cscg ist super

2026/cscg/misc/table-madness/service-target/Dockerfile

@@ -0,0 +1,46 @@
+FROM debian:bookworm AS builder
+
+RUN \
+    --mount=type=cache,target=/var/cache/apt,sharing=locked \
+    --mount=type=cache,target=/var/lib/apt,sharing=locked \
+    apt-get update && apt-get install -y --no-install-recommends \
+    libguestfs-tools cloud-image-utils curl linux-image-amd64 \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /build
+
+RUN chmod 0644 /boot/vmlinuz*
+
+RUN curl -Lo debian.qcow2 https://cloud.debian.org/images/cloud/bookworm/20260316-2418/debian-12-nocloud-amd64-20260316-2418.qcow2 && \
+    echo "661a11d853616ba72913ace404961a28350c58eb4041edd2c847aec932d5b99b debian.qcow2" | sha256sum --check
+
+COPY challenge.service flagger.py ipset.save iptables.save .
+
+RUN virt-customize -a debian.qcow2 \
+    --update \
+    --install iptables \
+    --install ipset \
+    --upload iptables.save:/iptables.save \
+    --upload ipset.save:/ipset.save \
+    --upload challenge.service:/etc/systemd/system/challenge.service \
+    --upload flagger.py:/flagger.py \
+    --run-command 'systemctl daemon-reload && systemctl enable challenge.service' \
+    --run-command 'rm -rf /var/lib/apt/lists/*'
+
+FROM debian:bookworm-slim
+
+RUN  \
+    --mount=type=cache,target=/var/cache/apt,sharing=locked \
+    --mount=type=cache,target=/var/lib/apt,sharing=locked \
+    apt-get update && apt-get install -y --no-install-recommends \
+    qemu-system-x86 qemu-utils qemu-kvm \
+    && rm -rf /var/lib/apt/lists/*
+
+
+COPY --from=builder /build/debian.qcow2 /vm/
+
+COPY flag.txt /vm/
+COPY entrypoint.sh /entrypoint.sh
+
+RUN chmod +x /entrypoint.sh
+CMD ["/entrypoint.sh"]

2026/cscg/misc/table-madness/service-target/challenge.service

@@ -0,0 +1,17 @@
+[Unit]
+Description=Challenge
+After=network.target
+Wants=network.target
+
+[Service]
+Type=simple
+ExecStartPre=/usr/sbin/iptables --flush
+ExecStartPre=/usr/sbin/ipset destroy
+ExecStartPre=/usr/sbin/ipset restore -f /ipset.save
+ExecStartPre=/usr/sbin/iptables-restore /iptables.save
+ExecStart=/usr/bin/python3 /flagger.py
+Restart=on-failure
+RestartSec=5s
+
+[Install]
+WantedBy=multi-user.target

2026/cscg/misc/table-madness/service-target/entrypoint.sh

@@ -0,0 +1,14 @@
+#!/bin/bash
+qemu-system-x86_64 \
+    -drive file=/vm/debian.qcow2,format=qcow2 \
+    -drive file=/vm/flag.txt,format=raw,if=virtio \
+    -m 1G \
+    -smp 4 \
+    -enable-kvm \
+    -nographic \
+    -display none \
+    -monitor none \
+    -snapshot \
+    -serial null \
+    -netdev socket,id=net0,listen=:5555 \
+    -device e1000,netdev=net0,mac=52:54:00:DD:EE:FF \

2026/cscg/misc/table-madness/service-target/flag.txt

@@ -0,0 +1 @@
+CSCG{dummy}

2026/cscg/misc/table-madness/service-target/flagger.py

@@ -0,0 +1,23 @@
+import socket
+import os
+
+PORT = 1337
+
+os.system("""
+IFACE=$(ip -o link | grep -i 52:54:00:DD:EE:FF | cut -d':' -f2 | xargs);
+ip addr add 192.168.100.2/24 dev "$IFACE";
+ip link set "$IFACE" up);
+""")
+
+os.system("dd if=/dev/vda of=/flag")
+FLAG = open("/flag", "rb").read()
+
+s = socket.socket()
+s.bind(("0.0.0.0", PORT))
+s.listen(1)
+
+while True:
+    c, _ = s.accept()
+    c.send(FLAG)
+    c.close()
+