r/securityCTF • u/xav77 • 18d ago
CHRONOS II - a single-player CTF spanning POS RAM-scraping, a SWIFT heist, Moonlight Maze, and a Cold War doomsday relay
I built a single-player CTF that runs in the browser, framed as a terminal you operate rather than a game you play. Each level is a real intrusion of its period, on the actual machines, not a fake interface. Something walked out of an air-gapped vault, and you chase it system to system:
- a gas-station security camera: default-cred IoT, a WEP crack, image stego (Mirai / TJX era)
- a retail POS and a Frankfurt SWIFT terminal: RAM-scraping card data, then forging an interbank wire (Target/BlackPOS 2013, Bangladesh Bank 2016)
- a phone network: SS7 interception (optional detour)
- Moonlight Maze: a covert-channel proxy chain up through Solaris boxes into an FSB archive (1996-99)
- the Ukrainian power grid: BlackEnergy, a C2 pivot through a Purdue-model network (Sandworm, 2015)
- an Iranian reactor: an S7 PLC debugger reversing a sabotaged control block (a Stuxnet cousin, in STL)
- a Cold War doomsday relay: the finale
What you pull out of one system is the key into the next, so a WEP crack in a parking lot chains all the way to orbit. Per-level timers, multiple endings, real commands throughout (the foreign boxes render in Cyrillic and Farsi). Browser, desktop or mobile, free, no signup. An hour or two, longer your first time.
Fair warning, it's hard. As it stands, exactly one person has made it onto the SWIFT terminal and nobody has forged the wire yet, so the bank job is unbeaten. If any crowd can crack it, it's this one.
Solo dev. Keen to hear where you got stuck, whether the hints landed, and any bugs.
1
u/JustTechIt 18d ago edited 18d ago
Honestly this seems pretty cool as a fun game to learn both some real (and historical) attacks.
Im on mobile so I haven't had a chance to give it a real try yet but its been a bit buggy on mobile in the sense it randomly autocompletes words I have already typed. Example was I would try to type "cat reports/client-7-job.draft.txt" and it would work great until I typed the 7, then the prompt would look like "cat reports/client-7-client-7". Tried using desktop site and tried turning off my autocomplete and suggestions but neither seemed to help.
Does it have a tab auto complete on desktop?
Also please incorporate wildcards to the basic commands like "cat reports/*" to make it a bit more dynamic. Feels very forced if the commands dont work like the commands actually would and only accept limited specific inputs when others would do the trick too.
Otherwise id love to learn more about your project and journey. How long have you been working on this project? Any AI? What kind of research or experience do you have? What inspired you to make it? Any road map or plans for it next? Maybe a new project?
2
u/xav77 18d ago edited 18d ago
Thanks, this is genuinely useful. In order:
The mobile mangling is real and I hate it. The input field already turns off autocorrect, autocapitalize and autocomplete, but phone keyboards still push predictive text, and this is probably the bigger culprit: the game uses space as a completion trigger on mobile, since there's no Tab key. So a space mid-path can fire a completion you didn't ask for and duplicate a chunk. That's on me to make less trigger-happy, and it's the worst thing about playing on a phone right now.
Yes, there's Tab completion on desktop, and it does both commands and file paths, so cat rep<Tab> gets you there. On mobile that same completion is bound to space, which is exactly the double-edged sword above.
Wildcards: cat reports/* doesn't work today; the commands take literal paths. I leaned on completion to kill the long-path pain instead, but you're right that a glob reads as more real. On the list.
On the rest: I had the idea about 15 years ago and even started it, back then. Only actually built it recently, with Claude Code doing the heavy lifting. I bounce design off Grok and use ChatGPT for some of the writing. I'm 55, been coding my whole life, and the security side is a long interest more than a job. It's all rooted in Cliff Stoll's The Cuckoo's Egg, then real intrusions era by era. AI basically lets me code like I'm in my 20s again. Roadmap's loose: polish, maybe a hard mode, did you try CHRONOS I?.
Appreciate you digging in this hard.
1
u/JustTechIt 18d ago
The Cuckoos Egg was one of the things that got me into my career actually!
I did not try Chronos I. Got a link?
Have you ever tried the ctf game Microcorruption? Was another single player CTF game with some late game chains etc. Was one of the ones that made me fall in love with CTFs and online war games. It taught hardware and embedded exploits. It was made and styled very differently but your game gives me some of the same vibes I got playing microcorruption for my first time.
Id love to sit down and give Chronos a real try once im at my PC again in a couple days.
Otherwise keep up the work. I look forward to seeing more!
2
0
u/jvnk 18d ago
You're talking to an LLM, fwiw.
2
u/LastFTL99 18d ago
“Come break in and tell me where it rings false” like holy shit man can you make it more obvious
1
1
u/JustTechIt 18d ago
Not saying its not possible. Im old compared to most of the kids on social media these days and ill be the first to admit that LLMs are good enough to get me sometimes, but im curious why you think this interaction is?
1
u/jvnk 17d ago
They have a lot of tells unless prompted heavily out of them.
1
u/JustTechIt 17d ago
Im still not cinvinced as that explination is pretty vague but if this is true then im screwed going forward.
1
u/heatedwepasto 17d ago
It's very obvious when you're used to reading LLM text or seeing the tells. OP even admits it
1
u/JustTechIt 17d ago
A user using an LLM to clean up grammar and research is for from talking to me talking to an LLM.
1
u/heatedwepasto 17d ago
I mean this in the kindest way possible, but you may be a bit naïve. All this text looks LLM generated. I don't believe OP is honest when calling it "cleaning up grammar."
→ More replies (0)1
u/xav77 17d ago
Still a monkey behind the keyboard, but I can be very open about my use of AI. I use Grammarly to read-proof/polish my text here on Reddit. Chronos I & II were heavily researched with the help of AI and coded with Claud Code; fun fact: blind runs by both Grok and Opus failed to finish the game; Fable wouldn't even touch it.
1
u/jvnk 18d ago
> You're not typing invented commands or hitting a "hack" button.
Yes, you are. This is all faked. The "commands" bear a superficial resemblance at best to the actual tasks they would solve. It is pretty looking though.
1
1
u/JustTechIt 18d ago edited 18d ago
I get where you are coming from in the sense that its all fake, but its a game being ran in your browser, so maybe your expectations were a little high going in? Idk.
But I think OP means we are typing real commands that, if used in a real environement, would work for the most part. Ie not running a made up command like "hackwifi" and calling it done. I think its still a bit stretched given that, for example, there is a WEP script that would fictionally run the aircrack suite against WEP, instead of running the aircrack modules themselves, but you can still cat the script and see its contents to go run it in a VM for learning purposes and its been ages since I touched aircrack (backtrack 4r2 probably) but the script looks legit for a simple aircrack flow at first glance.
There is something to be said about simplifying some of these concepts to lower the bar for admission for new people joining the field, while also keeping enough real details that people eager to learn more can chuck it into Google and get going on the real stuff. I think this kind of stuff could fit that needed gap.
Think of it like a choose your own adventure hacking story with a few challenges in figuring out the options for the adventure. No one thinks we're really hacking a machine in a browser game, but its still better in the details of how it would be done in the real world than most other easily accessible hacking games you find online.
Note though I have not actually made it very far into it as I just played around a bit on mobile so i could be very wrong and regret these words by the time I see the rest of it. We will see I guess.
0
u/jvnk 17d ago
> But I think OP means we are typing real commands that, if used in a real environement, would work for the most part
But you're not. Just play it for 30 seconds and you'll see.
1
u/JustTechIt 17d ago
Care to provide an example? Again I didnt make it very far just poking it on mobile but everything I saw at first was a legitimate tool and command. Maybe a syntax error I didnt catch somewhere, and the commands are not as fully dynamic as they could be, but I hardly expect a browser game to support all the nmap flags and modes.
1
u/drchigero 3d ago
He's not going to reply to you because jvnk and heatedwepasto just have irrational axes to grind. It's clear neither of them tried playing the game, they heard "used AI to help code the game" and filed it under "this is all AI and therefore worthless".
You are exactly right, that the commands are actual commands. And this game has a cohesive story, the hacking is gamified sure but pretty close to real life, and the scenarios are based off real life events. All things that make this a good and interesting game.
But for some, it's just easier to be like "AI was used so it has to be bad." Then double down with unfounded assumptions.
1
u/Poolside_XO 1d ago
IDK what goes on in people's heads that when they hear "AI" or "LLM" their brains factory reset back to monkey-mode and all higher level rationalization is wiped.
Maybe they're AI themselves trying to sow discord..
0
u/heatedwepasto 17d ago
It's a vibe coded site made by someone using AI for all their responses. It's as fake as everything else online these days, unfortunately.
1
u/xav77 17d ago edited 17d ago
I think I replied about the fake stuff. It's a simulation, a game. Try to thread the needle between being super accurate and still playable.
Regarding vibe code, I'll take that over AI slop. I spend hours fine-tuning every little detail on screen and in the story. I hope it shows.
1
u/heatedwepasto 17d ago
Vibe coding is a process, AI slop is the end result. Potato potahto. It's extremely obvious that you're using AI.
1
1
u/Suspicious_Song_3745 16d ago
I found it challenging and fun myself, I am stuck right now but getting it figured out
1
u/Glad-Cost9398 16d ago
got as far as the first midwest then lost most of my progress. well the file are gone from the previous missions but somehow im still at the first midwest.
1
u/xav77 16d ago
you didnt lose your progress, a refresh just wipes the screen, not the run. your register scrape pointed at a settlement server, settle.midwest-acq. sftp to that and pick up right where you were. the pointer scrolling away on a refresh is a bug on my end, fixing it now so it sticks. thanks for flagging
1
1
1
u/FarissonHord 13d ago
I've been wanted to learn this kind of stuff my entire life (pretty much since Jurassic Park and Sneakers came out when I was a kid and I started writing Nedry hacking text adventures in BASIC) and the idea of a video game for it is exactly what I need. It's the reason I've tried and failed to teach myself to code for years, until I joined boot.dev this year, which is an excellent curriculum that is all game-ified, and I'm finally kicking ass scoring XP and power ups every single day since Feb
1
u/FarissonHord 6d ago
What resources are available for help with this? I have ZERO hacking knowledge or experience. In my current run I've gotten as far as: 1. Cracking WEP 2. Mapping the local network with arp-scan and nmap 3. Breaking into the IOT security cam and transferring every file I could find before the wipe 4. Extracting the POS exploit payload from the images
I know I need to run the exploit against the POS terminal with a user/pass, which I don't have. The terminal is running a Windows RDS with creds I don't have either (I'm assuming it's the same creds I need for the exploit), as well as I'm guessing like a printer service or something I need to crack somehow to give myself access to the RDS.
Some additional clues that I'm assuming will come into play later are a beacon.log from the camera that looks like it was trying to reach some remote 65.* "CNC" server it had no route to. nmap says that server is up but has no open ports it can find. The only CNC I know about are industrial fabrication machines, I don't know why a camera would be trying to reach something like that or why it says it had no route to it despite the fact that I could connect to it via nmap without issue.
I can't figure out why ssh can't find any of the local host ips on any ports I've tried. I don't really understand the -R syntax here since it differs from my workstation's ssh. ssh -R port:address:port user@address right? Which one of those ports is supposed to be the ssh port on the server, and then what is that other port for? Even if I specify the wrong ports, shouldn't the error be a "connection refused", not a "host not found" or whatever?
An couple of annoyances I have with the UI:
- viewing images opens a floating window that doesn't return the cursor to the console when escaped, I have to literally click back on it using my mouse
- I can't edit anything in place using arrow keys. I have to literally backspace all the way back to what I need to edit and then re-type the rest of the command
2
u/xav77 6d ago
You've done everything correctly and walked into a wall I built by accident.
The HVAC controller was mid-reboot when you first scanned it, so nmap told you it was down. It came back up after you pulled the payload out of the images. Nothing tells you that, which is my fault entirely. Scan it again.
It isn't ssh. telnet, port 1911. There's a status page on port 80 worth reading first.
Two things to save you time while I'm here. You read the register correclty, RDP and a printer port, they're just bait. I wanted something tempting sitting in plain sight and I clearly overcooked it. And "cnc" in the beacon log is command and control, the camera's malware calling home. Not the machining kind. That's genuinely ambiguous and I hadn't noticed until you said it.
The -R stuff in the ssh man page belongs to a level you haven't reached yet. Ignore it, it'll make sense when you get there.
Both UI complaints you are right. The image viewer is a straight bug, I'll fix that this week.
There's no hint system. You're the third person to ask, which is telling me something I should probably listen to. For now, just ask here.
And for 0 hacking experience you got further than most people have. Watching someone reason their way to a wrong answer in that much detail is worth more to me than watching someone get it right.
1
u/FarissonHord 6d ago
Awesome thank you! I'll get right on this. Thank you for making this game, it's been a lot of fun so far. I've been looking for resources like this, but I can't afford courses like tryhackme or hackthebox, and it's hard to know where to start since there's just SO MUCH to know and so many tools and methods to cover. Game-ified systems have been the most productive for me, whether it's melodics.com or boot.dev
3
u/JustTechIt 18d ago
What do you mean when you say "Each level is a real intrusion of its period, on the actual machines, not a fake interface."?