Redesign challenges for unique skills; fix hints, docs and test tooling

[madebygps]

Summary

Reviews the challenge catalogue for real skills, correct setup, accurate docs/hints, and no bad practices. Each challenge now teaches one distinct skill and tool.

Docs and hints

• Fixed inaccurate hints and README rows for ch2, 5, 10 and 12.
• Rewrote hints (verify/src/verify/commands.py) and README rows for every changed challenge.

Challenge changes

• 3: 5 MB auth log with one odd Accepted line to find among 50,000 Failed lines
• 4: flag in a service account's GECOS field
• 5: chmod a mode-000 key pointed to by a world-writable config
• 8: real SSH key auth as vault (password login disabled, flag printed by ForceCommand)
• 9: custom search domain via resolved.conf.d, resolve host with getent hosts
• 11: fix both the nginx listen port and the typo'd root
• 12: no more hex leak via logs
• 13: cron job writes the flag to a status log from a root-only file
• 14: flag loaded through EnvironmentFile=, no longer in systemctl show/cat
• 15: nested gz, bz2, xz archives (installs bzip2 and xz-utils)
• 16: three-link chain; the flag is the final filename, not file contents
• 17: flag hidden in a 400-line shell history
• 18: flag is the ext4 volume label (blkid/e2label)

Test tooling

• The solver in .github/skills/ctf-testing/ covers the new challenges.
• deploy_and_test.sh: after an AWS stop/start the public IP changes, so it now asks EC2 for the new one.
• test_ctf_challenges.sh: sync before reboot (GCP hard-resets and its root fs uses commit=30, which lost the reboot marker; reproduced 3/3 without sync, 0/3 with it). The ch9 solver also no longer matches Azure's own internal.cloudapp.net domain.

Testing

Full deploy_and_test.sh <provider> --with-reboot passes on AWS, GCP and Azure (28 solver checks + 6 post-reboot checks, 0 failures each), all run against the final test scripts.
Also verified by hand on a live AWS VM as ctf_user: ch8 password login is rejected, and the old shortcuts (cat, systemctl show/cat, /proc/PID/environ, grep -a on the ch15 archive) no longer expose flags. Broad grep -r 'CTF{' can still find some plain-text flags; that is accepted.

Notes

• Removed the inbound port 8083 rules from the three main.tf files. The nginx listener on 8083 in ch11 is only reached from the VM, so nothing needs it exposed. Full test with reboot re-run on all three clouds afterwards: PASS.
• A hard reset within 30 s of a solve can lose a learner's progress on GCP (commit=30). Not addressed here.

[madebygps]

Follow-up from the challenge setup review: commit 9ea3e65 adds the agreed cleanup.

• Fails clearly when challenge 11 cannot find exactly one expected original or already-modified nginx directive, instead of silently skipping replacements.
• Clarifies challenge 13 wording so it matches the persistent cron output.
• Centralizes final ctf_challenges ownership after all challenge setup modules run, removing the unrelated dependency from challenge 18.
• Assigns ownership directly to challenge 17’s generated history file instead of recursively changing the entire old_admin home directory.

[madebygps]

Pushed 53bd408 with a round of review changes.

Consistency

• Challenge titles now match everywhere (README, verify names, both certificate lists, test script). The README table is the source of truth.
• Every setup/challenges/chNN_*.py has a module docstring: title, learner goal, skills tested, what it plants. No solving commands.
• README Skills column is concept-only for all 18 rows.
• AGENTS.md documents these standards so future challenges follow them.

Hints

• All 18 hints rewritten as nudges. They point at a concept or a man page, not the exact tool, field, path or flag.

Challenge changes

• ch11: writes the full broken nginx config directly instead of patching the default one with replace_once.
• ch16: five-link chain with a relative ../ hop, plus decoy links to a fake flag. README now says where to start.
• ch17: three users have histories, each with decoy secrets. The flag moved from an export line to a curl header. README and hint updated.
• ch18: hint no longer gives the location or names the label. The test now reads the label without sudo, which is the real learner path.

Testing

• Basic run: 28 passed, 0 failed on GCP and Azure. Ch16, 17 and 18 solve on both. Cleanup confirmed.
• Not run: AWS (credentials expired) and --with-reboot.

[madebygps]

Draft social post

We just shipped an update to our Linux CTF.

Want to get hands on with a Linux lab that will test your skills in under 9 minutes of setup? That's the longest deploy we've seen.

You SSH into a real cloud VM and work through 18 challenges using nothing but the command line. On average, the VM is ready in about:

• AWS: 1.5 minutes
• Azure: 2.5 minutes
• GCP: 6.5 minutes

Want to test your skills on real sysadmin tasks?

• Track down a hidden file or a secret buried in a log, the kind of job find and grep were made for
• Fix a permissions problem with chmod and get into a locked-down service over ssh
• Work out what a service is doing with systemctl and journalctl
• Dig through nested archives with tar
• Chase a DNS oddity and watch traffic on the wire

Free, runs on AWS, Azure or GCP, and you finish with a completion certificate.

Think you can find every flag?
https://github.com/learntocloud/linux-ctfs

#Linux #CTF #CloudComputing #LearnToCode #DevOps