Remaster Linux Live CD images for the purpose of creating ready to use security wargames with pre-installed vulnerabilities to exploit.
You will need the following in order to build the Live CD using the scripts in this project:
- Linux, with root access using
sudo
git
make
,gcc
-- for building vulnerable programspwgen
-- for generating random passwordsrsync
genisoimage
-- formkisofs
advancecomp
-- foradvdef
squashfs-tools
-- forunsquashfs
curl
-- for downloading packages and other files
The base Live CD is 32-bit, and therefore the C programs
must be built 32-bit too. In order to do that you need
to install 32-bit development libraries. In Debian for
example the package is called libc6-dev-i386
.
You have different options to build the CD:
- Basic build: using a single script to build everything
- 3-step build: 3 steps to give you a chance to customize
- Expert build: if you want to understand everything
Choose whichever method is most suitable for you.
To fetch all the necessary files including the 8MB TinyCore base base image, the hacking contest data and all the required TinyCore packages and remaster the CD:
./scripts/rebuild.sh
Note: some of the steps need to run sudo
, so you will be prompted
for your password one or more times.
The idea of this build method is to create the basic CD data but stop before rebuilding the image so that you can customize it first.
-
Build the basic CD data:
./scripts/build.sh
Note: some of the steps need to run
sudo
, so you will be prompted for your password one or more times. -
Customize the contents in the
extract
directory. This step is completely up to you, depending on what you want to customize. You might want to install some custom packages, for example keymaps for non US keyboards:sudo ./scripts/install-tcz.sh kmaps
-
Create the final ISO:
sudo ./scripts/pack-iso.sh
The challenges are based on the original online contest organized by Stripe: https://stripe.com/blog/capture-the-flag
The easiest way to use is with a software like VirtualBox, for example by following these steps:
- Create a new virtual machine: Linux, 2.6 kernel
- Memory: 256MB
- Hard disk: no need for a disk
- CD: configure the virtual machine to use the ISO image of the Live CD as a CD drive
- Start the Virtual Machine
At the boot prompt, you may want to enter fr
, jp
or hu
to use French, Japanese or Hungarian keymap, respectively.
All the regular boot options of TinyCore should work as well.
After the system has started, you will be presented the instructions to pass the first challenge.
To install additional software in the running system,
switch to the tc
user with the su - tc
command, and
use the tce
program -- TinyCore's package manager.
It is not complicated, just follow the instructions.
The solutions are intentionally omitted from this project. You may find the solutions to the original Stripe challenges, but don't be surprised if they don't work on this Live CD out of the box. That is intentional too ;-)
Please keep your own solutions private.
If you want to get root access in the live system, you can
either do su - tc
to become the admin user, or boot the
system with the mc superuser
standard TinyCore boot option.
- https://stripe.com/blog/capture-the-flag
- https://stripe.com/blog/capture-the-flag-20
- http://io.smashthestack.org:84/
- http://patorjk.com/software/taag/#p=testall&f=Graffiti&t=CTF
-
Re-implement /levels/level02/level02.py without flask (save 3MB)
-
Implement the second Capture The Flag contest of Stripe
-
maybe: Generalize the scripts to use with other than TinyCore