cscg ist super

2026/cscg/misc/one-bit/Dockerfile

@@ -0,0 +1,30 @@
+# syntax=docker/dockerfile:1
+FROM ubuntu:22.04
+
+ARG DEBIAN_FRONTEND=noninteractive
+RUN apt-get update --fix-missing && apt-get install -y openssh-server qemu-system git wget cpio curl sudo
+
+RUN mkdir /var/run/sshd
+#password for user login
+RUN sed -i 's/#Port 22/Port 3000/' /etc/ssh/sshd_config \
+    && sed -i 's/#PermitEmptyPasswords no/PermitEmptyPasswords yes/' /etc/ssh/sshd_config  \
+    && printf "\n\nAuthenticationMethods none\n" >> /etc/ssh/sshd_config
+
+RUN groupadd --system ctf --gid 1000 \
+    && useradd --uid 1000 --system --gid ctf --home-dir /home/ctf --create-home --comment "CTF image user" -s /bin/bash ctf \
+    && chown -R ctf:ctf /home/ctf \ 
+    && passwd -d ctf && mkdir -p /chall/initfs
+
+WORKDIR /chall
+COPY initfs/ ./initfs
+RUN git clone --recurse-submodules -j8 https://github.com/MyEyes/basic_linux_env && cd basic_linux_env && ./build.sh && mkdir host
+COPY adjust_initramfs.sh run.sh ./
+COPY run_qemu.sh ./basic_linux_env
+RUN ./adjust_initramfs.sh && chmod -R go-rwx basic_linux_env/* && chmod -R go+rwx basic_linux_env/host && rm -rf initfs
+COPY sudoers /etc/sudoers
+
+COPY bzImage ./basic_linux_env
+
+EXPOSE 3000
+# Start SSH server
+CMD ["/usr/sbin/sshd", "-D"]

2026/cscg/misc/one-bit/README.md

@@ -0,0 +1,7 @@
+## General notes
+
+* The challenge really uses a stock `v5.15.201` kernel with the given `.config` and the applied `kernel.diff`
+    * The `chall_config.diff` is just there for your convenience, the `9p` stuff is so the `host` dir can be mounted in QEMU.
+    * You can download the bzImage or build it yourself, but you shouldn't really need it.
+* The `basic_linux_env` is just a minimal shell environment to run a linux kernel, you can clone it yourself for testing.
+* The flag is accessible in the qemu VM at /flag

2026/cscg/misc/one-bit/adjust_initramfs.sh

@@ -0,0 +1,16 @@
+#!/bin/sh
+
+cp -r initfs/* basic_linux_env/basic_initfs/root/
+
+cd basic_linux_env/basic_initfs/root/bin
+ln -s ./busybox ./cat
+ln -s ./busybox ./uname
+ln -s ./busybox ./modprobe
+ln -s ./busybox ./chmod
+ln -s ./busybox ./grep
+ln -s ./busybox ./unshare
+ln -s ./busybox ./setuidgid
+cd -
+
+cd basic_linux_env/basic_initfs && ./build.sh
+cd -

2026/cscg/misc/one-bit/chall_config.diff

@@ -0,0 +1,41 @@
+192c192
+< # CONFIG_USER_NS is not set
+---
+> CONFIG_USER_NS=y
+782a783
+> CONFIG_BLK_MQ_VIRTIO=y
+1233c1234,1236
+< # CONFIG_NET_9P is not set
+---
+> CONFIG_NET_9P=y
+> CONFIG_NET_9P_VIRTIO=y
+> # CONFIG_NET_9P_DEBUG is not set
+1443a1447
+> # CONFIG_VIRTIO_BLK is not set
+1720a1725
+> # CONFIG_VIRTIO_NET is not set
+2397a2403
+> # CONFIG_HW_RANDOM_VIRTIO is not set
+3183a3190
+> # CONFIG_SND_VIRTIO is not set
+3669a3677,3678
+> CONFIG_VIRTIO=y
+> CONFIG_VIRTIO_PCI_LIB=y
+3671,3672c3680,3685
+< # CONFIG_VIRTIO_PCI is not set
+< # CONFIG_VIRTIO_MMIO is not set
+---
+> CONFIG_VIRTIO_PCI=y
+> CONFIG_VIRTIO_PCI_LEGACY=y
+> # CONFIG_VIRTIO_BALLOON is not set
+> # CONFIG_VIRTIO_INPUT is not set
+> CONFIG_VIRTIO_MMIO=y
+> # CONFIG_VIRTIO_MMIO_CMDLINE_DEVICES is not set
+3803a3817
+> # CONFIG_VIRTIO_IOMMU is not set
+4080a4095,4097
+> CONFIG_9P_FS=y
+> # CONFIG_9P_FS_POSIX_ACL is not set
+> # CONFIG_9P_FS_SECURITY is not set
+4388a4406
+> # CONFIG_CRYPTO_DEV_VIRTIO is not set

2026/cscg/misc/one-bit/initfs/flag

@@ -0,0 +1 @@
+CSCG{dummy}

2026/cscg/misc/one-bit/initfs/init

@@ -0,0 +1,13 @@
+#!/bin/sh
+mount -t devtmpfs devtmpfs /dev
+mount -t proc proc /proc
+mount -t sysfs sysfs /sys
+mount -t tmpfs tmpfs /tmp
+mount -t 9p -o trans=virtio,version=9p2000.L host /mnt/host
+
+chmod 600 flag
+chmod +s /bin/busybox
+
+setuidgid 1000 sh
+echo "Init exiting, shutting down system"
+poweroff -f

2026/cscg/misc/one-bit/kernel.diff

@@ -0,0 +1,12 @@
+diff --git a/fs/binfmt_misc.c b/fs/binfmt_misc.c
+index 740dac1012ae..b974b868278a 100644
+--- a/fs/binfmt_misc.c
++++ b/fs/binfmt_misc.c
+@@ -934,6 +934,7 @@ static struct file_system_type bm_fs_type = {
+ 	.name		= "binfmt_misc",
+ 	.init_fs_context = bm_init_fs_context,
+ 	.kill_sb	= kill_litter_super,
++	.fs_flags = FS_USERNS_MOUNT,
+ };
+ MODULE_ALIAS_FS("binfmt_misc");
+ 

2026/cscg/misc/one-bit/run.sh

@@ -0,0 +1,3 @@
+#!/bin/sh
+
+cd /chall/basic_linux_env && sudo /chall/basic_linux_env/run_qemu.sh

2026/cscg/misc/one-bit/run_qemu.sh

@@ -0,0 +1,10 @@
+#!/bin/sh
+qemu-system-x86_64 \
+    -m 2048\
+    -kernel /chall/basic_linux_env/bzImage\
+    -append 'console=ttyS0 noapic'\
+    -monitor none\
+    -initrd /chall/basic_linux_env/basic_initfs/initramfs\
+    -virtfs local,path=/chall/basic_linux_env/host,mount_tag=host,security_model=passthrough,id=host\
+    -nographic
+    #-serial mon:stdio

2026/cscg/misc/one-bit/sudoers

@@ -0,0 +1 @@
+ctf ALL=(ALL) NOPASSWD: /chall/basic_linux_env/run_qemu.sh