I have always been fascinated with text based games. Dial-up was the only thing available until I was an adult. So the only online gaming that I could do was text based. Over the years I've loved the many adventures so I decided to be nostalgic and make a CTF for Derbycon. The CTF grew and now here we are an official DEFCON 28 Contest.

Anyways I built a MUD for Derbycon over the years, and now its this huge monster so now I'm using it as a DEFCON 28 Contest.

Contest Over

The contest is over, a new one is being prepped for another conference.


This game has permadeath, when you die you reset to level 1, you will retain your stats and completed quests. Technically death doesn't cause these things but your recovery from it. Praying without "deathproof" or death insurance resets you to level 1.

You get 3 lives total, death insurance only protects you from the level reset. Actual death or stat re-rolls will deduct from your life total. Upon your third death your character will be deleted.


Cheat codes have been published and their usage will prevent the display of flags. Checkout the cheat console in colony to discover how to enable cheats.


There are intentional bugs in this game, also many many unintentional ones. Feel free to exploit them. If you find a way to bypass the cheat system feel free to utilize it. Also beware of traps, some exploits may have unintended consequences.

Fuzzing the game with urandom to crash clients or the game will result in disqualification.


  • winner of the contest must demonstrate control over the character account in Las Vegas by logging into the game at Defcon 29
  • all judgements by evilmog are final, no appeals
  • winner will be the player with the most points on the ctf board as of Sunday Morning at 0900 of Defcon 28
  • in the event of a tie, some sort of tie breaker will be created
  • if the winner is unavailable or evilmog gets impatient and other players of the MUD ctf are present in Las Vegas, the human badge will be awarded to the highest ranked player present
  • pickup of the badge will be on badge day of Defcon 29, the inhuman registration line is apparently short, location to be determined and oddly arbitrary
  • hints and rules will be announced on twitter
  • game administrators with legit access to source codes not eligible, I may waive this rule if no winners can make it to vegas
  • reported bugs via the bug command that can be used to fix this bug may be awarded CTF points at evilmogs discretion
  • ctf board name must be your player name so I can identify you, if it's not you may not get a prize
  • bots, triggers, timers etc are fully allowed
  • updates in game cannot be trusted
  • mxp support is in
  • I may or may not abuse certain parts of the telnet protocol
  • do not fuzz the game with random input, there are some protections but this is an old server, it won't buffer overflow due to the sandbox but you will spin the CPU