Disobey 2023 - CTF - Deloitte 5
-------------------------------
In these challenges you were just given a server address and had to get going from there.
In this case as there were many challenges on the same host I decided to check if the site had forgot their
.git public and yes, they had it straing under the http://123.45.67.89/.git/
A perfect tool for carving out the content is the gitGet.sh tool I made a few years back.
So just ran the tool: bash gitGet.sh http://12.34.56.78 and watched it carve out the content:
Carved: file .git/HEAD
Carved: file .git/description
Carved: file .git/config
Carved: file .git/COMMIT_EDITMSG
Carved: file .git/index
Created: .git/refs/heads/
Carved: file .git/refs/heads/master
Created: .git/logs/
Carved: file .git/logs/HEAD
Created: .git/logs/refs/heads/
Carved: file .git/logs/refs/heads/master
Created: .git/info/
Carved: file .git/info/exclude
Carved: commit .git/objects/bb/f54de2cece041e8042140bd1a88abf6b1cb572
Carved: tree .git/objects/1a/ad8956589f6d7b106ae4a32ac3199705119d3e
Carved: commit .git/objects/26/daf050f486844b05053ab7e4e4964b19907f2c
Carved: tree .git/objects/1a/ad8956589f6d7b106ae4a32ac3199705119d3e
Carved: commit .git/objects/05/dfd74af0fe330b18ad770bbb8daae8eab9352d
Carved: tree .git/objects/b2/468a5a6f33b2cd1a206635e41fbf74063ee89e
Carved: commit .git/objects/f3/3e9612473766f66260e73ce682148b93f60d90
Carved: tree .git/objects/b2/468a5a6f33b2cd1a206635e41fbf74063ee89e
Carved: commit .git/objects/e4/ff6c942d237abc759d15990e320b10ebbc4404
Carved: tree .git/objects/41/aaf0786163416615ac06680fa1d5ce6ed182ed
Carved: commit .git/objects/15/16497b96e4b5c308abe36b25861a2836be6212
Carved: tree .git/objects/41/aaf0786163416615ac06680fa1d5ce6ed182ed
Carved: commit .git/objects/2b/bc49dfe52f0a488a164fd5863859fd097d6797
Carved: tree .git/objects/60/7cd8e71e319c11c2f56ec3d098a910a0194f42
Carved: commit .git/objects/01/2c73b6f228380d4da8322bb9be8e36eff25dda
Carved: tree .git/objects/60/7cd8e71e319c11c2f56ec3d098a910a0194f42
Carved: commit .git/objects/c2/519886be984e413cfdf26a80bbd118c790b4dd
Carved: tree .git/objects/4b/825dc642cb6eb9a060e54bf8d69288fbee4904
Carved: commit .git/objects/4f/c53e3fbb17b00861d98637193a0ab41bae4b97
Carved: tree .git/objects/4b/825dc642cb6eb9a060e54bf8d69288fbee4904
Carved: commit .git/objects/4f/c53e3fbb17b00861d98637193a0ab41bae4b97
Carved: tree .git/objects/4b/825dc642cb6eb9a060e54bf8d69288fbee4904
Carved: file .git/objects/1e/7b56848b1129bd5f402808417aad39426b9ef7
Carved: file .git/objects/66/655c5445edd17ebbdd2256a2fcd62782ea4e3a
Carved: file .git/objects/72/18b58a09f6e8af4545234a1b1e5aa82614feb0
Carved: file .git/objects/a4/952cfa80b1e5b624db408d0d6ee04c03889a62
Now all I had to do was find out what interesting stuff was hidden there.
Started by checking: cat .git/logs/HEAD
0000000000000000000000000000000000000000 bbf54de2cece041e8042140bd1a88abf6b1cb572 Charles Challenge 1674856889 +0200 commit (initial): first version, saving to continue working on later
bbf54de2cece041e8042140bd1a88abf6b1cb572 26daf050f486844b05053ab7e4e4964b19907f2c Charles Challenge 1671563959 +0100 commit (amend): first version, saving to continue working on later
26daf050f486844b05053ab7e4e4964b19907f2c 05dfd74af0fe330b18ad770bbb8daae8eab9352d Charles Challenge 1674856999 +0200 commit: added domain information and some other stuff, man im too tired to remember what i changed, just see the commit history ok?
05dfd74af0fe330b18ad770bbb8daae8eab9352d f33e9612473766f66260e73ce682148b93f60d90 Charles Challenge 1672927936 +0100 commit (amend): added domain information and some other stuff, man im too tired to remember what i changed, just see the commit history ok?
f33e9612473766f66260e73ce682148b93f60d90 e4ff6c942d237abc759d15990e320b10ebbc4404 Charles Challenge 1674857095 +0200 commit: an auditor told me that i cant have this in my ini file so now its gone
e4ff6c942d237abc759d15990e320b10ebbc4404 1516497b96e4b5c308abe36b25861a2836be6212 Charles Challenge 1673791936 +0100 commit (amend): an auditor told me that i cant have this in my ini file so now its gone
1516497b96e4b5c308abe36b25861a2836be6212 2bbc49dfe52f0a488a164fd5863859fd097d6797 Charles Challenge 1674857172 +0200 commit: added first version for the page. See Steve? I'm being busy and productive
2bbc49dfe52f0a488a164fd5863859fd097d6797 012c73b6f228380d4da8322bb9be8e36eff25dda Charles Challenge 1674670284 +0100 commit (amend): added first version for the page. See Steve? I'm being busy and productive
012c73b6f228380d4da8322bb9be8e36eff25dda c2519886be984e413cfdf26a80bbd118c790b4dd Charles Challenge 1674857248 +0200 commit: consider this my letter of resignation
c2519886be984e413cfdf26a80bbd118c790b4dd 4fc53e3fbb17b00861d98637193a0ab41bae4b97 Charles Challenge 1674861354 +0100 commit (amend): consider this my letter of resignation
OK, so the part where the auditor has told the creator that they can't have something in their ini file, so
that's my cue for a starting point: git checkout 1516497b96e4b5c308abe36b25861a2836be6212
Then I checked what had changed: git diff f33e9612473766f66260e73ce682148b93f60d90
diff --git a/config.ini b/config.ini
old mode 100644
new mode 100755
index 1e7b568..a4952cf
--- a/config.ini
+++ b/config.ini
---snip---
---snip---
-auth_token = DISOBEY{treasure_maps_fallen_trees}
+auth_token =
encryption = AES256
And there we had it, another flag: DISOBEY{treasure_maps_fallen_trees}
|