diff --git a/README.md b/README.md index 38c976d..597d197 100644 --- a/README.md +++ b/README.md @@ -1,3 +1,18 @@ -# ctf-chal-ji +# JI EPITA - CTF + +#### Challenge Type : boot to root (box) +#### Difficulty : easy + +---- + +## Writeup + + + + + + + + + -Défi (box) du CTF organisé pour la JI \ No newline at end of file diff --git a/config/supervisord.conf b/config/supervisord.conf new file mode 100644 index 0000000..c036691 --- /dev/null +++ b/config/supervisord.conf @@ -0,0 +1,10 @@ +[supervisord] +nodaemon=true + +[program:sshd] +command=/usr/sbin/sshd -D +autorestart=true + +[program:apache2] +command=/usr/sbin/apache2ctl -D FOREGROUND +autorestart=true diff --git a/docker/Dockerfile b/docker/Dockerfile new file mode 100644 index 0000000..67c8ac7 --- /dev/null +++ b/docker/Dockerfile @@ -0,0 +1,58 @@ +FROM ubuntu:24.04 + +ENV DEBIAN_FRONTEND=noninteractive + +RUN apt update && apt upgrade -y && \ + apt install -y \ + apache2 \ + curl \ + nano \ + vim \ + supervisor \ + openssh-server \ + sudo \ + cowsay \ + && rm -rf /var/lib/apt/lists/* + +# the user players will need to have access as + + +RUN useradd -m -s /bin/bash l33t \ +&& echo "l33t:h4x0r" | chpasswd + +# foothold user with no sudo perms. Only access to the l33t user home directory. + +RUN useradd webmaster + +# apache2 config to change default 80 port to 31337 + +RUN sed -i 's/^Listen 80/Listen 31337/' /etc/apache2/ports.conf + +RUN sed -i 's///' /etc/apache2/sites-available/000-default.conf + +# copy the app + +#COPY ./app/ /var/www/html/ + +RUN mkdir /var/run/sshd + +# (suggestion) +# for the privesc, cowsay allowed to be ran with sudo without password +# https://gtfobins.github.io/gtfobins/cowsay/ + +RUN printf 'l33t ALL=(ALL) NOPASSWD: /usr/games/cowsay, /usr/bin/sudo -l\n' > /etc/sudoers.d/l33t && \ + chmod 0440 /etc/sudoers.d/l33t && \ + visudo -cf /etc/sudoers.d/l33t + +# 22 port -> ssh, 31337 port (suggestion) -> vulnerable webserver players need to find using nmap port scans + +EXPOSE 22 +EXPOSE 31337 + +# config of supervisord to have both apache2 and sshd services running + +COPY config/supervisord.conf /etc/supervisor/conf.d/supervisord.conf + +# start supervisord +CMD ["/usr/bin/supervisord", "-n"] + diff --git a/docker/docker-compose.yml b/docker/docker-compose.yml new file mode 100644 index 0000000..e69de29 diff --git a/docker/entrypoint.sh b/docker/entrypoint.sh new file mode 100644 index 0000000..f682536 --- /dev/null +++ b/docker/entrypoint.sh @@ -0,0 +1,2 @@ +#! /bin/bash + diff --git a/www/index.html b/www/index.html new file mode 100644 index 0000000..8b1652e --- /dev/null +++ b/www/index.html @@ -0,0 +1,24 @@ + + + + + + Tux gallery ! + + + +
+
    +
  1. Tux Gallery logo
    2. +
  2. Upload
    3. +
  3. View
    4. +
+
+
+
+ +
+
+ + + \ No newline at end of file diff --git a/www/static/css/stylesheet.css b/www/static/css/stylesheet.css new file mode 100644 index 0000000..e69de29 diff --git a/www/static/img/logo.jpg b/www/static/img/logo.jpg new file mode 100644 index 0000000..f26fb8a Binary files /dev/null and b/www/static/img/logo.jpg differ