ctf-tools Documentation

ctf-tools

This is a Nix flake packaging various security research tools.
Of course, this isn't a hard problem, but it's really nice to have them in one place that's easily deployable to new machines and so forth.
The packages are checked every once in a while, so things should hopefully have a decent chance of working!

The following tools are included. The first table lists tools packaged in this repo (under nix/pkgs/); the second lists tools taken from nixpkgs.

NIX?????? Copy Chapter

Long-time ctf-tools users might be surprised by this development, but it is a good development.
Nix provides isolated packaging and can be deployed into a dev/hack environment, locally into a user's home directory, or globally system/container-wide.
It also happily installs alongside your normal OS and package manager (e.g., ubuntu and apt) with zero interference.
Trust me, I was as skeptical as you are for years, but it is the way.

Packaged in this repo Copy Section

From nixpkgs Copy Section

Usage Copy Chapter

Every tool is a flake output. To use, do:

# install a tool into your Nix profile
nix profile install github:zardus/ctf-tools#gdb

# run a tool without installing it
nix run github:zardus/ctf-tools#ropper

# run a shell with a tool in it
nix shell github:zardus/ctf-tools#ropper

# list every available tool
nix flake show github:zardus/ctf-tools

A bin/manage-tools wrapper around nix profile is also provided, for the familiar CLI:

# (once) configure Nix + the binary cache
/path/to/ctf-tools/bin/manage-tools setup

manage-tools list                 # list the available tools
manage-tools install pwntools
manage-tools uninstall gdb
manage-tools search preload

Tools install into your Nix profile, and uninstalling removes them cleanly.

Cross-compiler toolchains (`cross2`, `crosstool`) Copy Section

Two of the tools are toolchain builders rather than single programs, so they
expose one output per target instead of one output overall. Install only the
target you need — each is an independent package.

crosstool is the crosstool-NG ct-ng
driver, and only the driver — unlike the old shell tool, it puts no cross
compilers on your PATH. Installing crosstool gives you ct-ng itself, ready
to build your own toolchain from a config:

nix profile install github:zardus/ctf-tools#crosstool
ct-ng list-samples

The compilers themselves are separate outputs: 77 of crosstool-NG's 146 samples
are prebuilt as crosstool-ng-<sample>, so you can install a ready-made
toolchain (say, arm-none-eabi-gcc) instead of spending an hour building one:

# a bare-metal ARM toolchain: arm-none-eabi-gcc, -gdb, -objdump, ...
nix profile install github:zardus/ctf-tools#crosstool-ng-arm-none-eabi

# a full Linux/glibc cross toolchain, with sysroot
nix profile install github:zardus/ctf-tools#crosstool-ng-aarch64-unknown-linux-musl

# see all of them (bare-metal newlib/picolibc plus Linux
# glibc/uClibc/musl, and the mingw-w64 Windows targets)
nix flake show github:zardus/ctf-tools | grep crosstool-ng-

The sample name is the crosstool-NG sample id with any character outside
[a-zA-Z0-9_-] replaced by - (so x86_64-ubuntu16.04-linux-gnu becomes
crosstool-ng-x86_64-ubuntu16-04-linux-gnu).

The other 69 samples that ct-ng list-samples prints have no
crosstool-ng-* output — build them yourself with ct-ng <sample> && ct-ng build, or pin one as a flake output by running
nix/pkgs/crosstool/pin-samples.sh and folding the hash it prints into
nix/pkgs/crosstool/hashes.nix (anything in there is surfaced automatically).

cross2 is the companion toolchain set for the
kozos.jp assembly book — binutils 2.21.1 +
gcc 3.4.6 + newlib 1.20.0 (+ gdb 7.3.1 where it still builds, or just its CPU
simulator, <target>-run, where it does not), for 34
mostly-retro bare-metal targets. Installing cross2 gives you the book's six
"major architecture" toolchains (arm, h8300, i386, mips, powerpc, sh); the other
targets are individual cross2-<target> outputs:

# the major-architecture bundle
nix profile install github:zardus/ctf-tools#cross2

# or just one target, e.g. mmix or vax
nix profile install github:zardus/ctf-tools#cross2-mmix-elf
nix profile install github:zardus/ctf-tools#cross2-vax-netbsdelf

These are large, from-source gcc builds, so install them with the binary
cache configured — otherwise Nix will build the whole toolchain
locally (tens of minutes to hours each).

Help! Copy Chapter

Something not working?
I didn't write (almost) any of these tools, but hit up the discord if you're desperate.
Maybe some kind soul will help!

Binary cache Copy Chapter

CI builds the tools packaged in this repo and pushes them to a public Cachix cache, so installs download prebuilt binaries instead of compiling.
Trusted Nix users pick this up automatically from the flake's nixConfig; otherwise run cachix use ctftools once (or pass --accept-flake-config).

Dockerized Tools Copy Chapter

You can get the tools packaged in this repo in prebuilt containers from dockerhub.
For example:

$ echo hi | docker run -i ctftools/taintgrind taintgrind --taint-stdin=yes /bin/cat

The images are generated by CI, which installs the tool into a nixos/nix base with nix profile install.

Adding Tools Copy Chapter

To add a tool (say, named toolname):

1. If it is already in nixpkgs, add a line to nix/passthrough.nix.
2. Otherwise, create nix/pkgs/toolname/default.nix — a callPackage-style derivation with its sources pinned by hash — and build it with nix build .#toolname.
3. Add it to the README.

The flake discovers nix/pkgs/* automatically; the output name is the directory name.

License Copy Chapter

The individual tools are all licensed under their own licenses.
As for ctf-tools itself, it is licensed under BSD 2-Clause License.
If you find it useful, star it on GitHub (https://github.com/zardus/ctf-tools).

Good luck!

See Also

There's a curated list of CTF tools, but without installers, here: https://github.com/apsdehal/aWEsoMe-cTf.

There's a Vagrant config with a lot of the bigger frameworks here: https://github.com/thebarbershopper/epictreasure.

Useful CTF tools in apt repos Copy Chapter

As tools get officially packaged, we switch to just suggesting that you apt install them!

Useful CTF tools in docker images Copy Chapter

Previously, this repository included some scripts that were wrappers around docker pull.
We trust that you can do that yourself :-)

Useful CTF Libraries Copy Chapter

Previously, this repository included library installers.
Because of how bespoke library install preferences are (e.g., unlike a tool, it's not clear if per-library venvs are a desired thing), we've stopped shipping them, and link them here for posterity.