022024

Syrinx

A capture-the-flag competition disguised as a video game.

Pixel-art 2D game world of the Thapar University campus with shopfronts and a player character — The playable campus - walk into a building, get a challenge.

Overview

Most CTF platforms are a scoreboard bolted onto a folder of challenge files. Syrinx is a 2D game: a pixel-art recreation of the Thapar University campus, built in Godot, where players walk around and enter buildings to pull live challenges. 300+ participants played it.

Behind the game is a Go web server with WebRTC peer-to-peer connections between players, so movement and state stay in sync without a relay in the middle. Every one of the 28 challenges runs in its own Docker container - so a player who escalates to root owns their sandbox, not the platform.

I wrote the challenges around techniques I'd actually used: JWT forgery against a Node.js backend, cronjob privilege escalation via wildcard injection, SSH key-based escalation through GTFOBins, stack canaries, race conditions and reverse engineering.

Highlights

012D Godot game world mapped to the real campus - the interface is the CTF
02Go web server with WebRTC peer-to-peer sync for 300+ concurrent players
0328 original challenges: JWT forgery, cronjob wildcard injection, GTFOBins privilege escalation, stack canaries, race conditions, reverse engineering
04Per-challenge Docker isolation so exploits stay contained by design

Stack

Golang
Godot
Docker
Linux
WebRTC

Inside

Dockerfile and terminal showing a crontab-based privilege escalation challenge — Cronjob privilege escalation - Dockerfile and the target's crontab.

Terminal showing SSH into an Ubuntu container and checking sudo permissions — SSH escalation challenge: get in with a key, find what runs as root.

Discussion

Loading…