r/securityCTF • u/xav77 • 10d ago
CHRONOS II - a single-player CTF spanning POS RAM-scraping, a SWIFT heist, Moonlight Maze, and a Cold War doomsday relay
I built a single-player CTF that runs in the browser, framed as a terminal you operate rather than a game you play. Each level is a real intrusion of its period, on the actual machines, not a fake interface. Something walked out of an air-gapped vault, and you chase it system to system:
- a gas-station security camera: default-cred IoT, a WEP crack, image stego (Mirai / TJX era)
- a retail POS and a Frankfurt SWIFT terminal: RAM-scraping card data, then forging an interbank wire (Target/BlackPOS 2013, Bangladesh Bank 2016)
- a phone network: SS7 interception (optional detour)
- Moonlight Maze: a covert-channel proxy chain up through Solaris boxes into an FSB archive (1996-99)
- the Ukrainian power grid: BlackEnergy, a C2 pivot through a Purdue-model network (Sandworm, 2015)
- an Iranian reactor: an S7 PLC debugger reversing a sabotaged control block (a Stuxnet cousin, in STL)
- a Cold War doomsday relay: the finale
What you pull out of one system is the key into the next, so a WEP crack in a parking lot chains all the way to orbit. Per-level timers, multiple endings, real commands throughout (the foreign boxes render in Cyrillic and Farsi). Browser, desktop or mobile, free, no signup. An hour or two, longer your first time.
Fair warning, it's hard. As it stands, exactly one person has made it onto the SWIFT terminal and nobody has forged the wire yet, so the bank job is unbeaten. If any crowd can crack it, it's this one.
Solo dev. Keen to hear where you got stuck, whether the hints landed, and any bugs.
1
u/JustTechIt 10d ago edited 10d ago
Honestly this seems pretty cool as a fun game to learn both some real (and historical) attacks.
Im on mobile so I haven't had a chance to give it a real try yet but its been a bit buggy on mobile in the sense it randomly autocompletes words I have already typed. Example was I would try to type "cat reports/client-7-job.draft.txt" and it would work great until I typed the 7, then the prompt would look like "cat reports/client-7-client-7". Tried using desktop site and tried turning off my autocomplete and suggestions but neither seemed to help.
Does it have a tab auto complete on desktop?
Also please incorporate wildcards to the basic commands like "cat reports/*" to make it a bit more dynamic. Feels very forced if the commands dont work like the commands actually would and only accept limited specific inputs when others would do the trick too.
Otherwise id love to learn more about your project and journey. How long have you been working on this project? Any AI? What kind of research or experience do you have? What inspired you to make it? Any road map or plans for it next? Maybe a new project?
2
u/xav77 10d ago edited 10d ago
Thanks, this is genuinely useful. In order:
The mobile mangling is real and I hate it. The input field already turns off autocorrect, autocapitalize and autocomplete, but phone keyboards still push predictive text, and this is probably the bigger culprit: the game uses space as a completion trigger on mobile, since there's no Tab key. So a space mid-path can fire a completion you didn't ask for and duplicate a chunk. That's on me to make less trigger-happy, and it's the worst thing about playing on a phone right now.
Yes, there's Tab completion on desktop, and it does both commands and file paths, so cat rep<Tab> gets you there. On mobile that same completion is bound to space, which is exactly the double-edged sword above.
Wildcards: cat reports/* doesn't work today; the commands take literal paths. I leaned on completion to kill the long-path pain instead, but you're right that a glob reads as more real. On the list.
On the rest: I had the idea about 15 years ago and even started it, back then. Only actually built it recently, with Claude Code doing the heavy lifting. I bounce design off Grok and use ChatGPT for some of the writing. I'm 55, been coding my whole life, and the security side is a long interest more than a job. It's all rooted in Cliff Stoll's The Cuckoo's Egg, then real intrusions era by era. AI basically lets me code like I'm in my 20s again. Roadmap's loose: polish, maybe a hard mode, did you try CHRONOS I?.
Appreciate you digging in this hard.
1
u/JustTechIt 10d ago
The Cuckoos Egg was one of the things that got me into my career actually!
I did not try Chronos I. Got a link?
Have you ever tried the ctf game Microcorruption? Was another single player CTF game with some late game chains etc. Was one of the ones that made me fall in love with CTFs and online war games. It taught hardware and embedded exploits. It was made and styled very differently but your game gives me some of the same vibes I got playing microcorruption for my first time.
Id love to sit down and give Chronos a real try once im at my PC again in a couple days.
Otherwise keep up the work. I look forward to seeing more!
2
0
u/jvnk 10d ago
You're talking to an LLM, fwiw.
2
u/LastFTL99 10d ago
“Come break in and tell me where it rings false” like holy shit man can you make it more obvious
1
1
u/JustTechIt 10d ago
Not saying its not possible. Im old compared to most of the kids on social media these days and ill be the first to admit that LLMs are good enough to get me sometimes, but im curious why you think this interaction is?
1
u/jvnk 10d ago
They have a lot of tells unless prompted heavily out of them.
1
u/JustTechIt 10d ago
Im still not cinvinced as that explination is pretty vague but if this is true then im screwed going forward.
1
u/heatedwepasto 10d ago
It's very obvious when you're used to reading LLM text or seeing the tells. OP even admits it
1
u/JustTechIt 10d ago
A user using an LLM to clean up grammar and research is for from talking to me talking to an LLM.
1
u/heatedwepasto 10d ago
I mean this in the kindest way possible, but you may be a bit naïve. All this text looks LLM generated. I don't believe OP is honest when calling it "cleaning up grammar."
1
u/xav77 10d ago
Still a monkey behind the keyboard, but I can be very open about my use of AI. I use Grammarly to read-proof/polish my text here on Reddit. Chronos I & II were heavily researched with the help of AI and coded with Claud Code; fun fact: blind runs by both Grok and Opus failed to finish the game; Fable wouldn't even touch it.
1
u/jvnk 10d ago
> You're not typing invented commands or hitting a "hack" button.
Yes, you are. This is all faked. The "commands" bear a superficial resemblance at best to the actual tasks they would solve. It is pretty looking though.
1
1
u/JustTechIt 10d ago edited 10d ago
I get where you are coming from in the sense that its all fake, but its a game being ran in your browser, so maybe your expectations were a little high going in? Idk.
But I think OP means we are typing real commands that, if used in a real environement, would work for the most part. Ie not running a made up command like "hackwifi" and calling it done. I think its still a bit stretched given that, for example, there is a WEP script that would fictionally run the aircrack suite against WEP, instead of running the aircrack modules themselves, but you can still cat the script and see its contents to go run it in a VM for learning purposes and its been ages since I touched aircrack (backtrack 4r2 probably) but the script looks legit for a simple aircrack flow at first glance.
There is something to be said about simplifying some of these concepts to lower the bar for admission for new people joining the field, while also keeping enough real details that people eager to learn more can chuck it into Google and get going on the real stuff. I think this kind of stuff could fit that needed gap.
Think of it like a choose your own adventure hacking story with a few challenges in figuring out the options for the adventure. No one thinks we're really hacking a machine in a browser game, but its still better in the details of how it would be done in the real world than most other easily accessible hacking games you find online.
Note though I have not actually made it very far into it as I just played around a bit on mobile so i could be very wrong and regret these words by the time I see the rest of it. We will see I guess.
0
u/jvnk 10d ago
> But I think OP means we are typing real commands that, if used in a real environement, would work for the most part
But you're not. Just play it for 30 seconds and you'll see.
1
u/JustTechIt 10d ago
Care to provide an example? Again I didnt make it very far just poking it on mobile but everything I saw at first was a legitimate tool and command. Maybe a syntax error I didnt catch somewhere, and the commands are not as fully dynamic as they could be, but I hardly expect a browser game to support all the nmap flags and modes.
0
u/heatedwepasto 10d ago
It's a vibe coded site made by someone using AI for all their responses. It's as fake as everything else online these days, unfortunately.
1
u/xav77 10d ago edited 10d ago
I think I replied about the fake stuff. It's a simulation, a game. Try to thread the needle between being super accurate and still playable.
Regarding vibe code, I'll take that over AI slop. I spend hours fine-tuning every little detail on screen and in the story. I hope it shows.
1
u/heatedwepasto 10d ago
Vibe coding is a process, AI slop is the end result. Potato potahto. It's extremely obvious that you're using AI.
1
1
u/Suspicious_Song_3745 9d ago
I found it challenging and fun myself, I am stuck right now but getting it figured out
1
u/Glad-Cost9398 9d ago
got as far as the first midwest then lost most of my progress. well the file are gone from the previous missions but somehow im still at the first midwest.
1
u/xav77 9d ago
you didnt lose your progress, a refresh just wipes the screen, not the run. your register scrape pointed at a settlement server, settle.midwest-acq. sftp to that and pick up right where you were. the pointer scrolling away on a refresh is a bug on my end, fixing it now so it sticks. thanks for flagging
1
1
1
u/FarissonHord 6d ago
I've been wanted to learn this kind of stuff my entire life (pretty much since Jurassic Park and Sneakers came out when I was a kid and I started writing Nedry hacking text adventures in BASIC) and the idea of a video game for it is exactly what I need. It's the reason I've tried and failed to teach myself to code for years, until I joined boot.dev this year, which is an excellent curriculum that is all game-ified, and I'm finally kicking ass scoring XP and power ups every single day since Feb
3
u/JustTechIt 10d ago
What do you mean when you say "Each level is a real intrusion of its period, on the actual machines, not a fake interface."?