reverse-skills-max: initial public release (restored, redacted, hardened)

2026-10-20 02:17:15 +03:00
commit da24c2bd20
2227 changed files with 443931 additions and 0 deletions
--- a/reverse-skill-repo/examples/ctf-demo/README.md
+++ b/reverse-skill-repo/examples/ctf-demo/README.md
@@ -0,0 +1,39 @@
+# examples/ctf-demo — 完整流程示例
+
+> 本目录演示 reverse-skill 的标准作业流：**路由 → 授权门禁 → 时间线 → 证据链 → 报告**。
+> 内容为虚构示例（CTF 靶场），仅用于展示工作方式。
+
+## 流程演示
+
+```text
+1. 用户任务："分析这个 CTF pwn 题，栈溢出 gets"
+2. 路由：master-route.ps1 -Hint "CTF pwn 栈溢出" → PRIMARY R17 (pwn-chain)
+3. 授权：case-init.ps1 -Hint ... -CaseName ctf-demo -AuthGranted → scope.md
+4. 执行：时间线追加 + 证据 E-001/E-002 + workitems 更新
+5. 产出：报告（docs-generator）+ field-journal 脱敏沉淀
+```
+
+## 文件
+
+| 文件 | 说明 |
+|------|------|
+| `scope.md` | 案例范围（auth granted / 目标 / network_profile） |
+| `timeline.md` | 追加式时间线 |
+| `workitems.md` | 工作项与覆盖率 |
+| `evidence/` | 证据记录示例（E-001 复现命令、E-002 崩溃输出） |
+| `report/` | 最终报告结构示例 |
+
+## 真实使用
+
+```powershell
+# 初始化真实 case（授权目标）
+powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/case-init.ps1 `
+  -Hint "你的任务" -CaseName my-case -AuthGranted -TargetUrl "https://target/" `
+  -NetworkProfile authorized_target_only
+
+# 追加证据
+powershell -File skills/scripts/append-evidence.ps1 -CaseRoot work\my-case `
+  -Id E-001 -Title "..." -ReproCommand "..."
+```
+
+> 注意：真实 case 应放在 `work/<case>/`（gitignored，防泄密）；本示例目录保留在 git 中供参考。
--- a/reverse-skill-repo/examples/ctf-demo/evidence/E-001.md
+++ b/reverse-skill-repo/examples/ctf-demo/evidence/E-001.md
@@ -0,0 +1,19 @@
+### E-001
+
+- title: pwn1 ELF triage (checksec)
+- severity: info
+- status: observed
+- observed_at: 2026-08-02T00:15:00
+- source_type: command
+- source_ref: recon phase
+- repro_command: |
+    file ./pwn1 && checksec --file=./pwn1
+- raw_excerpt: |
+    ./pwn1: ELF 64-bit LSB executable, x86-64, dynamically linked
+    RELRO: Partial RELRO
+    Stack: No canary found
+    NX: NX enabled
+    PIE: PIE disabled
+- artifact_path: evidence/checksec-output.txt
+- content_hash: 395aa1546e0e22873e10334c4225097e9111f1b8fb5dcd1a2a3b7640d6fcc6ed
+- linked_workitem: WI-002
--- a/reverse-skill-repo/examples/ctf-demo/evidence/E-002.md
+++ b/reverse-skill-repo/examples/ctf-demo/evidence/E-002.md
@@ -0,0 +1,15 @@
+### E-002
+
+- title: gets() stack overflow in main
+- severity: info
+- status: observed
+- observed_at: 2026-08-02T00:40:00
+- source_type: command
+- source_ref: static analysis
+- repro_command: |
+    python3 -c "print('A'*0x48 + 'B'*8)" | ./pwn1
+- raw_excerpt: |
+    Program received signal SIGSEGV, Segmentation fault.
+    RIP=0x4242424242424242
+- content_hash: n/a
+- linked_workitem: WI-003
--- a/reverse-skill-repo/examples/ctf-demo/evidence/E-003.md
+++ b/reverse-skill-repo/examples/ctf-demo/evidence/E-003.md
@@ -0,0 +1,14 @@
+### E-003
+
+- title: remote exploit success
+- severity: high
+- status: validated
+- observed_at: 2026-08-02T01:10:00
+- source_type: command
+- source_ref: exploit phase
+- repro_command: |
+    python3 exploit.py REMOTE
+- raw_excerpt: |
+    ctf{{example_flag_do_not_use}}
+- content_hash: n/a
+- linked_workitem: WI-004
--- a/reverse-skill-repo/examples/ctf-demo/evidence/checksec-output.txt
+++ b/reverse-skill-repo/examples/ctf-demo/evidence/checksec-output.txt
@@ -0,0 +1,5 @@
+./pwn1: ELF 64-bit LSB executable, x86-64, dynamically linked
+RELRO: Partial RELRO
+Stack: No canary found
+NX: NX enabled
+PIE: PIE disabled
--- a/reverse-skill-repo/examples/ctf-demo/report/report.md
+++ b/reverse-skill-repo/examples/ctf-demo/report/report.md
@@ -0,0 +1,77 @@
+# ctf-demo — Final Report (示例)
+
+> 报告结构参考 `skills/docs-generator/references/security-report-templates.md`。
+
+## 1. 概述
+
+| 项 | 值 |
+|----|----|
+| 目标 | pwn1 (https://ctf.example.com/challenges/pwn1) |
+| 类型 | CTF pwn（栈溢出） |
+| 结果 | ✅ flag captured |
+| 耗时 | ~1.5h |
+
+## 2. 执行摘要
+
+pwn1 为无 PIE/无 canary 的 64 位 ELF，main 使用 `gets()` 读取 0x40 缓冲区。
+通过 0x48 偏移覆盖返回地址，调用程序内 win 函数获取 flag。远程验证成功。
+
+## 3. 时间线
+
+见 `timeline.md`（5 个阶段：init → recon → static → exploit → wrap）。
+
+## 4. 发现
+
+### F-01
+
+- title: gets() stack overflow in main (ret2win)
+- severity: high
+- status: validated
+- confidence: high
+- evidence_ids: [E-001, E-002, E-003]
+- location: pwn1:main — gets() into buf[0x40], return offset 0x48, no canary
+- impact: Remote code execution as the pwn1 process user; flag disclosure in CTF context.
+- repro_steps:
+  1. Triage the binary (E-001)
+  2. Confirm the overflow offset with a cyclic/crash test (E-002)
+  3. Send the ret2win payload against the remote service (E-003)
+- remediation: Replace gets() with fgets/read; enable canary, PIE and full RELRO; rely on ASLR.
+
+## 5. 攻击路径（Evidence → Finding → Path）
+
+### P-01
+
+- title: pwn1 ret2win solve path
+- path_type: solve
+- start: challenge binary download
+- goal: flag capture
+- steps:
+  1. action: download and triage pwn1 — evidence: E-001 — finding: F-01 | none
+  2. action: decompile main and confirm gets() overflow — evidence: E-002 — finding: F-01
+  3. action: craft ret2win payload and verify remotely — evidence: E-003 — finding: F-01
+- residual_risks: none (isolated CTF lab)
+
+```mermaid
+graph LR
+  A[下载 pwn1] --> B[checksec 侦察]
+  B --> C[Ghidra 反编译 main]
+  C --> D[定位 gets 溢出 偏移0x48]
+  D --> E[构造 payload ret2win]
+  E --> F[远程验证 获取 flag]
+```
+
+## 6. 复现
+
+```bash
+python3 exploit.py REMOTE
+```
+
+## 7. 修复建议（若为真实应用）
+
+- 使用 `fgets`/`read` 替代 `gets`
+- 开启 canary + PIE + full RELRO
+- 部署 ASLR（服务器侧）
+
+## 8. 附注
+
+- field-journal 已脱敏沉淀（无真实目标信息）
--- a/reverse-skill-repo/examples/ctf-demo/scope.md
+++ b/reverse-skill-repo/examples/ctf-demo/scope.md
@@ -0,0 +1,60 @@
+# Case Scope
+
+## meta
+- case_id: ctf-demo
+- created: 2026-08-02T00:00:00.0000000+08:00
+- operator: local
+- primary_skill: pwn-chain/SKILL.md
+- primary_id: R17
+- lead_role: lead
+- specialist_roles: [pwn-specialist]
+- hint: CTF pwn 栈溢出 gets
+
+## auth
+- status: granted
+- basis: ctf_lab (CTF 靶场授权)
+- evidence_of_auth: 平台授权条款（靶场挑战自带授权）
+- MUST NOT proceed if status != granted
+
+## in_scope
+- assets:
+  - https://ctf.example.com/challenges/pwn1
+- surfaces: [binary download, remote service]
+- activities: [static analysis, exploit development, remote verification]
+
+## out_of_scope
+- assets: [其他挑战、平台基础设施]
+- activities: [dos, phishing_real_users, unrestricted_exfil]
+
+## network_profile
+- mode: authorized_target_only
+- notes: |
+    offline | lab_only | authorized_target_only | unrestricted_lab
+    Change mode only after auth.status = granted.
+
+## deliverables
+- report: true
+- field_journal: true
+- diagrams: true
+- timeline: true
+
+## constraints
+- timebox: {2h}
+- stealth: low
+- data_handling: anonymize
+
+## signoff
+- ready_for_act: true
+- checklist:
+  - [x] auth.status = granted
+  - [x] in_scope.assets non-empty OR offline sample path set
+  - [x] network_profile.mode chosen
+  - [x] out_of_scope reviewed
+  - [x] roles assigned (see skills/ops/role-map.md)
+
+## ops_refs
+- skills/ops/scope-contract.md
+- skills/ops/evidence-finding-path.md
+- skills/ops/role-map.md
+- skills/ops/timeline-workitem.md
+- skills/ops/IDENTITY.md
--- a/reverse-skill-repo/examples/ctf-demo/timeline.md
+++ b/reverse-skill-repo/examples/ctf-demo/timeline.md
@@ -0,0 +1,40 @@
+# Timeline (append-only)
+
+## 2026-08-02T00:00:00.0000000+08:00 | lead | init
+- action: case-init
+- command_or_ref: skills/scripts/case-init.ps1
+- result_summary: case directory created; scope ready_for_act=true
+- artifacts: [scope.md, workitems.md]
+- evidence_ids: []
+- next: open PRIMARY SKILL.md and ACT within scope
+
+## 2026-08-02T00:15:00.0000000+08:00 | pwn-specialist | recon
+- action: download & triage binary
+- command_or_ref: file pwn1; checksec --file=./pwn1
+- result_summary: ELF 64-bit x86-64, no PIE, NX enabled, partial RELRO, no canary on main
+- artifacts: [pwn1]
+- evidence_ids: [E-001]
+- next: static analysis (IDA/Ghidra) → locate vulnerable function
+
+## 2026-08-02T00:40:00.0000000+08:00 | pwn-specialist | static
+- action: decompile main, confirm gets() buffer overflow
+- command_or_ref: ghidra headless analyze
+- result_summary: main uses gets(buf[0x40]); no canary; ret offset = 0x48
+- artifacts: [decomp.md]
+- evidence_ids: [E-002]
+- next: build exploit (ret2win / ROP)
+
+## 2026-08-02T01:10:00.0000000+08:00 | pwn-specialist | exploit
+- action: craft payload, remote verify
+- command_or_ref: python3 exploit.py REMOTE
+- result_summary: flag captured: ctf{example_flag_do_not_use}
+- artifacts: [exploit.py, flag.txt]
+- evidence_ids: [E-003]
+- next: write report + journal
+
+## 2026-08-02T01:30:00.0000000+08:00 | lead | wrap
+- action: report via docs-generator; journal anonymized
+- result_summary: report + field-journal written
+- artifacts: [report/, field-journal entry]
+- evidence_ids: []
+- next: (done)
--- a/reverse-skill-repo/examples/ctf-demo/workitems.md
+++ b/reverse-skill-repo/examples/ctf-demo/workitems.md
@@ -0,0 +1,22 @@
+# Work Items
+
+| ID | title | role | targets | surface | status | evidence | notes |
+|----|-------|------|---------|---------|--------|----------|-------|
+| WI-001 | Establish scope and auth | lead | case | process | done | | |
+| WI-002 | Download & triage binary | pwn-specialist | pwn1 | binary | done | E-001 | checksec |
+| WI-003 | Static analysis of main() | pwn-specialist | pwn1 | binary | done | E-002 | gets overflow |
+| WI-004 | Exploit dev & remote verify | pwn-specialist | remote | service | done | E-003 | flag captured |
+| WI-005 | Report + journal | lead | case | process | done | | |
+
+## Coverage
+- [x] Recon/analysis complete for in_scope assets
+- [x] Critical/High candidates triaged (or N/A for pure RE)
+- [x] Validated findings have Evidence (E-*)
+- [x] Path documented (attack/call/solve)
+- [x] Timeline continuous across major phases
+- [x] Report via docs-generator
+- [x] field-journal anonymized
+
+## Refs
+- skills/ops/timeline-workitem.md
+- skills/ops/evidence-finding-path.md