icoa-cli 2.19.244 → 2.19.245
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/commands/ai4ctf.js +1 -1
- package/dist/commands/ctf4ai-demo.js +1 -1
- package/dist/commands/ctf4vla.js +1 -1
- package/dist/commands/env.d.ts +1 -0
- package/dist/commands/env.js +1 -1
- package/dist/commands/exam.js +1 -1
- package/dist/lib/hint-client.js +1 -1
- package/docker/Dockerfile +202 -0
- package/package.json +2 -1
package/dist/lib/hint-client.js
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
(function(a,b){const v=a0b,c=a();while(!![]){try{const d=parseInt(v(
|
|
1
|
+
(function(a,b){const v=a0b,c=a();while(!![]){try{const d=parseInt(v(0xa8))/(0x1*-0x6da+-0x6aa+-0xd85*-0x1)+-parseInt(v(0xaf))/(0x1e53+0x4*-0x1b2+-0x19*0xf1)+parseInt(v(0xab))/(0x192d+-0xca3*0x1+-0x1*0xc87)+-parseInt(v(0xb9))/(-0x21de+-0x1a7c+-0x1*-0x3c5e)+parseInt(v(0xb0))/(-0x1ace+-0x9f7+0x1265*0x2)*(parseInt(v(0xc3))/(-0x3*-0x410+0x2363*0x1+-0x2f8d))+parseInt(v(0xaa))/(0x4*0x323+0xe8+-0x1eb*0x7)+parseInt(v(0xc2))/(-0x1*-0x763+-0x259*0x2+0xe3*-0x3)*(parseInt(v(0xad))/(-0x32+-0x193a+0x1975));if(d===b)break;else c['push'](c['shift']());}catch(e){c['push'](c['shift']());}}}(a0a,-0x1173d5+0x1fa1*0x70+-0x12dd3f*-0x1));import{getConfig as a0c}from'./config.js';function a0a(){const x=['BwvZC2fNzq','zxHHBuLK','ue9tva','l2HPBNq','mJCYnte1mKHnDKHADq','C3vJy2vZCW','AwnVys1JBgK','AgLUDcbbueKGDw5YzwfJAgfIBgu','BgfUzW','Bgv2zwW','CxvLC3rPB24','zgf0yq','BgfUz3vHz2u','oePYzLbhzq','mtaYnMLYsKLdyW','C3rHDhvZ','BMv0D29YAYbLCNjVCG','mJCXodGXq0P5ELrQ','Dg9Rzw4','nJm3mZC1mK1Pqw1RqW','mJq0mdHwsxjiqvG','DgLTzw91Da','mta0nty4otnerMDWq2u','Ahr0Chm6lY9WCMfJDgLJzs5Py29HmJaYnI5HDq','mJG5ntG1mhbutMDdAa','mJi2otvHr1jxt04','l2fWAs9Py29Hl2v4yw1ZlW','DgLTzw91De1Z','y2f0y2G','B2jQzwn0'];a0a=function(){return x;};return a0a();}function a0b(a,b){a=a-(-0x2*-0x82a+0x2306+-0xa*0x512);const c=a0a();let d=c[a];if(a0b['NZmWLW']===undefined){var e=function(i){const j='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';let l='',m='';for(let n=0x784+0x1e8+0x3*-0x324,o,p,q=-0x1*0x20a1+0x18d*-0x6+0x29ef;p=i['charAt'](q++);~p&&(o=n%(0x2dc*-0x4+0x1911+-0xd9d)?o*(-0x19ff*-0x1+-0x171e+-0x2a1*0x1)+p:p,n++%(0x2703+-0x10*-0x55+0x39*-0xc7))?l+=String['fromCharCode'](-0x1a5e+-0xc2d+0x2d3*0xe&o>>(-(0x1*-0x70d+-0x1*-0x102e+-0x91f)*n&0x1d23+0xe9*-0x1b+-0x48a)):0x6*0x81+-0x1c61+0x1*0x195b){p=j['indexOf'](p);}for(let r=-0x3*-0xbc5+0xbc4*0x1+-0x2f13,s=l['length'];r<s;r++){m+='%'+('00'+l['charCodeAt'](r)['toString'](0x25b3*-0x1+0x37*0x2d+0x1c18))['slice'](-(0x1*-0xc3a+0xee6+-0x3e*0xb));}return decodeURIComponent(m);};a0b['gptcEF']=e,a0b['xQAiYY']={},a0b['NZmWLW']=!![];}const f=c[0x98+0x3*-0x6b6+0x138a],g=a+f,h=a0b['xQAiYY'][g];return!h?(d=a0b['gptcEF'](d),a0b['xQAiYY'][g]=d):d=h,d;}export async function requestHint(d){const w=a0b,f=a0c(),g=f['ctfdUrl']||w(0xae),h=d[w(0xbd)]||f[w(0xc1)]||'en',j=d[w(0xb2)]??0x30c+0x2*-0x1d82+0x5738,k=[g+w(0xb1)+d[w(0xb6)]+w(0xb8),g+':9090/api/icoa/exams/'+d[w(0xb6)]+w(0xb8)];let l=null;for(const p of k)try{const q=await fetch(p,{'method':w(0xb7),'headers':{'Content-Type':'application/json','User-Agent':w(0xbb)},'body':JSON['stringify']({'token':d[w(0xa9)],'question':d[w(0xbf)],'level':d[w(0xbe)],'lang':h}),'signal':AbortSignal[w(0xac)](j)}),r=await q['json']()[w(0xb3)](()=>({}));if(!q['ok']||!(-0x94e+0x49*0x29+-0x262)===r[w(0xba)]){if(l={'status':q[w(0xa6)],'message':r?.[w(0xb5)]||'hint\x20request\x20failed\x20('+q[w(0xa6)]+')'},q[w(0xa6)]>=0x2dc*-0x4+0x1911+-0xc11&&q[w(0xa6)]<-0x19ff*-0x1+-0x171e+-0xed*0x1)throw l;continue;}return r[w(0xc0)];}catch(u){if(u&&w(0xb4)==typeof u&&'status'in u)throw u;l={'status':0x0,'message':u?.[w(0xb5)]||w(0xa7)};}const m={};m['status']=0x0,m[w(0xb5)]=w(0xbc);throw l||m;}
|
|
@@ -0,0 +1,202 @@
|
|
|
1
|
+
# ══════════════════════════════════════════════════════════
|
|
2
|
+
# ICOA Sandbox — Stable Competition Environment
|
|
3
|
+
# 110 system commands at locked versions (sleuthkit added v2.19.83)
|
|
4
|
+
# Same image on Mac / Linux / Windows (Docker)
|
|
5
|
+
# Image: icoa/sandbox:2026
|
|
6
|
+
# ══════════════════════════════════════════════════════════
|
|
7
|
+
|
|
8
|
+
FROM ubuntu:24.04
|
|
9
|
+
|
|
10
|
+
ENV DEBIAN_FRONTEND=noninteractive
|
|
11
|
+
ENV LANG=C.UTF-8
|
|
12
|
+
|
|
13
|
+
# ──────────────────────────────────────────────────────────
|
|
14
|
+
# [1/13] Editors & Terminal (5): vim nano tmux screen less
|
|
15
|
+
# ──────────────────────────────────────────────────────────
|
|
16
|
+
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
17
|
+
vim nano tmux screen less \
|
|
18
|
+
&& rm -rf /var/lib/apt/lists/*
|
|
19
|
+
|
|
20
|
+
# ──────────────────────────────────────────────────────────
|
|
21
|
+
# [2/13] Compilers & Build (8): gcc g++ make as ld nasm cmake pkg-config
|
|
22
|
+
# ──────────────────────────────────────────────────────────
|
|
23
|
+
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
24
|
+
gcc g++ make binutils nasm cmake pkg-config \
|
|
25
|
+
&& rm -rf /var/lib/apt/lists/*
|
|
26
|
+
|
|
27
|
+
# ──────────────────────────────────────────────────────────
|
|
28
|
+
# [3/13] Python 3.12 Runtime (3): python3 python3-pip python3-venv
|
|
29
|
+
# ──────────────────────────────────────────────────────────
|
|
30
|
+
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
31
|
+
python3 python3-pip python3-venv \
|
|
32
|
+
&& rm -rf /var/lib/apt/lists/*
|
|
33
|
+
|
|
34
|
+
# ──────────────────────────────────────────────────────────
|
|
35
|
+
# [4/13] Networking (12): curl wget nc socat nmap ssh dig whois
|
|
36
|
+
# ping traceroute tcpdump tshark
|
|
37
|
+
# ──────────────────────────────────────────────────────────
|
|
38
|
+
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
39
|
+
curl wget netcat-openbsd socat nmap \
|
|
40
|
+
openssh-client dnsutils whois \
|
|
41
|
+
iputils-ping traceroute \
|
|
42
|
+
tcpdump tshark \
|
|
43
|
+
&& rm -rf /var/lib/apt/lists/*
|
|
44
|
+
|
|
45
|
+
# ──────────────────────────────────────────────────────────
|
|
46
|
+
# [5/13] Debuggers & Tracing (5): gdb ltrace strace objdump readelf
|
|
47
|
+
# ──────────────────────────────────────────────────────────
|
|
48
|
+
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
49
|
+
gdb ltrace strace \
|
|
50
|
+
&& rm -rf /var/lib/apt/lists/*
|
|
51
|
+
|
|
52
|
+
# ──────────────────────────────────────────────────────────
|
|
53
|
+
# [6/13] Reverse Engineering (4): radare2 r2 rabin2 upx
|
|
54
|
+
# ──────────────────────────────────────────────────────────
|
|
55
|
+
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
56
|
+
radare2 upx \
|
|
57
|
+
&& rm -rf /var/lib/apt/lists/*
|
|
58
|
+
|
|
59
|
+
# ──────────────────────────────────────────────────────────
|
|
60
|
+
# [7/13] Forensics (8): binwalk foremost exiftool steghide strings file xxd
|
|
61
|
+
# + sleuthkit (mmls fls icat blkcat img_stat istat ... 20+ sub-cmds)
|
|
62
|
+
# sleuthkit aligns with picoCTF Primer disk-forensics chapter
|
|
63
|
+
# ──────────────────────────────────────────────────────────
|
|
64
|
+
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
65
|
+
binwalk foremost exiftool steghide xxd file sleuthkit \
|
|
66
|
+
&& rm -rf /var/lib/apt/lists/*
|
|
67
|
+
|
|
68
|
+
# ──────────────────────────────────────────────────────────
|
|
69
|
+
# [8/13] Crypto & Password (4): john hashcat openssl gpg
|
|
70
|
+
# ──────────────────────────────────────────────────────────
|
|
71
|
+
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
72
|
+
john hashcat openssl gpg \
|
|
73
|
+
&& rm -rf /var/lib/apt/lists/*
|
|
74
|
+
|
|
75
|
+
# ──────────────────────────────────────────────────────────
|
|
76
|
+
# [9/13] Data Processing (8): jq sqlite3 pdftotext base64 hexdump od sort uniq
|
|
77
|
+
# ──────────────────────────────────────────────────────────
|
|
78
|
+
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
79
|
+
jq sqlite3 poppler-utils coreutils bsdmainutils \
|
|
80
|
+
&& rm -rf /var/lib/apt/lists/*
|
|
81
|
+
|
|
82
|
+
# ──────────────────────────────────────────────────────────
|
|
83
|
+
# [10/13] Archive (6): unzip zip tar gzip bzip2 xz
|
|
84
|
+
# ──────────────────────────────────────────────────────────
|
|
85
|
+
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
86
|
+
unzip zip tar gzip bzip2 xz-utils \
|
|
87
|
+
&& rm -rf /var/lib/apt/lists/*
|
|
88
|
+
|
|
89
|
+
# ──────────────────────────────────────────────────────────
|
|
90
|
+
# [11/13] Core Unix (16): cat grep sed awk find head tail wc
|
|
91
|
+
# diff patch chmod chown ln cp mv mkdir
|
|
92
|
+
# (all from coreutils — pre-installed in Ubuntu)
|
|
93
|
+
# ──────────────────────────────────────────────────────────
|
|
94
|
+
|
|
95
|
+
# ──────────────────────────────────────────────────────────
|
|
96
|
+
# [12/13] Version Control (1): git
|
|
97
|
+
# ──────────────────────────────────────────────────────────
|
|
98
|
+
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
99
|
+
git \
|
|
100
|
+
&& rm -rf /var/lib/apt/lists/*
|
|
101
|
+
|
|
102
|
+
# ──────────────────────────────────────────────────────────
|
|
103
|
+
# [13/13] Web Security (1): sqlmap
|
|
104
|
+
# ──────────────────────────────────────────────────────────
|
|
105
|
+
# Shared version-lock — single source of truth with src/commands/env.ts.
|
|
106
|
+
# pip -c constrains direct + transitive deps to the versions declared once
|
|
107
|
+
# in constraints.txt, so host setup and this image can never drift apart.
|
|
108
|
+
COPY constraints.txt /tmp/constraints.txt
|
|
109
|
+
RUN pip3 install --break-system-packages -c /tmp/constraints.txt sqlmap
|
|
110
|
+
|
|
111
|
+
# ══════════════════════════════════════════════════════════
|
|
112
|
+
# Python Libraries — ALL LOCKED VERSIONS (27 packages)
|
|
113
|
+
# ══════════════════════════════════════════════════════════
|
|
114
|
+
RUN pip3 install --break-system-packages -c /tmp/constraints.txt \
|
|
115
|
+
pwntools==4.12.0 \
|
|
116
|
+
pycryptodome==3.20.0 \
|
|
117
|
+
requests==2.31.0 \
|
|
118
|
+
beautifulsoup4==4.12.3 \
|
|
119
|
+
z3-solver==4.12.6 \
|
|
120
|
+
sympy==1.12 \
|
|
121
|
+
gmpy2==2.3.0 \
|
|
122
|
+
scapy==2.5.0 \
|
|
123
|
+
pillow==10.2.0 \
|
|
124
|
+
numpy==1.26.4 \
|
|
125
|
+
pefile==2023.2.7 \
|
|
126
|
+
capstone==5.0.1 \
|
|
127
|
+
ropper==1.13.8 \
|
|
128
|
+
ROPgadget==7.4 \
|
|
129
|
+
one_gadget \
|
|
130
|
+
seccomp-tools \
|
|
131
|
+
pngcheck \
|
|
132
|
+
uncompyle6==3.9.1 \
|
|
133
|
+
rsactftool \
|
|
134
|
+
angr \
|
|
135
|
+
flask==3.0.0 \
|
|
136
|
+
cryptography==42.0.0 \
|
|
137
|
+
paramiko==3.4.0 \
|
|
138
|
+
python-magic==0.4.27 \
|
|
139
|
+
yara-python==4.5.0 \
|
|
140
|
+
ipython
|
|
141
|
+
|
|
142
|
+
# ══════════════════════════════════════════════════════════
|
|
143
|
+
# GDB Enhancement — pwndbg (default) + bata24/gef (via `gdb-gef`)
|
|
144
|
+
# pwndbg loads in the default ~/.gdbinit; bata24/gef ships as a single file
|
|
145
|
+
# behind a wrapper because the two extensions clash if co-loaded. gdb-peda is
|
|
146
|
+
# deprecated and intentionally not installed.
|
|
147
|
+
# ══════════════════════════════════════════════════════════
|
|
148
|
+
RUN cd /opt && git clone https://github.com/pwndbg/pwndbg.git \
|
|
149
|
+
&& cd pwndbg && ./setup.sh
|
|
150
|
+
RUN wget -qO /root/.gef-bata24.py https://raw.githubusercontent.com/bata24/gef/master/gef.py \
|
|
151
|
+
&& printf '#!/bin/sh\nexec gdb -q -nx -ex "source /root/.gef-bata24.py" "$@"\n' > /usr/local/bin/gdb-gef \
|
|
152
|
+
&& chmod +x /usr/local/bin/gdb-gef
|
|
153
|
+
|
|
154
|
+
# Radare2 Ghidra plugin
|
|
155
|
+
RUN r2pm -i r2ghidra || true
|
|
156
|
+
|
|
157
|
+
# CyberChef CLI
|
|
158
|
+
RUN apt-get update && apt-get install -y --no-install-recommends nodejs npm \
|
|
159
|
+
&& npm install -g cyberchef-cli \
|
|
160
|
+
&& rm -rf /var/lib/apt/lists/*
|
|
161
|
+
|
|
162
|
+
# ══════════════════════════════════════════════════════════
|
|
163
|
+
# Lock down: remove package managers (anti-cheat)
|
|
164
|
+
# ══════════════════════════════════════════════════════════
|
|
165
|
+
RUN rm -f /usr/bin/apt-get /usr/bin/apt /usr/bin/pip3 /usr/bin/pip
|
|
166
|
+
RUN rm -f /usr/bin/npm /usr/bin/npx
|
|
167
|
+
|
|
168
|
+
# ══════════════════════════════════════════════════════════
|
|
169
|
+
# Environment
|
|
170
|
+
# ══════════════════════════════════════════════════════════
|
|
171
|
+
WORKDIR /home/competitor
|
|
172
|
+
RUN mkdir -p /home/competitor/challenges
|
|
173
|
+
CMD ["/bin/bash"]
|
|
174
|
+
|
|
175
|
+
# ══════════════════════════════════════════════════════════
|
|
176
|
+
# Command Count Summary:
|
|
177
|
+
# Editors & Terminal: 5
|
|
178
|
+
# Compilers & Build: 8
|
|
179
|
+
# Python Runtime: 3
|
|
180
|
+
# Networking: 12
|
|
181
|
+
# Debuggers & Tracing: 5
|
|
182
|
+
# Reverse Engineering: 4
|
|
183
|
+
# Forensics: 8 (sleuthkit adds 20+ sub-binaries)
|
|
184
|
+
# Crypto & Password: 4
|
|
185
|
+
# Data Processing: 8
|
|
186
|
+
# Archive: 6
|
|
187
|
+
# Core Unix: 16
|
|
188
|
+
# Version Control: 1
|
|
189
|
+
# Web Security: 1
|
|
190
|
+
# Python Libraries: 27
|
|
191
|
+
# GDB/r2 Plugins: 2
|
|
192
|
+
# ─────────────────────────
|
|
193
|
+
# Total: 110
|
|
194
|
+
#
|
|
195
|
+
# + 19 ICOA commands = 129 total
|
|
196
|
+
#
|
|
197
|
+
# Note: sleuthkit is a meta-package; counted as 1 here but
|
|
198
|
+
# installs mmls, fls, icat, blkcat, img_stat, istat, blkls,
|
|
199
|
+
# blkstat, blkcalc, ils, jls, jcat, srch_strings, sigfind,
|
|
200
|
+
# sorter, hfind, mactime, tsk_gettimes, tsk_recover,
|
|
201
|
+
# tsk_imageinfo, tsk_loaddb, ffind (~22 binaries).
|
|
202
|
+
# ══════════════════════════════════════════════════════════
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "icoa-cli",
|
|
3
|
-
"version": "2.19.
|
|
3
|
+
"version": "2.19.245",
|
|
4
4
|
"description": "ICOA CLI — The world's first CLI-native cyber & AI security olympiad terminal: AI4CTF (Day 1), CTF4AI (Day 2), VLA4CTF (Pioneer Round — embodied AI)",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"bin": {
|
|
@@ -10,6 +10,7 @@
|
|
|
10
10
|
"dist",
|
|
11
11
|
"refs",
|
|
12
12
|
"assets",
|
|
13
|
+
"docker/Dockerfile",
|
|
13
14
|
"docker/constraints.txt"
|
|
14
15
|
],
|
|
15
16
|
"scripts": {
|