Capture The Flag

A security wargame with 6 challenges, embedded on an ultra-light Linux Live CD

Get the ISO View on GitHub

Capture The Flag!

Break through the 6 increasingly difficult challenges to capture "The Flag".

Using the Live CD

Configure a virtual machine to use the ISO image as a Live CD, using a virtualization software like VirtualBox, VMWare, qemu or similar.

  1. Get the latest ISO image (~26MB): https://github.com/janosgyerik/capture-the-flag/releases/download/v1.0/ctf1-r14.iso
  2. Create a new virtual machine: Linux, 2.6/3.x/4.x kernel, 32-bit
  3. Memory: 256MB
  4. Hard disk: no need for a disk
  5. CD: configure the CD drive to use the ISO image
  6. Start the Virtual Machine

In the boot menu, if you have a US keyboard, then simply press enter. Otherwise, you can type fr, jp or hu and Enter to use French, Japanese or Hungarian keymap, respectively.

The Live CD is based on TinyCore Linux, and all the regular boot options should work as expected.

After the system has started, you will see the instructions to pass the first challenge:

Start

The goal is to advance through the levels one by one, discovering the password to the next level at each step, until you reach "The Flag" (and celebrate):

End

Solutions

The solutions are intentionally omitted from this project. You can find the solutions to the original Stripe challenges on the internet, but don't be surprised if they won't work on this Live CD out of the box. That's intentional too ;-)

Please keep your own solutions private. Thank you.

Installing additional software

You can install additional software in the running system, if you really want. Switch to the tc user with the su - tc command, and use the tce program -- TinyCore's package manager. Simply run the program and follow the instructions.

Abusing the CD

If you want to get root access in the live system, you can either do su - tc to become the admin user, or boot the system with the mc superuser boot option. This is no secret, and you won't learn anything this way.

Disclaimer

The challenges are based on the original online contest organized by Stripe: https://stripe.com/blog/capture-the-flag

Links