-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathapp.py
executable file
·175 lines (159 loc) · 8.5 KB
/
app.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
#!/usr/bin/env python3
# *-* coding: utf-8 *-*
# *-* author: @TheFlash2k
import os
import sys
import time
import uvicorn
import requests
from pprint import pprint
from fastapi import FastAPI
from threading import Thread
from dotenv import load_dotenv
from fastapi.responses import PlainTextResponse
from validator.ctfd import CTFd
from validator.db import Database
from validator.logger import logger
from validator.discord import Discord
from validator.manager import Manager
errs = {
127 : 'Challenge ID does not exist',
128 : 'Team ID does not exist',
129 : 'Challenge does not have a regex-based flag'
}
app = FastAPI()
@app.get("/flag", response_class=PlainTextResponse)
async def flag(team_id: str, chal_id: str):
gen = mgr.generate_flag(chal_id, team_id)
if type(gen) == int:
return errs[gen]
elif not gen:
return "An error occurred when generating the flag. Please contact the administrator."
return gen
@app.get("/check")
def updates():
logger.info("Running duplicate check...")
challs = [i['challenge_id'] for i in ctfd.get_regex_flags()]
logger.info(f"Found {len(challs)} challenges with REGEX based flags.")
for chal in challs:
chal_name = ctfd.get_challenge_name(chal)
logger.info(f"Checking challenge \"{chal_name}\"...")
submitted = ctfd.get_submitted_flags(chal)
msg = {'ban': [], 'msg' : [] }
for submitted in submitted:
vals = list(submitted.values())[0]
flag = db.get(list(submitted.keys())[0])
if not flag:
logger.error(f"Flag {list(submitted.keys())[0]} does not exist in local db")
team_id = vals[0]['team']['id']
name = ctfd.get_team_name(team_id)
if ctfd.ban_team(team_id):
logger.info(f"Successfully banned {name}")
else:
logger.error(f"An error occurred when banning {name}")
msg['ban'].append(f"**{name}** has been ***BANNED*** for submitting a flag that wasn't even generated for challenge ***{chal_name}***.")
submission_id = vals[0]['submission_id']
logger.info(f"Deleting submission {submission_id}...")
if ctfd.delete_submission(submission_id):
logger.info(f"Successfully deleted submission {submission_id}")
else:
logger.error(f"An error occurred when deleting submission {submission_id}")
msg['msg'].append(f"Submission {submission_id} has been deleted.")
continue
if len(vals) != 1:
logger.error(f"Multiple submission for flag {list(submitted.keys())[0]} found!")
flag = db.get(list(submitted.keys())[0])
if flag:
generated_by = flag[0][2]
generated_by_name = ctfd.get_team_name(generated_by)
logger.error(f"Actual flag was generated by: {generated_by}")
submission_ids = [i['submission_id'] for i in vals]
team_ids = [i['team']['id'] for i in vals]
if generated_by not in team_ids:
logger.error(f"{generated_by} did not submit the flag but it was generated by them. Banning...")
if ctfd.ban_team(generated_by):
logger.info(f"Successfully banned team {generated_by}")
else:
logger.error(f"An error occurred when banning team {generated_by}")
msg['ban'].append(f"**{generated_by_name}** has been ***BANNED*** for sharing flag of challenge ***{chal_name}***.")
other_teams = [i for i in team_ids if i != generated_by]
for team in other_teams:
name = ctfd.get_team_name(team)
logger.error(f"{name} submitted the flag but it was generated by {generated_by_name}. Banning...")
if ctfd.ban_team(team):
logger.info(f"Successfully banned team {name}")
else:
logger.error(f"An error occurred when banning team {name}")
if name != generated_by_name:
msg['ban'].append(f"**{name}** has been ***BANNED*** for submitting **{generated_by_name}**'s flag of challenge ***{chal_name}***.")
# Remove the submission:
for submission_id in submission_ids:
logger.info(f"Deleting submission {submission_id}...")
if ctfd.delete_submission(submission_id):
logger.info(f"Successfully deleted submission {submission_id}")
else:
logger.error(f"An error occurred when deleting submission {submission_id}")
msg['msg'].append(f"Submission {submission_id} has been deleted.")
else:
team_id = vals[0]['team']['id']
flag = list(submitted.keys())[0]
db_flag = db.get(flag)
if db_flag:
generated_by = db_flag[0][2]
generated_by_name = ctfd.get_team_name(generated_by)
if int(generated_by) != int(team_id):
name = ctfd.get_team_name(team_id)
logger.error(f"Flag {flag} was not generated by {name} but by {generated_by_name}")
teams = [team_id, generated_by]
for team in teams:
if ctfd.ban_team(team):
logger.info(f"Successfully banned {name}")
else:
logger.error(f"An error occurred when banning {name}")
msg['ban'].append(f"**{generated_by_name}** has been ***BANNED*** for sharing flag of challenge ***{chal_name}***.")
if name != generated_by_name:
msg['ban'].append(f"**{name}** has been ***BANNED*** for submitting **{generated_by_name}**'s flag of challenge ***{chal_name}***.")
msg['msg'].append(f"Team **__{generated_by_name}__**'s flag of challenge **__{chal_name}__** was also used by **__{name}__**, both teams have been banned.")
# Get submission id:
submission_id = vals[0]['submission_id']
logger.info(f"Deleting submission {submission_id}...")
if ctfd.delete_submission(submission_id):
logger.info(f"Successfully deleted submission {submission_id}")
else:
logger.error(f"An error occurred when deleting submission {submission_id}")
logger.info(f"Finished checking challenge {chal}")
logger.info("Finished duplicate check.")
for k,v in msg.items():
msg[k] = list(set(v))
if msg['ban'] != []:
_snd = "\n".join([f"- {i}" for i in msg['ban']])
ctfd.send_notification("Flag Sharing Detected", _snd + "\n\nPowered by [`TheFlash2k`](https://github.com/TheFlash2k/CTFd-Flag-Validator/)'s Flag Sharing Detector.")
Thread(target=Discord.post, args=(f"### **__Flag Sharing Detected__**\n{''.join([f'{i}' + chr(10) for i in msg['msg']])}",), daemon=True).start()
return msg
def run_updates():
while True:
logger.info("Initiating update check after " + str(ver_delay) + " minutes")
time.sleep(ver_delay * 60)
logger.info("Running updates")
try:
r = requests.get(f"http://localhost:{api_port}/check")
logger.info("++ Respsonse from update: " + r.text)
except Exception as E:
logger.error(f"An error occurred when running updates: {E}")
if __name__ == "__main__":
load_dotenv()
api_host = os.getenv("API_HOST", "0.0.0.0")
try:
api_port = int(os.getenv("API_PORT", 9512))
ver_delay = int(os.getenv("VERIFICATION_DELAY", 1))
except Exception as E:
logger.error(f"An error occurred when parsing API_PORT or VERIFICATION_DELAY. Ensure that they're numbers..\nError: {E}")
sys.exit(1)
db_name = os.getenv("DB_NAME", "flags.db")
ctfd = CTFd()
db = Database(db_name=db_name)
mgr = Manager(ctfd=ctfd, db=db)
logger.info("Starting flag validator")
th = Thread(target=run_updates, daemon=True)
th.start()
uvicorn.run(app, host=api_host, port=api_port)