ctf::setup

# VM settings for CTF work:
# RAM:  4–8 GB (Ghidra needs ~4 GB alone)
# CPU:  2–4 cores
# Disk: 60 GB+ (tools + challenge files)
# Network: NAT (isolated) for malware analysis
#          Bridged for CTF platform access
# Shared folder: yes (easy file transfer)

# Take snapshots BEFORE:
# - Running unknown binaries
# - Installing new tools
# - Trying kernel exploits
# - Pwn challenges that crash the system

# VMware: VM → Snapshots → Take Snapshot
# VirtualBox: Machine → Take Snapshot
# QEMU/KVM: virsh snapshot-create-as vm snap1

# Run suspicious binaries safely:
docker run --rm -it ubuntu bash
# or
firejail ./suspicious_binary
# or
sandbox-exec -f deny.sb ./binary   # macOS

#!/bin/bash — paste and run on fresh Ubuntu/Kali

# System tools
sudo apt update && sudo apt install -y \
    python3-pip git curl wget vim tmux \
    gdb gdb-multiarch ltrace strace \
    ncat netcat-openbsd socat \
    binwalk foremost scalpel \
    xxd hexedit file strings \
    exiftool steghide stegsolve \
    wireshark tshark \
    checksec patchelf \
    upx-ucl

# Python tools
pip3 install \
    pwntools z3-solver \
    requests flask \
    pycryptodome \
    ROPgadget ropper \
    frida-tools \
    volatility3 \
    r2pipe

# Rust/Go tools
# feroxbuster
cargo install feroxbuster
# chisel
go install github.com/jpillora/chisel@latest

# Ghidra (NSA decompiler)
wget https://github.com/NationalSecurityAgency/ghidra/releases/download/Ghidra_11.0.3_build/ghidra_11.0.3_PUBLIC_20240410.zip
unzip ghidra_*.zip && ln -s ghidra_*/ghidraRun ~/bin/ghidra

# pwndbg
git clone https://github.com/pwndbg/pwndbg
cd pwndbg && ./setup.sh

# GEF (alternative to pwndbg)
bash -c "$(curl -fsSL https://gef.blah.cat/sh)"

# one_gadget (find execve gadgets in libc)
gem install one_gadget

# seccomp-tools
gem install seccomp-tools

# libc-database
git clone https://github.com/niklasb/libc-database
cd libc-database && ./get ubuntu   # download Ubuntu libcs

# Sleuth Kit
sudo apt install sleuthkit autopsy

# bulk_extractor
sudo apt install bulk-extractor

# volatility3
pip3 install volatility3
# Symbols: https://isf-server.techanarchy.net/

# photorec / testdisk
sudo apt install testdisk

# extundelete / ext4magic
sudo apt install extundelete

# zsteg (PNG steg)
gem install zsteg

# stegseek (crack steghide)
wget https://github.com/RickdeJager/stegseek/releases/download/v0.6/stegseek_0.6-1.deb
sudo dpkg -i stegseek_0.6-1.deb

# ffuf
go install github.com/ffuf/ffuf/v2@latest

# sqlmap
git clone https://github.com/sqlmapproject/sqlmap

# Burp Suite Community (free)
# https://portswigger.net/burp/releases
# chmod +x burpsuite_community*.sh && ./burpsuite_community*.sh

# jwt_tool
pip3 install jwt_tool
# or
git clone https://github.com/ticarpi/jwt_tool

# flask-unsign
pip3 install flask-unsign

# SecLists wordlists
git clone https://github.com/danielmiessler/SecLists /opt/SecLists

# nuclei — template vuln scanner
go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest

# httpx — probe live hosts
go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest

# katana — JS/headless crawler
go install github.com/projectdiscovery/katana/cmd/katana@latest

# rustscan — fast port scanner (pipes to nmap)
cargo install rustscan

# netexec (nxc) — successor to CrackMapExec
pipx install git+https://github.com/Pennyw0rth/NetExec

# name-that-hash (nth) — identify hash types
pipx install name-that-hash

# pipx — install CLI tools in isolated venvs
sudo apt install pipx
pipx ensurepath
pipx install <tool>

# uv — fast pip/venv replacement (Astral)
curl -LsSf https://astral.sh/uv/install.sh | sh
# then
uv pip install <pkg>
uv venv        # create a venv
uvx <tool>      # run a tool ad-hoc (like pipx run)

~/ctf/
├── tools/          ← cloned tools (ghidra, pwndbg, etc.)
├── wordlists/      ← rockyou, SecLists
├── 2026-picoctf/   ← per-competition folder
│   ├── web/
│   │   ├── challenge1/
│   │   │   ├── solve.py
│   │   │   ├── notes.md
│   │   │   └── flag.txt
│   │   └── challenge2/
│   ├── pwn/
│   ├── forensics/
│   ├── crypto/
│   ├── rev/
│   └── misc/
└── templates/      ← solve script templates

# Create structure quickly
mkdir -p ~/ctf/{tools,wordlists}
mkdir -p ~/ctf/2026-event/{web,pwn,forensics,crypto,rev,misc}
for cat in web pwn forensics crypto rev misc; do
    mkdir -p ~/ctf/2026-event/$cat/chall1
done

# ~/ctf/templates/solve.py
from pwn import *
import sys

HOST, PORT = 'challenge.ctf.com', 1337
BINARY     = './challenge'

elf  = ELF(BINARY)
context.binary = elf

def conn():
    if args.REMOTE: return remote(HOST, PORT)
    if args.GDB:    return gdb.debug(BINARY, 'b main\nc')
    return process(BINARY)

def exploit():
    p = conn()
    # EXPLOIT HERE
    p.interactive()

if __name__ == '__main__':
    exploit()

# notes.md template:
# ## Challenge: name
# Category: pwn / web / crypto...
# Points: 100
# ## Analysis
# ## Solution
# ## Flag: picoCTF{...}

# Recommended: 3-pane layout
# ┌──────────────┬──────────────┐
# │  main shell  │   gdb/r2    │
# │  (solve.py)  │             │
# ├──────────────┴──────────────┤
# │      ghidra / notes         │
# └─────────────────────────────┘

# Create session
tmux new-session -s ctf

# Split panes
Ctrl-b %      # vertical split
Ctrl-b "      # horizontal split
Ctrl-b →←↑↓  # navigate panes
Ctrl-b z      # zoom/unzoom pane
Ctrl-b [      # scroll mode (q to exit)
Ctrl-b d      # detach
tmux attach -t ctf  # reattach

# Sane defaults for CTF work
set -g history-limit 50000
set -g mouse on
set -g base-index 1

# Better prefix (Ctrl-a like screen)
unbind C-b
set -g prefix C-a
bind C-a send-prefix

# Reload config
bind r source-file ~/.tmux.conf

# Easy splits
bind | split-window -h
bind - split-window -v

# Status bar
set -g status-right '%H:%M'