Major updates #8

MarkusOstermayer · 2026-01-18T00:12:25Z

Hey, this PR adds/changes the following

Updated challenges to the new manifest (021530e)
Adds the package archival services for debian and ubuntu images (8b4c712, 1026b29)
Removed all alpine based images (35eb948), instanced templates (0d3eb8f) and kernel-PWN (41a03eb)
Added preparsing for sagemath (56c544b)
Added file extensions (6e02f00)
Added templates for docker-compose.yml files (e13ac2a)
Changed templates to use the flag placed in the environment (aff947a, 8978a0a)
Added a new template for creating offline-challenges with dynamic flags (33a6f2c)

There are unfortunately a lot of changes in this PR.
We could also split it up into multiple PRs in order to make it easier to review.

Ported all debian and ubuntu based images to use the archival services. In addition, all containers were switched from the docker-hashes to timestamped images to give challenge authors a better feeling of how old/new the image is.

I updated the pwn debian 12.11 template to debian 12.12. Since the minor version changed, I renamed the folder do not include it. Since this change might spark some discussion, this is a seperate commit

All minor versions have been updated, the table listing the versions in the readme-md has been updated and .version has been updated.

…ives' into yctf_v2

…ctf_v2

This Commit adds file-extensions for files that are not binaries (e.g. python or bash-files). This was done because file-extensions are present for other challenges aswell (e.g. the solidity or php template). This closes #4

I accidentay removed too much in ecd71ba, this commit adds it back in

This PR adds tempaltes for docker-compose-files that can be included in the dist. We are currently missing support from the makefile.

I had a copy-paste error in the manifest for the connection info.

removed old flag.txt, added new entrypoint to write the flag into a file and start nsjail.

In all non-jail templates, all references to flag.txt have been removed in the challenge subdirectory and the flag is being read from the environment

Added a tempalte that dynamically gegerates challenge dists

MarkusOstermayer · 2026-01-18T09:06:59Z

The manifest for offline-dynamic-python is still wrong, I'll fix that in the afternoon.

h4ckd0tm3 · 2026-01-20T06:47:03Z

Great work! Will take a look at the changes today :)

One question:
Should this continoue to be maintained as a fork?
At this point we stray very far away from LosTemplates, although keeping compatibility we could consider making a Repo that is not a fork.

h4ckd0tm3

Looking good so far, a few minor changes.
Regarding the solutions:
Might be that we need to rework the "find_flag" function again.
Hammer will provide the expected flag as env and I opted for a regex that matches generic flags as a fallback. Also open for input on that.

h4ckd0tm3 · 2026-01-20T06:51:00Z

.versions

Further supporting the fact that this should be it's own repository I think.

h4ckd0tm3 · 2026-01-20T06:54:39Z

bash-jail-ubuntu24.04/Makefile

LGTM
Are we keeping the Makefiles now?
I am currently working non finishing the test command for hammer.

Are we keeping the Makefiles now?

The preferred method of testing going forward should (IMO) be hammer.
Since the makefiles are stripped down so much, we could offer them as a "alternative" to hammer.

The only issue is that the RARGS and the actual parameters that hammer uses may get out of sync.
But if the Makefiles aren't that popular among challenge creators, we can just remove them.

h4ckd0tm3 · 2026-01-20T06:56:41Z

bash-jail-ubuntu24.04/challenge/setup_entrypoint.sh

+
+echo $FLAG > /jail/flag.txt
+cat /jail/flag.txt
+


Suggested change

unset FLAG

h4ckd0tm3 · 2026-01-20T06:59:40Z

bash-nojail-ubuntu24.04/challenge/entrypoint.sh

@@ -1,2 +1,2 @@
 #!/bin/sh
-/usr/bin/stdbuf -i0 -o0 -e0 /app/challenge
+/usr/bin/stdbuf -i0 -o0 -e0 /app/challenge.bash


Flag is never copied into the file.

Suggested change

/usr/bin/stdbuf -i0 -o0 -e0 /app/challenge.bash

echo $FLAG > /flag.txt

unset FLAG

/usr/bin/stdbuf -i0 -o0 -e0 /app/challenge.bash

h4ckd0tm3 · 2026-01-20T07:00:33Z

bash-nojail-ubuntu24.04/challenge/Dockerfile

-RUN chmod +x /app/challenge
+COPY challenge.bash /app/challenge.bash
+RUN chmod +x /app/challenge.bash
 COPY flag.txt /flag.txt


Remove flag copy, as flag.txt does not exist anymore.
Moved to entrypoint.sh

Suggested change

COPY flag.txt /flag.txt

h4ckd0tm3 · 2026-01-20T07:40:51Z

phpxss-nojail-ubuntu24.04/Manifest.yaml

+    function: linear
+
+connectinfo: >-
+    <code>snicat {{ infos['challenge_container']['1337']['hostname'] }}</code><br>


Suggested change

<code>snicat {{ infos['challenge_container']['1337']['hostname'] }}</code><br>

<a href="{{ infos['challenge_container']['1337']['hostname'] }}" target=_blank>{{ infos['challenge_container']['1337']['hostname'] }}</a>

h4ckd0tm3 · 2026-01-20T07:41:02Z

phpxss-nojail-ubuntu24.04/Manifest.yaml

+
+connectinfo: >-
+    <code>snicat {{ infos['challenge_container']['1337']['hostname'] }}</code><br>
+    We recommend using <a href="https://github.com/CTFd/snicat" target="_blank">snicat</a> to connect to the challenge.


Suggested change

We recommend using <a href="https://github.com/CTFd/snicat" target="_blank">snicat</a> to connect to the challenge.

h4ckd0tm3 · 2026-01-20T07:43:50Z

pwn-jail-debian12/challenge/setup_entrypoint.sh

+
+echo $FLAG > /jail/flag.txt
+cat /jail/flag.txt
+


Suggested change

unset FLAG

h4ckd0tm3 · 2026-01-20T07:44:46Z

pwn-jail-ubuntu24.04/challenge/setup_entrypoint.sh

+
+echo $FLAG > /jail/flag.txt
+cat /jail/flag.txt
+


Suggested change

unset FLAG

h4ckd0tm3 · 2026-01-20T07:50:23Z

python3.12-jail-ubuntu24.04/challenge/setup_entrypoint.sh

+
+echo $FLAG > /jail/flag.txt
+cat /jail/flag.txt
+


Suggested change

unset FLAG

MarkusOstermayer · 2026-01-20T08:27:44Z

Hey, thanks for the review.

Hammer will provide the expected flag as env and I opted for a regex that matches generic flags as a fallback.

Ah, I didn't know that. In this case, let's use your default and your regex.

MarkusOstermayer added 24 commits December 9, 2025 23:51

Ported debian and ubuntu based images

8b4c712

Ported all debian and ubuntu based images to use the archival services. In addition, all containers were switched from the docker-hashes to timestamped images to give challenge authors a better feeling of how old/new the image is.

Updated debian 12.11 template

1026b29

I updated the pwn debian 12.11 template to debian 12.12. Since the minor version changed, I renamed the folder do not include it. Since this change might spark some discussion, this is a seperate commit

Updated tempalte versions

2598648

All minor versions have been updated, the table listing the versions in the readme-md has been updated and .version has been updated.

Added file extension for sagemath

6935580

Merge remote-tracking branch 'upstream/fix/debian_ubuntu_package_arch…

612e454

…ives' into yctf_v2

Merge remote-tracking branch 'upstream/feature/sage_extension' into y…

56c544b

…ctf_v2

Removed instanced templates

0d3eb8f

Removed POW, removed qemu-pwn-kernel

41a03eb

Removed alpine based templates

35eb948

Added new manifests

021530e

Removed CTFd-configuration, removed dist-folder

eac9830

Removed old targets and other configuration

ecd71ba

Removed old phony targets

4136dc5

removed phony targets for offline-template

4ffe5cf

Updated readme, changed solidity-version number

6084d39

Added fileextensions for non-binaries

6e02f00

This Commit adds file-extensions for files that are not binaries (e.g. python or bash-files). This was done because file-extensions are present for other challenges aswell (e.g. the solidity or php template). This closes #4

Fixed makefile from prior mistake

abb7c82

I accidentay removed too much in ecd71ba, this commit adds it back in

Added docker-compose tempaltes

e13ac2a

This PR adds tempaltes for docker-compose-files that can be included in the dist. We are currently missing support from the makefile.

Fixed copy-paste error

3907442

I had a copy-paste error in the manifest for the connection info.

Added dummy-flag in docker-compose template

3150d99

Removed old dummy-flag

17e5d1e

Removed flag.txt from jailed challenges

aff947a

removed old flag.txt, added new entrypoint to write the flag into a file and start nsjail.

Repalce flag.txt-files with environment file

8978a0a

In all non-jail templates, all references to flag.txt have been removed in the challenge subdirectory and the flag is being read from the environment

Added offline-dynamic-python

33a6f2c

Added a tempalte that dynamically gegerates challenge dists

MarkusOstermayer requested a review from h4ckd0tm3 January 18, 2026 00:12

Added a environment variable to all makefiles

2e70a42

MarkusOstermayer marked this pull request as draft January 18, 2026 09:07

h4ckd0tm3 reviewed Jan 20, 2026

View reviewed changes

	<code>snicat {{ infos['challenge_container']['1337']['hostname'] }}</code><br>
	<a href="{{ infos['challenge_container']['1337']['hostname'] }}" target=_blank>{{ infos['challenge_container']['1337']['hostname'] }}</a>

Major updates #8

Are you sure you want to change the base?

Major updates #8

Uh oh!

Conversation

MarkusOstermayer commented Jan 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

MarkusOstermayer commented Jan 18, 2026

Uh oh!

h4ckd0tm3 commented Jan 20, 2026

Uh oh!

h4ckd0tm3 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

MarkusOstermayer commented Jan 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

MarkusOstermayer commented Jan 18, 2026 •

edited

Loading