writing-exploits.md

Writing exploits

This document provides an overview of how to build an exploit container.

Writing exploit script

The gameserver passed the targets for the exploit as a JSON list of key-value pairs via the environment variable TARGETS. Every entry of the list consists of the following information:

• ip: IP address of the target service.
• port: Port number of the target service.
• flag_id: Identifier of the flag to be retrieved from the specified target.

The exploit script should retrieve the flag corresponding to the flag_id and print it to stdout.

Building an exploit container

The exploit container can be built from scratch or from some existing container image. Teams are free to install any custom libraries, interpreters, compilers and more in the container. The only requirement is that teams correctly specify the exploit script as the entry point script to be executed when the container is started. Teams can test it against local instances of the services to ensure it is working correct.

Uploading exploit container

Teams have to name the image of the exploit container as "exploit_<service_name>" and upload it to their namespace in the container image registry. After they have uploaded the image, they can ensure that the image is scheduled to be updated by checking status in the team dashboard.