image/svg+xml + + + + + + Found Cat + + + Cute Brown, Black, and White cat found Thursday afternoon at the corner of Olive and Sunset. No tags. We think it's a girl. Loves fish, cheeseburgers, fingers. She's kind of cranky and wants to go home!Call Jody at 575-493-4096 ×113 + + + + diff --git a/doc/2009-10-NMT/pacman.svg b/doc/2009-10-NMT/pacman.svg new file mode 100644 index 0000000..4ad4ad9 --- /dev/null +++ b/doc/2009-10-NMT/pacman.svg @@ -0,0 +1,377 @@ + + + + + + + + + + + image/svg+xml + + + + + + + + + + $ md5sum <<. -= 2009 Capture The Flag Contest =- A computer security competition Presented by LANL, SNL, & NMT CS dept. Fri & Sat, October 16 & 17 Register your team by Oct 13!http://dirtbags.net/ctf. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/doc/2009-10-NMT/ship.svg b/doc/2009-10-NMT/ship.svg new file mode 100644 index 0000000..db864ec --- /dev/null +++ b/doc/2009-10-NMT/ship.svg @@ -0,0 +1,171 @@ + + + + + + + image/svg+xml + + + + + + + + + + + + + + + ortva-onfr64 644 xrl JJ91W3WyVUqyoTjto24trJ91pvO3LKxtBvxX==== + Oct 16 & 17Register teams by Oct 13http://dirtbags.net/ctf + A computer security competitionPresented by LANL, SNL, & NMT CS dept. + + + + diff --git a/doc/2010-10-NMT/chase.pdf b/doc/2010-10-NMT/chase.pdf new file mode 100644 index 0000000..e0e6a47 Binary files /dev/null and b/doc/2010-10-NMT/chase.pdf differ diff --git a/doc/2010-10-NMT/chase.svg b/doc/2010-10-NMT/chase.svg new file mode 100644 index 0000000..b2e7ab5 --- /dev/null +++ b/doc/2010-10-NMT/chase.svg @@ -0,0 +1,339 @@ + + + + + + + + + + + image/svg+xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + 2010 Capture The FlagA computer security competitionPresented by LANL & NMT CS Dept.Fri & Sat, October 29-30Register by October 12http://dirtbags.net/ctf/ + 5e5e5e205468657265277320616e6f74686572207374657020696e766f6c766564205e5e5e + + + + + + diff --git a/doc/2010-10-NMT/pacman2.pdf b/doc/2010-10-NMT/pacman2.pdf new file mode 100644 index 0000000..be954ea Binary files /dev/null and b/doc/2010-10-NMT/pacman2.pdf differ diff --git a/doc/2010-10-NMT/pacman2.svg b/doc/2010-10-NMT/pacman2.svg new file mode 100644 index 0000000..327c786 --- /dev/null +++ b/doc/2010-10-NMT/pacman2.svg @@ -0,0 +1,728 @@ + + + + + + + + + + + image/svg+xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + 5e5e5e204272696e6720796f757220616e7377657220666f7220706f696e747320205e5e5e + + + + 2010 Capture The FlagA computer security competitionPresented by LANL & NMT CS Dept.Fri & Sat, October 29-30Register by October 12http://dirtbags.net/ctf/ + + diff --git a/doc/2010-10-NMT/poster-text.txt b/doc/2010-10-NMT/poster-text.txt new file mode 100644 index 0000000..a9cec50 --- /dev/null +++ b/doc/2010-10-NMT/poster-text.txt @@ -0,0 +1,7 @@ +2010 Capture The Flag +A computer security competition +Presented by LANL & NMT CS Dept. +Fri & Sat, October 20-30 + +http://dirtbags.net/ctf/ + diff --git a/doc/2010-10-NMT/ship.pdf b/doc/2010-10-NMT/ship.pdf new file mode 100644 index 0000000..a583b23 Binary files /dev/null and b/doc/2010-10-NMT/ship.pdf differ diff --git a/doc/2010-10-NMT/ship.svg b/doc/2010-10-NMT/ship.svg new file mode 100644 index 0000000..297bd7d --- /dev/null +++ b/doc/2010-10-NMT/ship.svg @@ -0,0 +1,228 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + image/svg+xml + + + + + + + + + + + + + + 5e5e5e5e363a2c3c2277653c60793d663c6e7c2964242e713327716126222236645e5e5e5e + + + + 2010 Capture The FlagA computer security competitionPresented by LANL & NMT CS Dept.Fri & Sat, October 29-30Register by October 12http://dirtbags.net/ctf/ + + diff --git a/doc/ideas.txt b/doc/ideas.txt new file mode 100644 index 0000000..debae61 --- /dev/null +++ b/doc/ideas.txt @@ -0,0 +1,11 @@ +Ideas for puzzles +================= +* Hide something in a .docx zip file + + +Network treasure hunt +--------------------- +* DHCP option +* Single TCP RST with token in payload +* Multiple TCP RST with different payloads +* diff --git a/doc/summary.txt b/doc/summary.txt new file mode 100644 index 0000000..bfed796 --- /dev/null +++ b/doc/summary.txt @@ -0,0 +1,76 @@ +LANL Capture The Flag +===================== + +The LANL CTF training and exercise is designed to train novice to expert +analysts in new techniques and tools. Course material is in a tutorial +format, which is bundled into the exercise. + +The class portion proceeds as a lecture style, although participants are +encouraged to work at their own pace, soliciting assistance from +instructors during the lab sections of the lecture. A Capture-The-Flag +style exercise follows the training as a mechanism to reinforce concepts +the participants have just learned, as well as introduce new concepts, +and to help participants learn how to deal with an actual security +incident. In the exercise portion, participants form into teams which +compete against each other to gain points in a broad spectrum of +categories. + +Event categories and training topics are easily customized to better +meet each site's requirements for training. + + +Key Features +------------ + +Portable: Hardware for up to 80 participants fits into a single +suitcase, and the exercise portion can be conducted by a single +organizer for up to 100 participants. + +Flexible: Exercise or Training can be run standalone, and can last +anywhere from 2 hours to 5 days. + +Lasting: Exercise portion reinforces concepts learned during training. + +Modular: Categories can be cherry-picked from an ever-growing list, +creating a custom-tailored training and exercise. + +Extensible: New modules can be added quickly. + + +Categories currently available: (September 2010) +------------------------------------------------ + +* Base arithmetic +* Introductory computer programming / logical thinking +* Host forensics +* Malware reverse-engineering +* Network reverse-engineering + * Packet capture and analysis tools + * Reconstruction of session data + * Protocol reverse-engineering + * Custom tool development skills +* Linux systems programming + * Using strace, ltrace, gdb + * Understanding race conditions + * Programming securely +* Web application development + * Cross-site scripting attacks + * Input validation + * SQL Injection + * Security vs. obscurity +* Cryptography and codebreaking +* Steganography detection and extraction +* Social engineering +* Binary file formats +* General puzzle-solving skills + + +Categories in development +------------------------- + +* Securing SCADA devices +* Network traffic monitoring +* Log file analysis +* HTML / Javascript reverse-engineering +* Your request goes here! + diff --git a/src/Makefile b/src/Makefile index d31695c..f7a14d6 100644 --- a/src/Makefile +++ b/src/Makefile @@ -1,6 +1,11 @@ -all: in.tokend register.cgi +TARGETS = in.tokend register.cgi claim.cgi + +all: $(TARGETS) in.tokend: in.tokend.o xxtea.o register.cgi: register.cgi.o cgi.o +claim.cgi: claim.cgi.o cgi.o pointscli.o +clean: + rm -f $(TARGETS) *.o \ No newline at end of file diff --git a/src/cgi.c b/src/cgi.c index eb08a3a..8169e3d 100644 --- a/src/cgi.c +++ b/src/cgi.c @@ -1,5 +1,6 @@ #include #include +#include #include "cgi.h" static size_t inlen = 0; @@ -62,7 +63,7 @@ read_hex() outside of boundaries, we can use the same function for both. */ size_t -read_item(char *str, size_t maxlen) +cgi_item(char *str, size_t maxlen) { int c; size_t pos = 0; @@ -88,3 +89,40 @@ read_item(char *str, size_t maxlen) } } } + +void +cgi_page(char *title, char *fmt, ...) +{ + FILE *p; + va_list ap; + + printf("Content-type: text/html\r\n" + "\r\n"); + fflush(stdout); + p = popen("./template", "w"); + if (NULL == p) { + printf("

%s

\n", title); + p = stdout; + } else { + fprintf(p, "Title: %s\n", title); + } + va_start(ap, fmt); + vfprintf(p, fmt, ap); + va_end(ap); + fclose(p); + exit(0); +} + +void +cgi_error(char *fmt, ...) +{ + va_list ap; + + printf("500 Internal Error\r\n" + "Content-type: text/plain\r\n" + "\r\n"); + va_start(ap, fmt); + vprintf(fmt, ap); + va_end(ap); + exit(0); +} diff --git a/src/cgi.h b/src/cgi.h index 6f68907..6be7099 100644 --- a/src/cgi.h +++ b/src/cgi.h @@ -4,6 +4,8 @@ #include int cgi_init(); -size_t read_item(char *str, size_t maxlen); +size_t cgi_item(char *str, size_t maxlen); +void cgi_page(char *title, char *fmt, ...); +void cgi_error(char *fmt, ...); #endif diff --git a/src/in.tokend.c b/src/in.tokend.c index c0353ec..68511f4 100644 --- a/src/in.tokend.c +++ b/src/in.tokend.c @@ -127,10 +127,9 @@ main(int argc, char *argv[]) } bubblebabble(digest, crap, itokenlen); - /* Append digest to service name. I use . as a separator because it - won't be URL encoded. */ + /* Append digest to service name. */ tokenlen = (size_t)snprintf(token, sizeof(token), - "%s.%s", + "%s:%s", service, digest); } @@ -138,7 +137,6 @@ main(int argc, char *argv[]) { int fd; int ret; - struct flock lock; do { fd = open(tokenlog, O_WRONLY | O_CREAT, 0644); diff --git a/src/register.cgi.c b/src/register.cgi.c index d87cba3..1831370 100644 --- a/src/register.cgi.c +++ b/src/register.cgi.c @@ -5,7 +5,6 @@ #include #include #include -#include #include #include "cgi.h" @@ -23,27 +22,6 @@ djbhash(char const *buf, size_t buflen) return h; } -void -page(char *title, char *fmt, ...) -{ - FILE *p; - va_list ap; - - printf("Content-type: text/html\r\n\r\n"); - fflush(stdout); - p = popen("./template", "w"); - if (NULL == p) { - printf("

%s

\n", title); - p = stdout; - } else { - fprintf(p, "Title: %s\n", title); - } - va_start(ap, fmt); - vfprintf(p, fmt, ap); - va_end(ap); - fclose(p); -} - int main(int argc, char *argv[]) { @@ -60,10 +38,10 @@ main(int argc, char *argv[]) size_t len; char key[20]; - len = read_item(key, sizeof(key)); + len = cgi_item(key, sizeof(key)); if (0 == len) break; if ((1 == len) && ('t' == key[0])) { - teamlen = read_item(team, sizeof(team)); + teamlen = cgi_item(team, sizeof(team)); } } @@ -80,34 +58,29 @@ main(int argc, char *argv[]) "%s/%s", BASE_PATH, hash); if (sizeof(filename) == ret) { - printf(("500 Server screwed up\n" - "Content-type: text/plain\n" - "\n" - "The full path to the team hash file is too long.\n")); - return 0; + cgi_error("The full path to the team hash file is too long."); } fd = open(filename, 0444, O_WRONLY | O_CREAT | O_EXCL); if (-1 == fd) { - page("Bad team name", - ("

Either that team name is already in use, or you " - "found a hash collision (way to go). " - "In any case, you're going to " - "have to pick something else.

" - "

If you're just trying to find your team hash again," - "it's %s.

"), - hash); - return 0; + cgi_page("Bad team name", + ("

Either that team name is already in use, or you " + "found a hash collision (way to go). " + "In any case, you're going to " + "have to pick something else.

" + "

If you're just trying to find your team hash again," + "it's %s.

"), + hash); } write(fd, team, teamlen); close(fd); } /* Let them know what their hash is. */ - page("Team registered", - ("

Team hash: %s

" - "

Save your team hash somewhere!. You will need it " - "to claim points.

"), - hash); + cgi_page("Team registered", + ("

Team hash: %s

" + "

Save your team hash somewhere!. You will need it " + "to claim points.

"), + hash); return 0; }