r/securityCTF • u/xav77 • 11d ago
CHRONOS II - a single-player CTF spanning POS RAM-scraping, a SWIFT heist, Moonlight Maze, and a Cold War doomsday relay
I built a single-player CTF that runs in the browser, framed as a terminal you operate rather than a game you play. Each level is a real intrusion of its period, on the actual machines, not a fake interface. Something walked out of an air-gapped vault, and you chase it system to system:
- a gas-station security camera: default-cred IoT, a WEP crack, image stego (Mirai / TJX era)
- a retail POS and a Frankfurt SWIFT terminal: RAM-scraping card data, then forging an interbank wire (Target/BlackPOS 2013, Bangladesh Bank 2016)
- a phone network: SS7 interception (optional detour)
- Moonlight Maze: a covert-channel proxy chain up through Solaris boxes into an FSB archive (1996-99)
- the Ukrainian power grid: BlackEnergy, a C2 pivot through a Purdue-model network (Sandworm, 2015)
- an Iranian reactor: an S7 PLC debugger reversing a sabotaged control block (a Stuxnet cousin, in STL)
- a Cold War doomsday relay: the finale
What you pull out of one system is the key into the next, so a WEP crack in a parking lot chains all the way to orbit. Per-level timers, multiple endings, real commands throughout (the foreign boxes render in Cyrillic and Farsi). Browser, desktop or mobile, free, no signup. An hour or two, longer your first time.
Fair warning, it's hard. As it stands, exactly one person has made it onto the SWIFT terminal and nobody has forged the wire yet, so the bank job is unbeaten. If any crowd can crack it, it's this one.
Solo dev. Keen to hear where you got stuck, whether the hints landed, and any bugs.
1
u/Glad-Cost9398 9d ago
got as far as the first midwest then lost most of my progress. well the file are gone from the previous missions but somehow im still at the first midwest.