Elvis Wiki - User contributions [en]

Lightbulb Worm

2024-01-07T19:40:37Z

MArastu:

== What is a Lightbulb Worm? ==

The Lightbulb Worm is a construct that results from the research and attacks done by Colin O'Flynn, Eyal Ronen, Adi Shamir, and Achi-Or Weingarten.
They provide the ingredients of the first worm that affects smart lighting systems.

The worm has the power to spread only through physical proximity and would also be able to destroy lightbulbs permanently. It only takes one infected lightbulb to be installed, and the worm can spread - through its ZigBee wireless connectivity - directly to the physical neighbors of this lamp. These newly infected lamps would again infect all their neighbor lamps.
That leads to a massive chain reaction that spreads in an epidemic fashion and attacks whole cities. The critical mass to infect all lightbulbs within a urban area like Paris was estimated to around 15.000 lightbulbs. <ref name="ronenarticle"/>

== Philips Hue and Zigbee Light Link ==

The research and experiments of constructing the lightbulb worm have been done by using Philips Hue smart lighting systems and exploiting the implementation of their inbuilt ZigBee Light Link Protocol and firmware update mechanisms.

The Philips Hue smart lamp system works as follows:
The lightbulbs are connected to a bridge device which creates a network the lightbulbs can join. The bridge controls all the lamps and also contains an IP link. Via the Router, it is connected to the Internet through which you can control your system with the Philips Hue Lightning App. <ref name="ronenpaper"/>

[[File:PhilipsHue.jpg|thumb|none|600px|Philips Hue and ZLL Architecture <ref name="ronenpaper"/>]]

Philips Hue lamps communicate with their controllers through the Zigbee protocol and use the ZigBee Light Link protocol. <ref name="ronenpaper"/>

The ZigBee Light Link protocol is standardized by the ZigBee Alliance and is a very popular standard in the lighting industry because it provides network flexibility and scalability.
It also offers high interoperability between products from different vendors.
To enable high interoperability, the Touchlink Commissioning protocol is used. It makes the installation of the light bulbs very easy and intuitive. <ref name="wan13/>

The Touchlink commissioning protocol creates PANs (Personal Area Networks) and directs every new device placed in proximity to a specific bridge to join the PAN.
The new device receives an encryption key that is used to encrypt and authenticate messages within the PAN.
This encryption key is unique for every PAN and encrypted by a “Master key."

This “Master key" is a secret key, but it is used and stored on every ZLL certifed
product. In the case for Philipps Hue products the same AES-CCM key was used on every device. This resulted in the fact that the team was able to send faulty OTA updates to each device since using the same key on each device does not offer any protection if this key is known to the attacker.

The Touchlink protocol provides two message types with which the state of a lightbulb can be changed:

1. Reset to factory new request: If the target device receives this message
with a valid Transaction ID, it is reset to a factory new state, and all Network information and keys are deleted.

2. Join (or start) network request: With this message, the device is instructed to join
the PAN. <ref name="ronenpaper"/>

== Security Features of Philips Hue ==
'''Encryption Mechanisms''' – see [[#Philips Hue and Zigbee Light Link|Philips Hue and ZigBee Light Link]]

'''Proximity Check''' - prevents a takeover of lightbulbs in the nearest neighborhood.
:The proximity check ensures that the initiator is physically very close to the target.
:It must be passed successfully to connect lamps to the bridge.
:Without the proximity check, any initiator that owns the ZLL master key could instruct lightbulbs to reset to a factory new state or join a new PAN. <ref name="ronenpaper"/>

== Ingredients of the Lightbulb Worm ==

;Persistence of code execution on the lamps to take over the control of the lamps
:The researchers achieved the Persistence of Code Execution by exploiting the (OTA - Over the Air) update mechanisms of the Philips Hue. And they did that by reverse engineering.
:The reverse engineering was possible because the system was vulnerable to side channel analysis and also some parts of the encryption was already known.

:So the team managed to upload selfwritten firmware on the lamps instead of the original firmware.<ref name="ronenpaper"/>

;Lateral movement - the worm should spread automatically through proximity
:The lateral movement had been achieved by passing the proximity check.
:That was possible by exploiting the software implementation of the Touchlink protocol and a feature of the ZLL protocol.
:ZLL devices should also be able to join other ZigBee networks, where no ZLL is used. When no ZLL is used, there is also no proximity check.

:So they just had to set the lightbulbs to a Factory New state and make the lightbulbs actively search for ZigBee networks and are open to connection.
:Setting them to a Factory New state was possible due to a software bug which could have been found with negative testing during the Zigbee certification process. <ref name="ronenpaper"/>

== Security Issues of the Philips Hue System ==

* Use of a '''single symmetric encryption key''' shared across many devices to protect the firmware update process

* The attacks were also possible because the hardware is '''vulnerable to side-channel analysis'''

* And also, the '''bugs and errors in the implementation of protocols''' (designed to prevent long-range take-over attacks) <ref name="ronenpaper"/>

== Estimated Damage ==

To estimate the actual damage of such an attack, the researchers calculated how many smart lamps would have to be installed to launch the attack.

Result: Paris, the critical mass would be around 15,000 lamps (installed within a distance of about 100 meters).
That is not an unrealistic amount of lamps concerning the popularity of Philips Hue.
So the researchers assumed that cities might be already vulnerable to such attacks. <ref name="ronenpaper"/>

This attack is even more remarkable because there is no internet communication used.
The worm only spreads through physical proximity and is independent of established networking structures – so once created, the worm is probably impossible to stop.

System administrators usually try to stop such an attack by isolating subnetworks from each other, which in this case would not be possible because only ZigBee communication is used, which is not monitored or protected.

Also, locating the source of the attack and also detecting the attack itself would be very difficult. <ref name="ronenpaper"/>

== Possible Attacks ==

;Bricking Attacks
:Unlike usual DoS irreversible, all devices would have to be replaced
;Wireless Network Jamming
:ZigBee runs over the IEEE 802.15.4 standard, which uses the 2.4 GHz, license-free band (continuous wave signal from 'test mode' could overlap other channels)
;Data infiltration and exfiltration
;Affect peoples health
:The light can be programmed in such a blinking rate which causes epileptic seizures
:The LEDs can also be driven at frequencies that are creating discomfort in humans <ref name="ronenpaper"/>

== Countermeasures ==

* Unique keys per lightbulb

* Asymetric cryptography for software verification

* Reducing the amount of damage a leaked key might be able to cause

* Negative testing to avoid implementation bugs <ref name="ronenpaper"/>

== Zigbee Protocol Overview ==
* ZigBee is a low-power, low-data-rate wireless communication protocol.
* Used in smart homes, industrial automation, and sensor networks.
* Operates in 2.4 GHz frequency band with mesh network communication.

== Zigbee Architecture ==
* Architecture includes Application, Application Interface, Security, Network, Medium Access Control, and Physical Layer.

== Zigbee Addressing and Frames ==
* Uses short (16-bit) and long (64-bit) addresses for device identification.
* Packet-based communication with data frames, acknowledgment frames, and command frames.

== Zigbee Security and Sniffing ==
* Features encryption and authentication for secure device communication.
* Tools like Wireshark and nRF52840 dongle mentioned for Zigbee sniffing.

=== Initial Steps for Experimentation ===
* Details on using nRF Connect for Desktop, firmware installation, and programming the nRF52840 Dongle.
* Installation of nRF Sniffer capture plugin in Wireshark discussed.
* [https://www.nordicsemi.com/Products/Development-hardware/nrf52840-dongle nRF52840 Dongle - Nordic Semiconductor]
* [https://github.com/NordicSemiconductor/nRF-Sniffer-for-802.15.4 nRF Sniffer for 802.15.4 - GitHub Repository]
* [https://infocenter.nordicsemi.com/index.jsp?topic=%2Fug_sniffer_802154%2FUG%2Fsniffer_802154%2Fintro_802154.html nRF Sniffer for 802.15.4 Introduction - Nordic Semiconductor Infocenter]

== References ==
<references>
<ref name="ronenarticle">Eyal Ronen, Colin O'Flynn, Adi Shamir, and Achi Or Weingarten. IoT Goes Nuclear: Creating a ZigBee Chain Reaction. In Proceedings – IEEE Symposium on Security and Privacy, 2017 </ref>

<ref name="wan13"> Jianfeng Wang. Zigbee light link and its applicationss. IEEE Wireless Communications, 2013 </ref>

<ref name="ronenpaper"> Eyal Ronen, Adi Shamir, Achi Or Weingarten, and Colin O‘Flynn. IoT Goes Nuclear: Creating a Zigbee Chain Reaction. IEEE Security and Privacy, 2018 </ref>
</references>

== Further Information ==
* Colin O'Flynn. A LIGHTBULB WORM? Details of the Philips Hue Smart Lighting Design. In Black Hat USA, 2016

[[Category:Documentation]]
[[Category:Basic]]

Lightbulb Worm

2024-01-07T19:35:35Z

MArastu:

== What is a Lightbulb Worm? ==

The Lightbulb Worm is a construct that results from the research and attacks done by Colin O'Flynn, Eyal Ronen, Adi Shamir, and Achi-Or Weingarten.
They provide the ingredients of the first worm that affects smart lighting systems.

The worm has the power to spread only through physical proximity and would also be able to destroy lightbulbs permanently. It only takes one infected lightbulb to be installed, and the worm can spread - through its ZigBee wireless connectivity - directly to the physical neighbors of this lamp. These newly infected lamps would again infect all their neighbor lamps.
That leads to a massive chain reaction that spreads in an epidemic fashion and attacks whole cities. The critical mass to infect all lightbulbs within a urban area like Paris was estimated to around 15.000 lightbulbs. <ref name="ronenarticle"/>

== Philips Hue and Zigbee Light Link ==

The research and experiments of constructing the lightbulb worm have been done by using Philips Hue smart lighting systems and exploiting the implementation of their inbuilt ZigBee Light Link Protocol and firmware update mechanisms.

The Philips Hue smart lamp system works as follows:
The lightbulbs are connected to a bridge device which creates a network the lightbulbs can join. The bridge controls all the lamps and also contains an IP link. Via the Router, it is connected to the Internet through which you can control your system with the Philips Hue Lightning App. <ref name="ronenpaper"/>

[[File:PhilipsHue.jpg|thumb|none|600px|Philips Hue and ZLL Architecture <ref name="ronenpaper"/>]]

Philips Hue lamps communicate with their controllers through the Zigbee protocol and use the ZigBee Light Link protocol. <ref name="ronenpaper"/>

The ZigBee Light Link protocol is standardized by the ZigBee Alliance and is a very popular standard in the lighting industry because it provides network flexibility and scalability.
It also offers high interoperability between products from different vendors.
To enable high interoperability, the Touchlink Commissioning protocol is used. It makes the installation of the light bulbs very easy and intuitive. <ref name="wan13/>

The Touchlink commissioning protocol creates PANs (Personal Area Networks) and directs every new device placed in proximity to a specific bridge to join the PAN.
The new device receives an encryption key that is used to encrypt and authenticate messages within the PAN.
This encryption key is unique for every PAN and encrypted by a “Master key."

This “Master key" is a secret key, but it is used and stored on every ZLL certifed
product. In the case for Philipps Hue products the same AES-CCM key was used on every device. This resulted in the fact that the team was able to send faulty OTA updates to each device since using the same key on each device does not offer any protection if this key is known to the attacker.

The Touchlink protocol provides two message types with which the state of a lightbulb can be changed:

1. Reset to factory new request: If the target device receives this message
with a valid Transaction ID, it is reset to a factory new state, and all Network information and keys are deleted.

2. Join (or start) network request: With this message, the device is instructed to join
the PAN. <ref name="ronenpaper"/>

== Security Features of Philips Hue ==
'''Encryption Mechanisms''' – see [[#Philips Hue and Zigbee Light Link|Philips Hue and ZigBee Light Link]]

'''Proximity Check''' - prevents a takeover of lightbulbs in the nearest neighborhood.
:The proximity check ensures that the initiator is physically very close to the target.
:It must be passed successfully to connect lamps to the bridge.
:Without the proximity check, any initiator that owns the ZLL master key could instruct lightbulbs to reset to a factory new state or join a new PAN. <ref name="ronenpaper"/>

== Ingredients of the Lightbulb Worm ==

;Persistence of code execution on the lamps to take over the control of the lamps
:The researchers achieved the Persistence of Code Execution by exploiting the (OTA - Over the Air) update mechanisms of the Philips Hue. And they did that by reverse engineering.
:The reverse engineering was possible because the system was vulnerable to side channel analysis and also some parts of the encryption was already known.

:So the team managed to upload selfwritten firmware on the lamps instead of the original firmware.<ref name="ronenpaper"/>

;Lateral movement - the worm should spread automatically through proximity
:The lateral movement had been achieved by passing the proximity check.
:That was possible by exploiting the software implementation of the Touchlink protocol and a feature of the ZLL protocol.
:ZLL devices should also be able to join other ZigBee networks, where no ZLL is used. When no ZLL is used, there is also no proximity check.

:So they just had to set the lightbulbs to a Factory New state and make the lightbulbs actively search for ZigBee networks and are open to connection.
:Setting them to a Factory New state was possible due to a software bug which could have been found with negative testing during the Zigbee certification process. <ref name="ronenpaper"/>

== Security Issues of the Philips Hue System ==

* Use of a '''single symmetric encryption key''' shared across many devices to protect the firmware update process

* The attacks were also possible because the hardware is '''vulnerable to side-channel analysis'''

* And also, the '''bugs and errors in the implementation of protocols''' (designed to prevent long-range take-over attacks) <ref name="ronenpaper"/>

== Estimated Damage ==

To estimate the actual damage of such an attack, the researchers calculated how many smart lamps would have to be installed to launch the attack.

Result: Paris, the critical mass would be around 15,000 lamps (installed within a distance of about 100 meters).
That is not an unrealistic amount of lamps concerning the popularity of Philips Hue.
So the researchers assumed that cities might be already vulnerable to such attacks. <ref name="ronenpaper"/>

This attack is even more remarkable because there is no internet communication used.
The worm only spreads through physical proximity and is independent of established networking structures – so once created, the worm is probably impossible to stop.

System administrators usually try to stop such an attack by isolating subnetworks from each other, which in this case would not be possible because only ZigBee communication is used, which is not monitored or protected.

Also, locating the source of the attack and also detecting the attack itself would be very difficult. <ref name="ronenpaper"/>

== Possible Attacks ==

;Bricking Attacks
:Unlike usual DoS irreversible, all devices would have to be replaced
;Wireless Network Jamming
:ZigBee runs over the IEEE 802.15.4 standard, which uses the 2.4 GHz, license-free band (continuous wave signal from 'test mode' could overlap other channels)
;Data infiltration and exfiltration
;Affect peoples health
:The light can be programmed in such a blinking rate which causes epileptic seizures
:The LEDs can also be driven at frequencies that are creating discomfort in humans <ref name="ronenpaper"/>

== Countermeasures ==

* Unique keys per lightbulb

* Asymetric cryptography for software verification

* Reducing the amount of damage a leaked key might be able to cause

* Negative testing to avoid implementation bugs <ref name="ronenpaper"/>

== Zigbee Protocol Overview ==
* ZigBee is a low-power, low-data-rate wireless communication protocol.
* Used in smart homes, industrial automation, and sensor networks.
* Operates in 2.4 GHz frequency band with mesh network communication.

== Zigbee Architecture ==
* Architecture includes Application, Application Interface, Security, Network, Medium Access Control, and Physical Layer.

== Zigbee Addressing and Frames ==
* Uses short (16-bit) and long (64-bit) addresses for device identification.
* Packet-based communication with data frames, acknowledgment frames, and command frames.

== Zigbee Security and Sniffing ==
* Features encryption and authentication for secure device communication.
* Tools like Wireshark and nRF52840 dongle mentioned for Zigbee sniffing.

=== Initial Steps for Experimentation ===
* Details on using nRF Connect for Desktop, firmware installation, and programming the nRF52840 Dongle.
* Installation of nRF Sniffer capture plugin in Wireshark discussed.

== References ==
<references>
<ref name="ronenarticle">Eyal Ronen, Colin O'Flynn, Adi Shamir, and Achi Or Weingarten. IoT Goes Nuclear: Creating a ZigBee Chain Reaction. In Proceedings – IEEE Symposium on Security and Privacy, 2017 </ref>

<ref name="wan13"> Jianfeng Wang. Zigbee light link and its applicationss. IEEE Wireless Communications, 2013 </ref>

<ref name="ronenpaper"> Eyal Ronen, Adi Shamir, Achi Or Weingarten, and Colin O‘Flynn. IoT Goes Nuclear: Creating a Zigbee Chain Reaction. IEEE Security and Privacy, 2018 </ref>
</references>

== Further Information ==
* Colin O'Flynn. A LIGHTBULB WORM? Details of the Philips Hue Smart Lighting Design. In Black Hat USA, 2016

[[Category:Documentation]]
[[Category:Basic]]

Host CTF Platforms with Docker

2023-09-15T20:33:31Z

MArastu:

== Summary ==
In the world, there are many different types of platforms to learn and compete in so called Capture The Flags (CTFs). While the possibilities to host our own CTF platform in the cloud are nearly endless, there are also open-source variants which can be hosted with Docker or on-premise. These types of platforms are often preferred, since they do not cost any money and also one can learn many things about the hosting machine, the used technologies and about the platform itself.
This Article focuses on three open-source platforms and shows how to host them in a dockerized environment.

== Infrastructure used for this work ==

[[File:Infrastructure.jpeg|1000px]]

== System Requirements ==

* Operating system:
** Windows 8 or higher
** Ubuntu Linux 20.04 LTS or higher
** macOS 10.14 or higher
** Or any other OS which support Docker
* Docker Engine >= 20.10
** optional: Docker Desktop
* Ruby
* Internet Browser of any type
* GIT

== Docker Setup ==

=== Installation ===

First, uninstall any conflicting packages:
for pkg in docker.io docker-doc docker-compose podman-docker containerd runc; do sudo apt-get remove $pkg; done

Then update the apt package index:
sudo apt-get update
sudo apt-get install ca-certificates curl gnupg

After that, install the official GPG keys:
sudo install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
sudo chmod a+r /etc/apt/keyrings/docker.gpg

When that's done, setup the repository:
echo \
"deb [arch="$(dpkg --print-architecture)" signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu \
"$(. /etc/os-release && echo "$VERSION_CODENAME")" stable" | \
sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

Then install the Docker Engine with the latest version:
sudo apt-get update
sudo apt-get install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

=== Verification ===

After the installation, verify that the Docker Engine was installed successfully:
sudo docker run hello-world

== MITRE CTF Scoreboard ==

The MITRE CTF Scoreboard is an open-source application developed by the MITRE Cyber Academy and focuses on hosting Capture The Flags in safe environments for learning, practicing and competing. It offers a wide variety of functionality, including authentication and authorization of individuals, the creation and management of teams, management of competitions and their including challenges, and much more.
MITRE CTF Scoreboard is installed with Docker and the according plugin 'docker-compose'.

=== Setup ===

These steps are for production deployments using [https://docs.docker.com/compose/ docker-compose].

Download the git repository:
git clone https://github.com/mitre-cyber-academy/ctf-scoreboard.git

Then navigate into the folder:
cd ctf-scoreboard

After that, generate your credentials:
./setup-docker-secrets.sh

Then run scoreboard database setup:
docker-compose run web rails db:initial_setup

Add appropriate [https://github.com/mitre-cyber-academy/ctf-scoreboard/wiki/Production-Installation#Environment-Configuration Environment Variables] into your `.env-prod` file for your environment.
Add NGINX_HOST to the '.env' file for your environment
NGINX_HOST=your-scoreboard-domain.com

Start the container:
docker-compose up -d

The software is now be accessible via 'https://<ip address of docker container>'.

=== Create an Admin User ===
After the initial installation, navigate with yout browser to 'https://<ip address of docker container>'. This will prompt you a registration mask, on which you can create your Admin User - the following page may differ from the actual 'Admin Registration' page.

[[File:CreatUserCTFMitre.png|500px]]

== MELLIVORA ==

Mellivora Capture the Flag (CTF) platform is a comprehensive and dynamic online platform designed for hosting and participating in cybersecurity Capture the Flag competitions. Developed with the aim of enhancing practical cybersecurity skills, Mellivora CTF offers a robust and challenging environment for individuals and teams to engage in offensive and defensive cybersecurity exercises. The platform provides a feature-rich and intuitive interface, making it accessible to both beginners and experienced cybersecurity enthusiasts. It offers a wide range of challenges across various categories, including cryptography, web exploitation, reverse engineering, forensics, and more. These challenges are designed to mimic real-world scenarios, allowing participants to develop and apply their technical skills in a safe and controlled environment.
Mellivora CTF emphasizes collaboration and learning by fostering a competitive and engaging atmosphere. Participants can form teams and compete against others, leveraging their collective expertise to solve complex challenges and earn points. The platform offers a scoring system that rewards both speed and accuracy, encouraging participants to strategize, communicate effectively, and think critically to maximize their score. One notable aspect of Mellivora CTF is its flexibility and extensibility. The platform supports custom challenge creation, allowing organizers to tailor the competition to their specific needs and objectives. Additionally, Mellivora CTF provides a comprehensive administrative dashboard that enables organizers to manage competitions, track progress, and analyze performance metrics in real-time.

=== Setup ===

Mellivora is easy to use with docker-compose. Mellivora comes with an included docker-compose configuration intended for development use. If you're looking to run Mellivora using Docker(-compose) in production, a good place to start might be to copy the provided docker-compose config and changing it to suit your needs.

Download the git repository:
git clone https://github.com/Nakiami/mellivora

Then navigate into the folder:
cd mellivora

After that, run following command:
docker-compose -f docker-compose.dev.yml up

in the Mellivora home directory to give Apache the permissions necessary for challenge file upload and caching run following command:
sudo chown -R www-data:www-data writable/

=== Create an admin user: ===
* Visit http://localhost/ which should now display the Mellivora landing page.
* Register a new user. You will probably get an error about emails not working. The user is created and functional despite the error.
* Go to http://localhost:18080 where Adminer should be running (assuming you're running in dev mode). Log in with

Server: db
Username: root
Password: password
Database: mellivora

To make your user an administrator, go to "SQL command" in the menu and run:
UPDATE users SET class = 100 WHERE id = 1;

Log in at http://localhost/. Done!

=== Create basic challenge ===
For creating a basic challenge login with your admin user.
From the top menu select "Manage".
By selecting "Manage" you can create and edit already existing challenges and categories by pressing on "Categories" for changing or editing the categories or "Challenges" for editing or adding new challenges.

=== Tips ===
* The dev docker-compose profile mounts to use files directly from the host. Making changes to files on disk will result in changes to the running instance without rebuilding the container.
* If you are making changes to composer requirements, you will need to delete/rebuild the docker image composerdependencies.
* Call docker-compose -f docker-compose.dev.yml up --build to rebuild and start.
* Copy include/config/config.default.inc.php to include/config/config.inc.php to make your configuration changes.

== RootTheBox ==

Hackers can practice and learn using Root the Box, a real-time capture the flag (CTF) scoring system for computer wargames. Any CTF-style game may be easily configured and adjusted using the application. By fusing a fun game-like atmosphere with practical tasks that communicate knowledge applicable to the real-world, such as penetration testing, incident response, digital forensics, and threat hunting, the platform enables you to engage both inexperienced and experienced players.
RootTheBox is installed with Docker and the according plugin 'docker-compose'.

=== Setup ===

These steps are for production deployments using [https://docs.docker.com/compose/ docker-compose].

Download the git repository:
git clone https://github.com/moloch--/RootTheBox.git

Then navigate into the folder:
cd RootTheBox

Update the repository:
git pull
docker-compose build

Start the container:
docker-compose up -d

The software is now be accessible via 'https://<ip address of docker container>:8888'.

=== Access Admin Dashboard ===

RootTheBox enables Users to access an admin dashboard, which enables them to configure the platform to their need.
Usually, when just installed, the credentials for the admin user are the following:
admin
rootthebox

Always make sure to change the password of your admin account before you start hosting the platform in production!

== References ==

* https://docs.docker.com/
* https://github.com/mitre-cyber-academy/ctf-scoreboard
* https://github.com/Nakiami/mellivora
* https://github.com/moloch--/RootTheBox.git

[[Category:Documentation]]

Host CTF Platforms with Docker

2023-07-03T16:20:20Z

MArastu:

== Summary ==
In the world, there are many different types of platforms to learn and compete in so called Capture The Flags (CTFs). While the possibilities to host our own CTF platform in the cloud are nearly endless, there are also open-source variants which can be hosted with Docker or on-premise. These types of platforms are often preferred, since they do not cost any money and also one can learn many things about the hosting machine, the used technologies and about the platform itself.
This Article focuses on two open-source platforms and shows how to host them in a dockerized environment.

== System Requirements ==

* Operating system:
** Windows 8 or higher
** Ubuntu Linux 20.04 LTS or higher
** macOS 10.14 or higher
** Or any other OS which support Docker
* Docker Engine >= 20.10
** optional: Docker Desktop
* Ruby
* Internet Browser of any type
* GIT

== Docker Setup ==

=== Installation ===

First, uninstall any conflicting packages:
for pkg in docker.io docker-doc docker-compose podman-docker containerd runc; do sudo apt-get remove $pkg; done

Then update the apt package index:
sudo apt-get update
sudo apt-get install ca-certificates curl gnupg

After that, install the official GPG keys:
sudo install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
sudo chmod a+r /etc/apt/keyrings/docker.gpg

When that's done, setup the repository:
echo \
"deb [arch="$(dpkg --print-architecture)" signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu \
"$(. /etc/os-release && echo "$VERSION_CODENAME")" stable" | \
sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

Then install the Docker Engine with the latest version:
sudo apt-get update
sudo apt-get install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

=== Verification ===

After the installation, verify that the Docker Engine was installed successfully:
sudo docker run hello-world

== MITRE CTF Scoreboard ==

The MITRE CTF Scoreboard is an open-source application developed by the MITRE Cyber Academy and focuses on hosting Capture The Flags in safe environments for learning, practicing and competing. It offers a wide variety of functionality, including authentication and authorization of individuals, the creation and management of teams, management of competitions and their including challenges, and much more.
MITRE CTF Scoreboard is installed with Docker and the according plugin 'docker-compose'.

=== Setup ===

These steps are for production deployments using [https://docs.docker.com/compose/ docker-compose].

Download the git repository:
git clone https://github.com/mitre-cyber-academy/ctf-scoreboard.git

Then navigate into the folder:
cd ctf-scoreboard

After that, generate your credentials:
./setup-docker-secrets.sh

Then run scoreboard database setup:
docker-compose run web rails db:initial_setup

Add appropriate [https://github.com/mitre-cyber-academy/ctf-scoreboard/wiki/Production-Installation#Environment-Configuration Environment Variables] into your `.env-prod` file for your environment.
Add NGINX_HOST to the '.env' file for your environment
NGINX_HOST=your-scoreboard-domain.com

Start the container:
docker-compose up -d

== MELLIVORA ==

Mellivora Capture the Flag (CTF) platform is a comprehensive and dynamic online platform designed for hosting and participating in cybersecurity Capture the Flag competitions. Developed with the aim of enhancing practical cybersecurity skills, Mellivora CTF offers a robust and challenging environment for individuals and teams to engage in offensive and defensive cybersecurity exercises. The platform provides a feature-rich and intuitive interface, making it accessible to both beginners and experienced cybersecurity enthusiasts. It offers a wide range of challenges across various categories, including cryptography, web exploitation, reverse engineering, forensics, and more. These challenges are designed to mimic real-world scenarios, allowing participants to develop and apply their technical skills in a safe and controlled environment.
Mellivora CTF emphasizes collaboration and learning by fostering a competitive and engaging atmosphere. Participants can form teams and compete against others, leveraging their collective expertise to solve complex challenges and earn points. The platform offers a scoring system that rewards both speed and accuracy, encouraging participants to strategize, communicate effectively, and think critically to maximize their score. One notable aspect of Mellivora CTF is its flexibility and extensibility. The platform supports custom challenge creation, allowing organizers to tailor the competition to their specific needs and objectives. Additionally, Mellivora CTF provides a comprehensive administrative dashboard that enables organizers to manage competitions, track progress, and analyze performance metrics in real-time.

=== Setup ===

Mellivora is easy to use with docker-compose. Mellivora comes with an included docker-compose configuration intended for development use. If you're looking to run Mellivora using Docker(-compose) in production, a good place to start might be to copy the provided docker-compose config and changing it to suit your needs.

Download the git repository:
git clone https://github.com/Nakiami/mellivora

Then navigate into the folder:
cd mellivora

After that, run following command:
docker-compose -f docker-compose.dev.yml up

in the Mellivora home directory to give Apache the permissions necessary for challenge file upload and caching run following command:
sudo chown -R www-data:www-data writable/

=== Create an admin user: ===
* Visit http://localhost/ which should now display the Mellivora landing page.
* Register a new user. You will probably get an error about emails not working. The user is created and functional despite the error.
* Go to http://localhost:18080 where Adminer should be running (assuming you're running in dev mode). Log in with

Server: db
Username: root
Password: password
Database: mellivora

To make your user an administrator, go to "SQL command" in the menu and run:
UPDATE users SET class = 100 WHERE id = 1;

Log in at http://localhost/. Done!

=== Tips ===
* The dev docker-compose profile mounts to use files directly from the host. Making changes to files on disk will result in changes to the running instance without rebuilding the container.
* If you are making changes to composer requirements, you will need to delete/rebuild the docker image composerdependencies.
* Call docker-compose -f docker-compose.dev.yml up --build to rebuild and start.
* Copy include/config/config.default.inc.php to include/config/config.inc.php to make your configuration changes.

== References ==

* https://docs.docker.com/
* https://github.com/mitre-cyber-academy/ctf-scoreboard
* https://github.com/Nakiami/mellivora

[[Category:Documentation]]