Self hosting Capture-the-Flag with OWASP Juice Shop, MultiJuicer and CTFd on AWS EC2
![Craig Gray](/img/team/craig.webp)
Craig Gray
DevOps EngineerWe hosted a fully remote CTF event for our Engineering team using OWASP Juice Shop, multi-juicer and CTFd. The event was a fun way to raise awareness of offensive security across our team.
Amazon EC2 is one of the eight AWS services for use during penetration testing without prior approval, consequently we hosted our infrastructure using EC2 and Amazon EKS with EC2 node groups.
Overview
OWASP Juice Shop is a vulnerable web application used in security trainings and awareness demos. OWASP Juice Shop is not designed for multiple users. MultiJuicer extends Juice Shop allowing participants to sign up and launch Juice Shops. MultiJuicer runs on Kubernetes (K8s).
CTFd is a capture the flag (CTF) platform which includes a challenge list, flag submission and scoreboard.
juice-shop-ctf exports challenges from Juice Shop for import into CTF platforms including CTFd.
Stringing these tools together along with AWS EC2 and AWS Elastic Kubernetes Service, we operated a system which enabled engineers to self sign up for a Juice Shop instance, find flags and submit them to CTFd to gain points.
![System Architecture](/img/ctf-juice-shop-ctfd-aws/ctf.webp)
System Architecture
Setting Up
There is a comprehensive CTF hosting guide in the Juice Shop documentation, which details the required set up for a CTF event.
What follows is how we set up our event.
Juice Shop and MultiJuicer
The set up of MultiJuicer on EKS has been adapted from the MultiJuicer documentation. These steps put the Juice Shop in CTF mode. Use the official documentation for further clarification on these following steps.
1. Deploying the EKS Cluster with eksctl
Create an EKS Cluster and two t3.medium EC2 instances.
2. Deploying MultiJuicer
Create a custom values.yaml configuration to put Juice Shop in CTF mode. Download values.yaml and update it with the keys below. Add a random string for ctfKey.
Additional configuration options for CTF mode are available in ctf.yaml.
Use helm to deploy the custom values.yaml.
3. Add an ingress to expose the MultiJuicer
Create an IAM policy giving the EKS cluster access to manage the AWS ALB.
Attach the policy to the cluster by downloading cluster-iam.yaml and updating region and attachPolicyARNs with the region of the EKS deployment and the policy ARN from the previous command.
Create the ingress controller.
4. Optional: Apply External DNS to attach a CNAME to the load balancer
For a custom domain name on the load balancer apply External DNS.
5. Optional: Apply the Cluster Autoscaler to scale out the EC2 instances
To autoscale the cluster nodes, apply the Cluster Autoscaler or alternatively scale manually with with eksctl.
Scoreboard with CTFd
CTFd offers a deployment option with docker-compose. This is the simplest way to self host the scoreboard. The following CloudFormation template launches the scoreboard on port 80 in an isolated VPC. EC2 instance user data is used to start the scoreboard.
1. Deploy the scoreboard
Save the CloudFormation template as scoreboard.yaml.
Import Challenges to the Scoreboard
1. Create a Juice Shop
Access the MultiJuicer UI to create a Juice Shop instance. Use kubectl get ingress
to find the MultiJuicer UI endpoint.
2. Port forward to the instance
This port forward will be used to export challenges. Keep kubectl port-forward
running or put it into the background with &
.
3. Create a config.yml file for juice-shop-ctf to export challenges.
The CTF key should match the key set previously.
4. Export the challenges
5. Import the challenges into CTFd
- Browse to the CTFd UI and create an Admin user and a name for the CTF.
- Import the challenges under Admin > Config > Backup.
- Recreate the CTF via the UI and ensure challenges show up.
The event
The infrastructure was deployed just before 9am. It took around thirty minutes to provision the full stack. At 9am the unofficial start of the event was announced. To be conscious of our engineers' time, we left it to the individual to decide when they wanted to get stared.
![Kick Off!](/img/ctf-juice-shop-ctfd-aws/start.webp)
Kick Off!
The official start of the remote event was scheduled for 1pm, however it didn't take engineers long to jump in and start working through the challenges.
![Coffee making an early start](/img/ctf-juice-shop-ctfd-aws/coffee.webp)
Coffee making an early start
At 1pm, we jumped on video conferencing and went through the set up instructions, to get those who didn't start in the morning set up. Leaving the conference call open, engineers could discuss exploits they were working on and get ideas and help from the others. SQL injection (SQLi), Cross Site Scripting (XSS) and Remote Code Execution (RCE) came up as topics of discussion.
OWASP Juice Shop is a learning tool and solutions are available online. Penalties were swift for those who "accidentally" google the answer.
![Awarding those who Google answers](/img/ctf-juice-shop-ctfd-aws/google.webp)
Awarding those who Google answers
Heading into the final stages of event competition was fierce and eventually a winner emerged.
![Dan goes into orbit](/img/ctf-juice-shop-ctfd-aws/final_score.webp)
Dan goes into orbit ๐
In the final hour we regrouped for some knowledge sharing. Some of the difficult challenges were selected and Engineers presented the novel ways in which the exploitation had been performed.
Tearing it down
Deleting the Scoreboard
Deleting the Multi juicer
Learning
- Four hours was a good amount of time for the official event to run.
- Engineers were capable to address a wide variety of of issues in a relatively short amount of time.
- There was some lag in the system. I think the lag may have been on the Juice Balancer. Consider increasing the amount of CPU and Memory on the Juice Balancer and Juice Shop pods.
- The focus should be on understanding the issues, not on accruing points, precious points.
- Security is fun.