run-server.yml

# This GitHub Actions workflow installs several useful tools for CTFs, and
# starts a server so the user can connect and work in the virtual environment.
# This is a pretty safe environment for running random binaries from CTFs, and
# you mostly don't have to worry about fucking anything up since it starts
# fresh every time.

# Created by Jacob Strieb
# December 2020

name: Run Collaborative CTF Environment

# Only run when manually triggered
on:
  # Trigger from POST
  repository_dispatch:
    types: [run-server]

  workflow_dispatch:
    inputs:
      ngrok_token:
        description: Token to use for ngrok (optional)
        required: false

jobs:
  start_server:
    name: Set up and start the collaborative CTF server
    runs-on: ubuntu-20.04
    steps:
      - name: Install (and upgrade) packages
        run: |
          sudo apt-get update
          # NOTE: upgrading takes way too long, and doesn't seem totally
          # necessary; hence it has been commented out
          # sudo apt-get --yes upgrade

          # NOTE: many of these are already installed; included for posterity
          # TODO: add other packages for CTF stuff
          PACKAGES=(
            binutils
            curl
            wget
            gcc
            tmux
            nmap
            htop
            gdb
            netcat
            socat
            build-essential
            imagemagick
            jq
            binwalk
            exiftool
            hashcat
            qemu
            valgrind
            fish
            gh
            ncdu
            bat
          )

          sudo apt-get --yes install ${PACKAGES[@]}

          sudo add-apt-repository ppa:neovim-ppa/unstable
          sudo apt-get update
          sudo apt-get install neovim

          python -m pip install --upgrade pip setuptools wheel
          python3 -m pip install --upgrade pip setuptools wheel

          PIP_PACKAGES=(
            pwntools
            ciphey
            pyfiglet
            pipenv
            python-dotenv
          )
          python3 -m pip install --upgrade ${PIP_PACKAGES[@]}

          # Install pup, not available on apt
          mkdir -p ~/Downloads;
          cd ~/Downloads;
          wget \
            --output-document pup_v0.4.0_linux_amd64.zip \
            "https://github.com/ericchiang/pup/releases/download/v0.4.0/pup_v0.4.0_linux_amd64.zip";
          unzip pup_v0.4.0_linux_amd64.zip;
          sudo mv ./pup /usr/local/bin/pup;

      - name: Install Docker
        run: |
          cd ~/Downloads;
          # install prerequisetes
          sudo apt install -y \
            apt-transport-https \
            ca-certificates \
            curl \
            software-properties-common \
            lsb-release \
            gnupg

          # add the GPG key for the official Docker repository
          curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -
          # add docker repository
          sudo add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu focal stable"
          # install docker
          sudo apt install docker-ce docker-ce-cli containerd.io

          # avoid sudo with docker commands
          sudo usermod -aG docker ${USER}
          # reload so sudo is not neededeith docker
          # su - ${USER}

          # new install docker
          # echo \
          #   "deb [arch=amd64 signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu \
          #   $(lsb_release -cs) stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null

      # Make CTF files from the repo available in the ~/ctf directory
      - uses: actions/checkout@v2
      - name: Move checked out repository to ~/ctf
        run: |
          cd
          mv "$GITHUB_WORKSPACE" ~/ctf

          # Re-create the workspace directory, otherwise subsequent steps start
          # in a folder that doesn't exist and immediately fail
          mkdir --parents "$GITHUB_WORKSPACE"

      - name: Install dotfiles
        run: |
          cd ~/ctf/dotfiles
          bash install.sh

          cp ./ttyd_run.sh ~/ttyd_run.sh
          cp ./ngrok.yml ~/ngrok.yml

          # Change the runner password to "ctf"; by default it has no password,
          # which complicates some things like connecting via SSH
          echo "runner:ctf" | sudo chpasswd

          # Add a command to kill the action by killing the "sleep" process
          echo 'alias quit="pkill sleep"' >> ~/.bashrc

      - name: Install chezmoi
        run: |
          sh -c "$(curl -fsLS chezmoi.io/get)" -- init --apply https://github.com/djsnipa1/dotfiles-chezmoi.git

      - name: Install ngrok and run in the background as a daemon
        run: |
          # Only proceed if there is a user-supplied authtoken for ngrok.
          # Prefer one submitted with a workflow dispatch, but accept one
          # stored as a repository secret.
          NGROK_AUTHTOKEN="${{ github.event.inputs.ngrok_token }}"
          if [ -z "$NGROK_AUTHTOKEN" ]; then
            NGROK_AUTHTOKEN="${{ secrets.NGROK_TOKEN }}"
          fi
          if [ -z "$NGROK_AUTHTOKEN" ]; then
            exit 0
          fi

          # Add the authtoken to the ngrok configuration file
          echo "authtoken: $NGROK_AUTHTOKEN" >> ~/ngrok.yml

          # Download and install ngrok
          cd
          wget \
            --quiet \
            --output-document ngrok.zip \
            "https://bin.equinox.io/c/4VmDzA7iaHb/ngrok-stable-linux-amd64.zip"
          unzip ngrok.zip
          sudo mv ngrok /usr/local/bin/ngrok
          touch ~/ngrok.log

          # Run ngrok in the background as a daemon
          start-stop-daemon \
            --start \
            --background \
            --chdir ~/ctf \
            --exec /usr/local/bin/ngrok \
            -- \
              start \
              -config ~/ngrok.yml \
              ttyd ssh

      - name: Install ttyd and run in the background as a daemon
        run: |
          # xterm is required for tmux\ttyd. Installed here to highlight that
          # this is the specific part of the script that requires it.
          sudo apt-get --yes install xterm

          # Download and install ttyd
          cd
          wget \
            --quiet \
            --output-document ttyd \
            "https://github.com/tsl0922/ttyd/releases/download/1.6.1/ttyd_linux.x86_64"
          chmod +x ttyd
          sudo mv ttyd /usr/local/bin/ttyd

          # Run ttyd in the background as a daemon
          start-stop-daemon \
            --start \
            --background \
            --chdir ~/ctf \
            --exec /usr/local/bin/ttyd \
            -- \
              --port 7681 \
              --credential runner:ctf \
              /bin/bash ~/ttyd_run.sh

      - name: Install Tor and run a hidden service in the background as a daemon
        run: |
          sudo apt-get --yes install tor

          # Sometimes it's already running for some reason...?
          sudo service tor stop
          sudo killall tor || true

          # Generate a random port for Tor to use since the default is often
          # taken
          export TOR_SOCKS_PORT="$((1025 + RANDOM % 8975))"

          # Run a hidden service in the background as a daemon -- allow
          # connecting to the ttyd instance via a browser and allow SSH
          tor \
            --runasdaemon 1 \
            --socksport $TOR_SOCKS_PORT \
            --hiddenservicedir /home/runner/tor_service \
            --hiddenserviceport "80 127.0.0.1:7681" \
            --hiddenserviceport "22 127.0.0.1:22"

      - name: Display connection information
        run: |
          # Start a tmux session in the background whose window group everyone
          # will share
          tmux new-session -d -c ~/ctf -s ctf

          echo Waiting for things to start up...
          sleep 20s

          echo
          echo When connecting, use username "'runner'" and password "'ctf'"
          echo

          # Print Tor connection info
          echo To connect securely over Tor:
          printf "http://%s\n" "$(cat ~/tor_service/hostname)"
          printf \
            "ssh -o ProxyCommand='nc -x localhost:9150 %%h %%p' ssh://runner@%s\n\n" \
            "$(cat ~/tor_service/hostname)"

          # Print ngrok connection info (if applicable)
          NGROK_AUTHTOKEN="${{ github.event.inputs.ngrok_token }}"
          if [ -z "$NGROK_AUTHTOKEN" ]; then
            NGROK_AUTHTOKEN="${{ secrets.NGROK_TOKEN }}"
          fi
          if [ -n "$NGROK_AUTHTOKEN" ]; then
            echo "To connect using ngrok (i.e., not Tor):"
            cat ~/ngrok.log \
              | jq .url \
              | grep -v "null" \
              | tr -d '"' \
              | sed 's/tcp:\/\/\(.*\)/ssh runner@\1/g' \
              | sed 's/:\([[:digit:]]\{5\}\)/ -p \1/' \
              | sort >> ~/connect.log

              # | sed 's/tcp:\/\/\(.*\)/ssh ssh:\/\/runner@\1/g' \
            cat ~/connect.log
            echo "CONNECT_INFO={cat ~/connect.log}" >> $GITHUB_ENV
          fi

      # Run python  text file
      # - name: Text Me Dependecies
      #   uses: VaultVulp/action-pipenv@v2.0.1
      #   with:
      #     command: install -d # Install all dependencies, including development ones

      - name: Text Me text.py
        env:
          TEXTNOW_SRC: ${{ secrets.TEXTNOW_SRC }}
          TEXTNOW_CSRF: ${{ secrets.TEXTNOW_CSRF }}

        run: |
          cd ~/ctf

          if [ -f "Pipfile" ]; then
            pipenv install
          else
            echo "Pipfile not found"
          fi

          if [ -f "text.py" ]; then
            pipenv run python text.py
          else
            echo "text.py not found"
          fi

        # uses: VaultVulp/action-pipenv@v2.0.1
        # with:
        #   command: run python main.py
        # command: run test # Run custom `test` command defined in the `[scripts]` block of Pipfile
        # - name: Text Me
        # path: ~/connect.log

        continue-on-error: true

      - name: Sleep
        run: |
          # Wait... This process will be killed to end the Action. Return a
          # non-failure exit code in any case so that there are no unnecessary
          # notifications about a failed Actions workflow.

          sleep 6h || true
        continue-on-error: true

      - name: Clean up
        run: |
          echo Done!