|
| 1 | +--- |
| 2 | +title: Private Github Repository |
| 3 | +date: 2024-12-23 19:47:00 +/-0600 |
| 4 | +categories: [Capture The Flags, 1337Up Live 2024] |
| 5 | +tags: [ctf, 1337up, osint, writeups] |
| 6 | +pin: true |
| 7 | +--- |
| 8 | + |
| 9 | +Challenge description: |
| 10 | + |
| 11 | +> Bob Robizillo created a public instructions for Tiffany, so she can start work on new secret project. can you access the secret repository? |
| 12 | +
|
| 13 | +Unfortunately, or, rather fortunately, there is no way to see a private GitHub repository unless you've been invited as a collaborator. So lets leverage our amazing OSINT skills to find any trace of Mr. Robizillo on the Internet. Now, your results may vary, but for me `"Robizillo" site:github.com` turned up nothing, so I then tied with a more general search `"Robizillo"`. And now we see why the first search turned up nothing, it's a github gist! Lets t ake a look at what it says. |
| 14 | + |
| 15 | + |
| 16 | + |
| 17 | +Hm, the provided "key" doesn't seem to be an actual SSH/RSA Key, I wonder if it's an encrypted message of some sorts. My favorite site to use for decryption is [CyberChef](https://gchq.github.io/CyberChef/), so lets copy and paste the encrypted message into there. |
| 18 | + |
| 19 | +Now, when using CyberChef, you create a 'recipe' using blocks that do various functions. One of the more useful ones to always start with is the `magic` block, as it try's to automatically detect what you can do to it. It's very helpful for when you have no idea where to even begin, or if you are stuck and don't know where to go next. For this time around, it recommended we do `From Base64` and then `Unzip`, so lets load that into the recipe and see what we get! |
| 20 | + |
| 21 | + |
| 22 | + |
| 23 | +Looks like there was a file hidden in the message! Let's download the file and see what we get. Once its on our machine we'll use `cat id_rsa` to output it to the commandline |
| 24 | + |
| 25 | + |
| 26 | + |
| 27 | +Looks like we now have a private key for ssh. Remember back to the message that Bob Robizillo said TIffany would have to add it in order to work on the repository. Lets add the key to our session and try to clone the `1337up` repository Bob mentioned in his earlier message. Since we know Bob's username is `bob-193`, we can be pretty sure that the repository is hidden in there. First things first, we need to add the key. `ssh-add id_rsa` takes care of that perfectly, and `git clone git@ithub.com:bob-193/1337up` gets us the repository! |
| 28 | + |
| 29 | + |
| 30 | + |
| 31 | + |
| 32 | + |
| 33 | +Checking inside the repository shows up a file named `readme.md`, which reads: |
| 34 | + |
| 35 | +> Hey, Tiffany! You will need to save this repo in your user space and implement changes we agreed earlier. |
| 36 | +
|
| 37 | + |
| 38 | + |
| 39 | +Hm, thats not very helpful. A further inspection of `git log` shows only the one commit, and there's nothing hidden in the `.git` directory. Is this the end of the line? We know we need to find Tiffany's username since she made a fork of the repository. We know she did because Bob alluded to it in his first message, and now in the recent `readme.md`. If only we had a way to authenticate a key... but wait! we do! Lets take a closer look at the `ssh` command. |
| 40 | + |
| 41 | +```terminal |
| 42 | +┌─[slavetomints@parrot]─[~] |
| 43 | +└──╼ $ssh |
| 44 | +usage: ssh [-46AaCfGgKkMNnqsTtVvXxYy] [-B bind_interface] |
| 45 | + [-b bind_address] [-c cipher_spec] [-D [bind_address:]port] |
| 46 | + [-E log_file] [-e escape_char] [-F configfile] [-I pkcs11] |
| 47 | + [-i identity_file] [-J [user@]host[:port]] [-L address] |
| 48 | + [-l login_name] [-m mac_spec] [-O ctl_cmd] [-o option] [-p port] |
| 49 | + [-Q query_option] [-R address] [-S ctl_path] [-W host:port] |
| 50 | + [-w local_tun[:remote_tun]] destination [command [argument ...]] |
| 51 | +``` |
| 52 | + |
| 53 | +Now, most of that isn't going to be useful to us, except for the `-i` option Checking the manpage for `ssh` also shows up the `-T` option. Lets take a closer look at each. |
| 54 | + |
| 55 | +The `-T` option tells ssh to no allocate a pseudo-terminal for the connection. Since we don't need a terminal for authenticating, theres no reason to allocate one. This should show the difference between using and not using it. |
| 56 | + |
| 57 | +```terminal |
| 58 | +┌─[slavetomints@parrot]─[~] |
| 59 | +└──╼ $ssh git@github.com |
| 60 | +PTY allocation request failed on channel 0 |
| 61 | +Hi Slavetomints! You've successfully authenticated, but GitHub does not provide shell access. |
| 62 | +Connection to github.com closed. |
| 63 | +┌─[✗]─[slavetomints@parrot]─[~] |
| 64 | +└──╼ $ssh -T git@github.com |
| 65 | +Hi Slavetomints! You've successfully authenticated, but GitHub does not provide shell access. |
| 66 | +``` |
| 67 | + |
| 68 | +It's not required to use it, but it helps to keep the terminal a little bit clearer. Now, the `-i` option specifies an identity file to use, such as the `id_rsa` file we have. So, now we can try to authenticate with GitHub using that identity only. The full command now is `ssh -T -i id_rsa git@github.com`. |
| 69 | + |
| 70 | + |
| 71 | + |
| 72 | +This is great! Now we know Tiffany's username, so we can clone over her fork of the `1337up` repository! |
| 73 | + |
| 74 | + |
| 75 | + |
| 76 | +Let's poke around a bit in here. we see the same `readme.md` from earlier, but now there's also a `config/` directory. Going into that and checking it out reveals a `.env` file which unfortunately doesn't contain a flag. |
| 77 | + |
| 78 | + |
| 79 | + |
| 80 | +However, `git log` does show that theres been 4 commits on this repo. While its possible to use `git diff [<options>] [<commit>]` to see the changes in a commit, I prefer to use VSCodes built in git log functionality. And looking at the changelogs there for previous commits reveals... |
| 81 | + |
| 82 | + |
| 83 | + |
| 84 | + |
| 85 | + |
| 86 | + |
| 87 | + |
| 88 | +Another repository! Ugh this is getting kind tedious, but nevertheless, lets clone that one and check it out |
| 89 | + |
| 90 | + |
| 91 | + |
| 92 | + |
| 93 | + |
| 94 | +Finally! We've found the flag, but we should clean up first. All we'll need to do is run `ssh-add -d is_rsa` to remove that key, because we don't need it anymore, and we're all good! Hopefully you learned a thing or two about git and GitHub on your way here. |
| 95 | + |
| 96 | +FLAG: INTIGRITI{9e0121bb8bce15ead3d7f529a81b77b4} |
0 commit comments