EpicTreasure - Batteries included CTF VM
Tools included
- Binjitsu
- Pwndbg
- Radare2
- Firmware tools (fmk / qemu)
- angr
- ROPGadget
- decompile - Add API key to
host-share/decompile-api
- qira
- binwalk
- apktool
Docker
docker pull ctfhacker/epictreasure
docker run -v /path/to/host/share/folder:/root/host-share --privileged -it --workdir=/root ctfhacker/epictreasure
Vagrant
Install VirtualBox
Check Virtualbox for information on installing Virtualbox on your respective operating system.
Install Vagrant
Check VagrantUp for information on installing vagrant.
Fire up the VM
git clone https://github.com/ctfhacker/epictreasure
cd epictreasure
mkdir host-share
vagrant up
... Go grab a coffee while we install all the things
vagrant ssh
Default settings
By default, my dotfiles are installed onto the VM. Simply comment out the following lines in et_setup.sh if you don't want my settings.
# Personal config
sudo sudo apt-get -y install stow
cd /home/vagrant
rm .bashrc
git clone https://github.com/thebarbershopper/dotfiles
cd dotfiles
./install.sh
Terminal
- Colorscheme for the terminal and vim is solarized
Vim
jk
orjj
toESC
out of VimESC
andArrow keys
are hard coded to not work in Vim (as a teaching mechanism):
is remapped to;
(who uses ; anyway?)- leader key is
SPACE
(thanks to spacemacs) SPACE p
will drop an embedded IPython line in a python scriptH
moves to beginning of line,L
moves to end of line (instead of^
and$
)
Tmux
- A new shell spawns a fresh
tmux
session tmux
leader switched toCtrl+A
Ctrl+A -
produces a horizontal pane.Ctrl+A \
produces a vertical pane.Ctrl+A [hjkl]
moves around available panes as vim motion
Check correct installation
Pwndbg
Run the following command in the VM:
gdb /bin/ls
Expected output:
Loaded 53 commands. Type pwndbg for a list.
Reading symbols from host-share/crackme...(no debugging symbols found)...done.
Only available when running
pwn>
Radare
Run the following command in the VM:
r2 /bin/ls
Expected output:
[0x00404890]> aaa
Binjitsu
Run the following command in the VM:
python
>>> from pwn import *
>>> elf = ELF('/bin/ls')
[*] '/bin/ls'
Arch: amd64-64-little
RELRO: Partial RELRO
Stack: Canary found
NX: NX enabled
PIE: No PIE
FORTIFY: Enabled
>>> rop = ROP(elf)
[*] Loading gadgets for '/bin/ls'
angr
Run the following commands in the VM:
source ~/angr/bin/activate
python
>>> import angr
>>>
decompile
Run the following commands in the VM:
decompile binary_name
Shared folder
Drop files in the host-share
folder on your host to find them on your VM at /home/vagrant/host-share