How k33p5/ctf-workstation works
CTF Workstation is a local, thinker-led challenge-solving rig: a reasoning operator triages a challenge, delegates tool-driven or model-assisted work, then verifies any proposed flag against observed command output. It spans category presets, interactive ReAct execution, model fan-out, specialized crypto and hash-cracking helpers, and wildcard routing. README and sampled source support the major components and their documented roles; some detailed wiring and category-specific implementations were not sampled, so uncertain links are omitted.
Main entry points: toolpool.py Parallel toolpool · executor.py ReAct executor · harness.py LLM harness · fanout.py Model fanout
Components 17
Solve orchestration
- Parallel toolpool
src/toolpool.py - ReAct executor
src/executor.py - LLM harness
src/harness.py - Model fanout
src/fanout.py - Flag guard
src/executor.py
Challenge analysis
- File triage
src/toolpool.py - Category presets
src/toolpool.py - Wildcard router
tools/wildcard.sh - Host and attack
tools/host_attack.sh
Specialist tools
- Lattice helpers
tools/cryptolll.py - GPU hashcat
src/hcat.py
Runtime integrations
- Shell runtime
- Model providers
Other components
- Thinker
- Challenge input
- Verified flag
- GPU hashcat runtime
Connections 22
- Thinker → Challenge input: triages
- Thinker → Parallel toolpool: delegates scans
- Thinker → ReAct executor: delegates tasks
- Thinker → LLM harness: requests answers
- Thinker → Model fanout: requests votes
- Thinker → Lattice helpers: uses helpers
- Thinker → GPU hashcat: cracks hashes
- Thinker → Host and attack: starts attack
- Thinker → Verified flag: submits verified
- Parallel toolpool → File triage: runs preset
- Parallel toolpool → Category presets: runs preset
- Parallel toolpool → Wildcard router: dispatches
- Parallel toolpool → Shell runtime: runs commands
- ReAct executor → LLM harness: requests completion
- ReAct executor → Shell runtime: runs commands
- ReAct executor → Flag guard: checks final
- Flag guard → Verified flag: accepts grounded
- Model fanout → LLM harness: calls per model
- LLM harness → Model providers: sends prompts
- Host and attack → Shell runtime: hosts and attacks
- Lattice helpers → Shell runtime: runs Sage bridge
- GPU hashcat → GPU hashcat runtime: invokes