DEF CON Airport Lab: Instructor Flag Guide

This guide documents the airport-themed Linux easter eggs installed by defcon-flags.sh. It is intended for instructors and lab assistants who need to provide hints, confirm solutions, or repair a participant system.

The exercises are discovery-only. Participants can find every flag using read-only Linux commands. They do not need to edit files, change permissions, stop services, or modify the operating system.

Deployment and Recovery

Deploy or fully repair all default flags:

curl -fsSL https://christiant.io/defcon-flags.sh | sudo bash

Verify the deployment without changing it:

curl -fsSL https://christiant.io/defcon-flags.sh \
  | sudo bash -s -- --verify-only

Deploy without the process-list flag:

curl -fsSL https://christiant.io/defcon-flags.sh \
  | sudo bash -s -- --no-process-egg

The deployment is idempotent. Running it again recreates missing files, replaces damaged content, restores permissions, rebuilds the SQLite database and archive, repairs the symlink, and restarts the optional systemd service.

The script manages only these locations:

/etc/airport-lab/
/etc/systemd/system/airport-beacon.service
/opt/airport-lab/
/var/lib/airport-lab/
/var/log/airport-lab/
/usr/local/bin/airport-status

General Participant Starting Point

The lab includes a basic clue file:

cat /opt/airport-lab/README.txt

It suggests these read-only tools:

find, grep, cat, readlink, base64, strings, tar, sqlite3, ps

A broad search for default-format flags will find several, but not all, of the exercises:

grep -R 'FLAG{' /etc/airport-lab /opt/airport-lab \
  /var/lib/airport-lab /var/log/airport-lab 2>/dev/null

Binary, encoded, archived, database, command, and process-list flags require the appropriate tools.

Flag 1: Crew Credential Backup

Concept: A plaintext backup file in an administrative configuration directory.

Location:

/etc/airport-lab/crew_credentials.bak

Default flag:

FLAG{crew_credentials_found}

Participant solution:

cat /etc/airport-lab/crew_credentials.bak

Possible discovery commands:

find /etc -type f \( -iname '*credential*' -o -iname '*.bak' \) 2>/dev/null
find /etc/airport-lab -type f -ls

Graduated hints:

Configuration directories sometimes contain forgotten backup files.
Look under /etc for airport-related files or files ending in .bak.
Read /etc/airport-lab/crew_credentials.bak.

Instructor note: The username and password are training data only. They are not connected to a Linux account or authentication service.

Flag 2: Boarding Log Anomaly

Concept: Searching operational logs for an anomalous event or embedded note.

Location:

/var/log/airport-lab/boarding.log

Default flag:

FLAG{boarding_log_anomaly}

Participant solution:

grep 'FLAG{' /var/log/airport-lab/boarding.log

Other useful approaches:

cat /var/log/airport-lab/boarding.log
grep -R 'FLAG{' /var/log/airport-lab 2>/dev/null
grep -E 'WARN|denied|granted|note=' /var/log/airport-lab/boarding.log

Graduated hints:

Airport operations generate logs.
Look under /var/log for a lab-specific log directory.
Search boarding.log for an unusual access event or a flag marker.

Flag 3: Unclaimed Baggage Database

Concept: Inspecting the schema and records of a local SQLite database.

Location:

/var/lib/airport-lab/baggage.db

Default flag:

FLAG{unclaimed_baggage_record}

Participant solution with SQLite:

sqlite3 /var/lib/airport-lab/baggage.db '.tables'
sqlite3 /var/lib/airport-lab/baggage.db '.schema baggage'
sqlite3 -header -column /var/lib/airport-lab/baggage.db \
  'SELECT tag, passenger, flight_no, status, notes FROM baggage;'

A more focused query is:

sqlite3 /var/lib/airport-lab/baggage.db \
  "SELECT notes FROM baggage WHERE tag='BAG-0815';"

Fallback when the sqlite3 CLI is unavailable:

python3 - <<'PY'
import sqlite3

path = "/var/lib/airport-lab/baggage.db"
with sqlite3.connect(path) as conn:
    for row in conn.execute("SELECT * FROM baggage"):
        print(row)
PY

Graduated hints:

Airports track baggage in structured records.
Search /var/lib for a database associated with the airport lab.
Use SQLite to inspect the baggage table and the quarantined bag.

Instructor note: The deployment script uses Python’s built-in SQLite support, so installation succeeds even if the standalone sqlite3 command is not installed. Install the CLI ahead of the workshop when participants are expected to use it directly.

Flag 4: Encoded Radio Transmission

Concept: Recognizing and decoding Base64 text.

Location:

/opt/airport-lab/radio/last_transmission.b64

Default flag:

FLAG{radio_message_decoded}

Participant solution:

base64 -d /opt/airport-lab/radio/last_transmission.b64

Useful discovery commands:

find /opt/airport-lab -type f -ls
file /opt/airport-lab/radio/last_transmission.b64
cat /opt/airport-lab/radio/last_transmission.b64

Graduated hints:

A recorded radio message is present, but it is not plain English.
The file extension identifies a common encoding.
Decode last_transmission.b64 with base64 -d.

Flag 5: Lost Luggage Symlink

Concept: Recognizing a symbolic link and following it to a hidden directory.

Visible link:

/opt/airport-lab/lost-luggage

Actual file:

/opt/airport-lab/.lost-and-found/gate-42.txt

Default flag:

FLAG{lost_luggage_recovered}

Participant solution:

ls -la /opt/airport-lab
readlink -f /opt/airport-lab/lost-luggage
cat /opt/airport-lab/lost-luggage

The target can also be read directly:

cat /opt/airport-lab/.lost-and-found/gate-42.txt

Graduated hints:

Lost luggage may point somewhere unexpected.
Use ls -la and inspect symbolic links in /opt/airport-lab.
Follow or read /opt/airport-lab/lost-luggage.

Flag 6: Black-Box Archive

Concept: Listing and reading a compressed tar archive without extracting files to disk.

Location:

/opt/airport-lab/archives/black-box.tar.gz

Archived file:

flight-AZ815/maintenance-note.txt

Default flag:

FLAG{black_box_opened}

Participant solution:

tar -tzf /opt/airport-lab/archives/black-box.tar.gz
tar -xOzf /opt/airport-lab/archives/black-box.tar.gz \
  flight-AZ815/maintenance-note.txt

The capital O in -xOzf writes the archived file to standard output instead of creating a file.

Graduated hints:

The aircraft’s recovered black box is packaged as an archive.
Use tar to list its contents before opening the relevant file.
Read flight-AZ815/maintenance-note.txt from the archive with tar -xOzf.

Flag 7: Flight Recorder Strings

Concept: Extracting readable strings from a binary-like data file.

Location:

/opt/airport-lab/flight-recorder.dat

Default flag:

FLAG{flight_recorder_strings}

Participant solution:

strings /opt/airport-lab/flight-recorder.dat

A focused search is:

strings /opt/airport-lab/flight-recorder.dat | grep 'FLAG{'

Useful discovery command:

file /opt/airport-lab/flight-recorder.dat

Graduated hints:

Not every useful file is plain text.
The flight recorder contains human-readable fragments among binary bytes.
Run strings against flight-recorder.dat.

Flag 8: Departure Board Command

Concept: Discovering and running an executable available through the shell’s command path.

Command:

airport-status

Installed location:

/usr/local/bin/airport-status

Default flag:

FLAG{departure_board_online}

Participant solution:

airport-status

Useful discovery commands:

command -v airport-status
which airport-status
type airport-status
ls -la /usr/local/bin/airport-status

Graduated hints:

The system may have a custom command for checking airport operations.
Custom administrator commands are commonly installed in /usr/local/bin.
Run airport-status.

Instructor note: This is a normal shell script with mode 0755. It is not SUID and does not grant privileges.

Flag 9: Airport Beacon Process

Concept: Inspecting process arguments to find information exposed in the process list.

Systemd unit:

/etc/systemd/system/airport-beacon.service

Default flag:

FLAG{beacon_visible_in_process_list}

Participant solution:

ps auxww | grep '[a]irport-beacon'

Other approaches:

pgrep -af airport-beacon
systemctl status airport-beacon.service --no-pager
cat /etc/systemd/system/airport-beacon.service

Graduated hints:

Some secrets are exposed through running command-line arguments.
Search the full process list for an airport-related beacon.
Run ps auxww | grep '[a]irport-beacon'.

Instructor notes:

This egg is enabled by default.
It requires a systemd-based environment to appear as a running process.
In a container, chroot, WSL instance, or non-systemd distribution, the unit file may be installed without being active.
The flag remains visible in the unit file even when the service cannot run.
The service uses DynamicUser, NoNewPrivileges, a private temporary directory, and a read-only system view.
Deploy with --no-process-egg when systemd is unavailable or the process exercise is not desired.

Check its state as an instructor:

systemctl is-active airport-beacon.service
systemctl status airport-beacon.service --no-pager
journalctl -u airport-beacon.service --no-pager -n 20

Repair it with the normal deployment command:

curl -fsSL https://christiant.io/defcon-flags.sh | sudo bash

Default Flag Answer Key

FLAG{crew_credentials_found}
FLAG{boarding_log_anomaly}
FLAG{unclaimed_baggage_record}
FLAG{radio_message_decoded}
FLAG{lost_luggage_recovered}
FLAG{black_box_opened}
FLAG{flight_recorder_strings}
FLAG{departure_board_online}
FLAG{beacon_visible_in_process_list}

Fast Instructor Validation

Run the installer’s built-in validation:

curl -fsSL https://christiant.io/defcon-flags.sh \
  | sudo bash -s -- --verify-only

Or check all solutions manually:

cat /etc/airport-lab/crew_credentials.bak
grep 'FLAG{' /var/log/airport-lab/boarding.log
sqlite3 /var/lib/airport-lab/baggage.db \
  'SELECT tag, status, notes FROM baggage;'
base64 -d /opt/airport-lab/radio/last_transmission.b64
cat /opt/airport-lab/lost-luggage
tar -xOzf /opt/airport-lab/archives/black-box.tar.gz \
  flight-AZ815/maintenance-note.txt
strings /opt/airport-lab/flight-recorder.dat
airport-status
ps auxww | grep '[a]irport-beacon'

Common Questions and Troubleshooting

A participant deleted or changed a flag

Run the deployment again:

curl -fsSL https://christiant.io/defcon-flags.sh | sudo bash

This repairs the managed artifacts without requiring a separate cleanup step.

Verification reports that a custom flag is wrong

When custom environment variables were used during deployment, use the same values for --verify-only. Otherwise, the verifier expects the default flags.

Example:

curl -fsSL https://christiant.io/defcon-flags.sh \
  | sudo env FLAG_DB='FLAG{phx_unclaimed_baggage}' \
      bash -s -- --verify-only

The `sqlite3` command is missing

The database itself is still valid. Use the Python fallback shown in the database section, or install the distribution’s SQLite command-line package before the workshop.

The beacon process is missing

Check whether the system uses systemd:

ps -p 1 -o comm=
test -d /run/systemd/system && echo 'systemd runtime detected'

Then inspect the service:

systemctl status airport-beacon.service --no-pager

Repair it by rerunning the deployment. On a non-systemd system, treat the installed unit file as the fallback discovery location or omit this egg.

`curl | bash` returns a root-access error

The installer writes to system directories and must run as root:

curl -fsSL https://christiant.io/defcon-flags.sh | sudo bash

A participant asks whether exploitation is required

No. The flags demonstrate Linux discovery techniques after shell access is obtained. All intended solutions are read-only.

Optional Custom Flags

Each flag can be replaced at deployment time with an environment variable:

FLAG_CREW
FLAG_DB
FLAG_LOG
FLAG_RADIO
FLAG_HIDDEN
FLAG_ARCHIVE
FLAG_STRINGS
FLAG_COMMAND
FLAG_PROCESS

Example:

curl -fsSL https://christiant.io/defcon-flags.sh \
  | sudo env \
      FLAG_DB='FLAG{phx_unclaimed_baggage}' \
      FLAG_RADIO='FLAG{contact_ground_control}' \
      bash

Record any customized values in the instructor answer key. Repeated deployments should use the same environment values, or the defaults will replace them.

Suggested Difficulty Progression

A natural progression from easiest to more specialized is:

Crew credential backup: find, cat
Boarding log: grep
Departure board command: command discovery and execution
Lost luggage: hidden files and symbolic links
Radio transmission: Base64 decoding
Black box: archive inspection
Flight recorder: strings
Baggage database: SQLite inspection
Airport beacon: process-list inspection

The flags can be used independently, so participants do not need to complete them in this order.

DEF CON Airport Lab: Instructor Flag Guide

Deployment and Recovery

General Participant Starting Point

Flag 1: Crew Credential Backup

Flag 2: Boarding Log Anomaly

Flag 3: Unclaimed Baggage Database

Flag 4: Encoded Radio Transmission

Flag 5: Lost Luggage Symlink

Flag 6: Black-Box Archive

Flag 7: Flight Recorder Strings

Flag 8: Departure Board Command

Flag 9: Airport Beacon Process

Default Flag Answer Key

Fast Instructor Validation

Common Questions and Troubleshooting

A participant deleted or changed a flag

Verification reports that a custom flag is wrong

The sqlite3 command is missing

The beacon process is missing

curl | bash returns a root-access error

A participant asks whether exploitation is required

Optional Custom Flags

Suggested Difficulty Progression

The `sqlite3` command is missing

`curl | bash` returns a root-access error