Isolet CLI

isolet-cli is a command line tool for isolet to manage challenges on isolet platform.

Use --help flag to know more about a particular command.

.
├── Dockerfiles
│ ├── chall-image-1
│ │ ├── Dockerfile
│ │ └── docker-files
│ │ └── file.txt
│ └── image-2
│ └── Dockerfile
├── chall.yaml
├── deployment.yaml (optional) # Refer custom deployment
└── resources
└── chall.zip

Note

The chall ls command will help you list challenges in a particular directory. The directory can be the challenge directory or the parent directory of the challenge directories, (DIRECTORY NAMES MUST FOLLOW RFC 1123 i.e directory names must contain letters (a-z), digits (0-9), and hyphens (-)).

Caution

When defining Dockerfile for dynamic challenges make sure to use port 80 for http challenges, 22 for ssh challenges and 6969 for nc challenges.

chall.yaml

chall.yaml file must be of following format

chall_name: "SQL Injection Lab"type: "dynamic"category_name: "Web"prompt: "Find the vulnerability in the login system to retrieve the flag."points: 200flag: "CTF{dynamic_sql_injection_flag}"attempts: 20# optionalhints: # optional
- hint: "Start by trying simple ' OR '1'='1' payloads"visible: false
- hint: "Use tools like sqlmap if stuck"cost: 300author: "Bob"visible: false # optionaltags:
- "Web"
- "Beginner"links: # optional
- "https://wiki.com/sql_injection"files: # optional
- "file.txt"# Must match the file name in resources directory# Only for dynamic challengesdeployment_type: sshdeployment_port: 2345# Not required if deployment type is http or challenge type is on-demandcpu: 15m# optionalmem: 32Mi # optional

Deployment

The deploy command is used to deploy dynamic challenge and expose it using a load-balancer and traefik. The usage is the exact same as load command. Similarly one can take down a deployment using undeploy command

Important

Try to work on a challenge on a single device, since syncing might cause issues, make sure that the cli tool is not used to edit challenges after the event is started, all the challenges must be managed using admin panel.

Custom deployment

Typically a dynamic/on-demand challenge must use a single docker container which will be run and specified port will be exposed, but there might be a case where author wants to use multiple containers.

One can use deployment.yaml to define their deployment and run chall load

Following is a template for deployment.yaml:

# DO NOT CHANGE ANYTHING EXCEPT WHEREVER COMMENTS ARE PRESENT AND ADD CONTAINERSapiVersion: apps/v1kind: Deploymentmetadata:
name: {{.Subd}}namespace: {{.Namespace}}labels:
app.kubernetes.io/component: deploymentapp.kubernetes.io/name: {{.Subd}}app.kubernetes.io/part-of: challengesspec:
replicas: 1selector:
matchLabels:
app.kubernetes.io/component: deploymentapp.kubernetes.io/name: {{.Subd}}app.kubernetes.io/part-of: challengestemplate:
metadata:
labels:
app.kubernetes.io/component: deploymentapp.kubernetes.io/name: {{.Subd}}app.kubernetes.io/part-of: challengesspec:
containers:
- image: {{.Registry}}/<image-dir-name> # put the name of directory your required image's Dockerfile is inname: container-1ports:
- containerPort: 80# 22 for ssh, 6969 for ncresources:
limits:
cpu: 300mmemory: 256Mirequests:
cpu: 100mmemory: 64MiimagePullSecrets:
- name: challenge-registry-secret
---
apiVersion: v1kind: Servicemetadata:
annotations:
traefik.ingress.kubernetes.io/router.entrypoints: {{.Subd}}name: {{.Subd}}-svcnamespace: {{.Namespace}}labels:
app.kubernetes.io/component: serviceapp.kubernetes.io/name: {{.Subd}}app.kubernetes.io/part-of: challengesspec:
ports:
- port: 8008protocol: TCPtargetPort: 80# same as containerPortselector:
app.kubernetes.io/name: {{.Subd}}type: ClusterIP
---
apiVersion: traefik.io/v1alpha1kind: IngressRoutemetadata:
name: {{.Subd}}-ingressnamespace: {{.Namespace}}labels:
app.kubernetes.io/component: ingressapp.kubernetes.io/name: {{.Subd}}app.kubernetes.io/part-of: challengesspec:
entryPoints:
- {{.Subd}} # only for nc/ssh challs
- web # only for http challs
- websecure # only for http challsroutes:
- kind: Rulematch: Host(`subdomain.domain.tld`) # use HostSNI(`*`) for nc/ssh challsservices:
- name: {{.Subd}}-svcport: 8008tls: # only for http challssecretName: challenge-certs

Installation

./configure --prefix=<install dir>
make install
# uninstall isolet
make uninstall