1. Project CTF Yeganeh Safaei Arizona State University
CSE 545 – Software Security
Spring 2017
Yeganeh Safaei
Arizona State University

2. Capture The Flag CTF is an attack-defense hacking competition.
Each team is competing against all the other teams.
All teams have the same virtual machine with a set of vulnerable services.
Each team is responsible for keeping their services running at all time.

3. CTF Architecture … … Game Network Admin Network Vuln VM Vuln VM
Router VM
Admin Network
Scriptbot/Gamebot
Score
Board
Team
Interface

4. Flag Each service is associated with a tuple (flagid ,token, flag)
Token
4vCANiiRVvge2UGMA
Flag
FLG798aHS0P2eQJV

5. sample_py service exploit

6. Goal
The goal of each team is to find the vulnerability in their local copy of the service and patch their service.
Exploiting all the other teams’ services to get flags.
Submitting the acquired flag to the team interface.
Running the exploits for every game tick.

7. https://ictf.cs.ucsb.edu/
Where to begin
Login to ictf framework with your team information
$ pip install ictf
Then, from within a python shell, such as iPython, you can run:
>>> from ictf import iCTF
>>> i = iCTF(“
>>> t =
To access your team’s VM, use the SSH keys, IP address, and port provided here:
>>> key_info = t.get_ssh_keys()
The ‘ctf_key’ is a key with access to the ‘ctf’ user, and the ‘root_key’ gives access to the ‘root’ user. ‘Ip’ and ‘port’ refer to the SSH server on your team VM.
You’ll want to save those keys to files:
>>> with open(“ctf_key”, ‘wb’) as f:
…        f.write(key_info[‘ctf_key’])
>>> with open(“root_key”, ‘wb’) as f:
…        f.write(key_info[‘root_key’])
Your hostname and port are provided as well; continuing the above example:
>>> print key_info[‘ip’]
>>> print key_info[‘port’]

8. Access Your VM
You can then access the VM:
$ ssh -i </path/to/ctf_key> -p <port number>
Once logged in, you can run:
>>> t.get_service_list()
You can use the iCTF client to get a list of teams’ IP addresses, and the flag ID for the flag you must steal:
>>> targets = t.get_targets(<service ID>)
Submit flags:
>>> t.submit_flag([“FLGxxxxxxx”,”FLGyyyyyyyyy”, ‘FLGzzzzzzzzz])

9. Suggestions Lots of tools to automate the exploits pwntools,…
Use a monitoring tools to check the incoming/outgoing traffic
Tcpdump, wireshark,…
Have your scripts and project ready for the final.