Mission 001: scan, log in, escalate, extract
The first real CTF mission takes shape: nmap a host, get in on weak credentials, escalate to root, read the flag. The Unity terminal and mission board land with it.
Written after the fact, from the commit history and the design logs.
The first mission got its full design today. One host on a private network, SSH and a web server open, weak credentials, and a flag only root can read. You scan it with nmap, get a shell, then escalate. The target container was built to offer several careless-administrator paths: a debug log that leaks the SSH password, a backup script that sudo runs as root and anyone can edit, a find binary with the SUID bit set.
Built alongside it, in the Unity client: the terminal itself (command parser, simulated filesystem, mission state), the mission board UI, the rewards popup, and an offline fallback so the game still ran without the backend. On the backend, a migration storing the mission and its simulated command outputs.
Two weeks earlier, wallet sign-in and synchronous evidence validation with rewards had landed, so by today the loop was close to playable end to end: pick a mission, run the commands, submit the flag, get judged.
The bug of the week was a quiet one. The flag inside the Unity simulated filesystem did not match the flag in the database migration. Two sources of truth, disagreeing. It took a verification pass to even notice. That class of bug is a large part of why mission content now lives in exactly one place inside Drift Core, and why this mission is being ported there for the demo rather than kept in two halves.
No spoilers in this post. The mission survived every reset and you will get to play it.