ctf-tools

This is a Nix flake packaging various security research tools. Of course, this isn't a hard problem, but it's really nice to have them in one place that's easily deployable to new machines and so forth. CI evaluates the catalog and builds the repository-packaged x86_64 tools every day, so breakage should be caught quickly.

The following tools are included. The first table lists tools packaged in this repo (under nix/pkgs/); the second lists tools taken from nixpkgs.

NIX??????

Long-time ctf-tools users might be surprised by this development, but it is a good development. Nix provides isolated packaging and can be deployed into a dev/hack environment, locally into a user's home directory, or globally system/container-wide. It also happily installs alongside your normal OS and package manager (e.g., ubuntu and apt) with zero interference. Trust me, I was as skeptical as you are for years, but it is the way.

Packaged in this repo

From nixpkgs

Usage

Every tool is a flake output. To use, do:

# install a tool into your Nix profile
nix profile install github:zardus/ctf-tools#gdb

# run a tool without installing it
nix run github:zardus/ctf-tools#ropper

# run a shell with a tool in it
nix shell github:zardus/ctf-tools#ropper

# list every available tool
nix flake show github:zardus/ctf-tools

A bin/manage-tools wrapper around nix profile is also provided, for the familiar CLI:

# (once) configure Nix + the binary cache
/path/to/ctf-tools/bin/manage-tools setup

manage-tools list                 # list the available tools
manage-tools install pwntools
manage-tools uninstall gdb
manage-tools search preload
manage-tools list -t              # list generated cross-toolchains

manage-tools install all          # every catalogued tool
manage-tools install all-toolchains
manage-tools install everything   # catalog + toolchains

Tools install into your Nix profile, and uninstalling removes them cleanly. The three aggregate names install as single profile entries, so Nix shares common dependencies and does not activate a partial set if a build fails. manage-tools prints Nix's download/build plan before installing an aggregate. On ARM, all contains every supported catalog tool; the generated toolchain aggregates are x86_64-only.

Downloads outside Nix

Package inputs are downloaded by Nix and pinned by SHA-256, including the two legacy plain-HTTP sources (steganabara and pkcrack's fallback mirror). A server or network attacker can make those fetches unavailable, but cannot make Nix accept different bytes under the recorded hash.

The exceptions are:

• libc-database-get all downloads the multi-gigabyte libc corpus into the user's data directory after installation.
• IDA itself is downloaded by the user from Hex-Rays. The ida wrapper can unpack that local archive and activate the vendor's bundled idapro wheel; activation tries an offline install first, with PyPI only as a fallback if that wheel declares an unavailable dependency.
• Running the crosstool package's ct-ng driver directly downloads the sources selected by the user's configuration. The prebuilt crosstool-ng-* flake outputs instead fetch a hash-pinned source set during the Nix build and compile offline.

Network scanners and clients naturally contact targets when run; that is tool operation, not package installation.

Platform support

The ordinary package set is available on both x86_64-linux and aarch64-linux. Packages that nixpkgs or their upstream binary releases mark as unsupported are omitted from the ARM package set instead of making the whole profile fail to evaluate.

The generated cross2-* and crosstool-ng-* toolchain outputs are x86_64-only. ARM packages are evaluated by CI, but are not built or uploaded to the size-limited ctftools Cachix cache; ARM users build repository-packaged tools locally. Tools forwarded unchanged from nixpkgs can still substitute from cache.nixos.org on either architecture.

Cross-compiler toolchains (cross2, crosstool)

On x86_64, two of the tools are toolchain builders rather than single programs, so they expose one output per target instead of one output overall. Install only the target you need — each is an independent package.

crosstool is the crosstool-NG ct-ng driver, and only the driver — unlike the old shell tool, it puts no cross compilers on your PATH. Installing crosstool gives you ct-ng itself, ready to build your own toolchain from a config:

nix profile install github:zardus/ctf-tools#crosstool
ct-ng list-samples

The compilers themselves are separate outputs: 77 of crosstool-NG's 146 samples are prebuilt as crosstool-ng-<sample>, so you can install a ready-made toolchain (say, arm-none-eabi-gcc) instead of spending an hour building one:

# a bare-metal ARM toolchain: arm-none-eabi-gcc, -gdb, -objdump, ...
nix profile install github:zardus/ctf-tools#crosstool-ng-arm-none-eabi

# a full Linux/musl cross toolchain, with sysroot
nix profile install github:zardus/ctf-tools#crosstool-ng-aarch64-unknown-linux-musl

# see all of them (bare-metal newlib/picolibc plus Linux
# glibc/uClibc/musl, and the mingw-w64 Windows targets)
nix flake show github:zardus/ctf-tools | grep crosstool-ng-

The sample name is the crosstool-NG sample id with any character outside [a-zA-Z0-9_-] replaced by - (so x86_64-ubuntu16.04-linux-gnu becomes crosstool-ng-x86_64-ubuntu16-04-linux-gnu).

The other 69 samples that ct-ng list-samples prints have no crosstool-ng-* output — build them yourself with ct-ng <sample> && ct-ng build, or pin one as a flake output by running nix/pkgs/crosstool/pin-samples.sh and folding the hash it prints into nix/pkgs/crosstool/hashes.nix (anything in there is surfaced automatically).

cross2 is the companion toolchain set for the kozos.jp assembly book — binutils 2.21.1 + gcc 3.4.6 + newlib 1.20.0 (+ gdb 7.3.1 where it still builds, or just its CPU simulator, <target>-run, where it does not), for 34 mostly-retro bare-metal targets. Installing cross2 gives you the book's six "major architecture" toolchains (arm, h8300, i386, mips, powerpc, sh); the other targets are individual cross2-<target> outputs:

# the major-architecture bundle
nix profile install github:zardus/ctf-tools#cross2

# or just one target, e.g. mmix or vax
nix profile install github:zardus/ctf-tools#cross2-mmix-elf
nix profile install github:zardus/ctf-tools#cross2-vax-netbsdelf

These are large, from-source gcc builds, so install them with the binary cache configured — otherwise Nix will build the whole toolchain locally (tens of minutes to hours each).

Help!

Something not working? I didn't write (almost) any of these tools, but hit up the discord if you're desperate. Maybe some kind soul will help!

Binary cache

CI builds the x86_64 tools packaged in this repo and pushes them to a public Cachix cache, so x86_64 installs download prebuilt binaries instead of compiling. Trusted Nix users pick this up automatically from the flake's nixConfig; otherwise run cachix use ctftools once (or pass --accept-flake-config).

ARM outputs are deliberately not pushed to this cache. Unchanged tools in the "From nixpkgs" table use the official cache.nixos.org binary cache and do not consume space in the ctftools cache. dirsearch is the exception on x86_64: our setuptools compatibility override produces a distinct output, so CI caches it alongside the tools packaged in this repository.

Dockerized Tools

You can get the tools packaged in this repo in prebuilt x86_64 containers from dockerhub. For example:

$ echo hi | docker run -i ctftools/taintgrind taintgrind --taint-stdin=yes /bin/cat

The images are generated by CI, which installs the tool into a nixos/nix base with nix profile install.

Adding Tools

To add a tool (say, named toolname):

1. If it is already in nixpkgs, add a line to nix/passthrough.nix.
2. Otherwise, create nix/pkgs/toolname/default.nix — a callPackage-style derivation with its sources pinned by hash — and build it with nix build .#toolname.
3. Add it to the README.

The flake discovers nix/pkgs/* automatically; the output name is the directory name.

License

The individual tools are all licensed under their own licenses. As for ctf-tools itself, it is licensed under BSD 2-Clause License. If you find it useful, star it on GitHub (https://github.com/zardus/ctf-tools).

Good luck!

See Also

There's a curated list of CTF tools, but without installers, here: https://github.com/apsdehal/aWEsoMe-cTf.

There's a Vagrant config with a lot of the bigger frameworks here: https://github.com/thebarbershopper/epictreasure.

The old apt-only tool list has been fully migrated to Nix outputs.

Useful CTF tools in docker images

Previously, this repository included some scripts that were wrappers around docker pull. We trust that you can do that yourself :-)

Useful CTF Libraries

Previously, this repository included library installers. Because of how bespoke library install preferences are (e.g., unlike a tool, it's not clear if per-library venvs are a desired thing), we've stopped shipping them, and link them here for posterity.