Adventures in Version Control Link to heading

Version control is awesome, it really is! Especially Git. But sometimes, site admins or devs make stupid mistakes, and one of these mistakes is failing to cleanup after one’s self when deploying.

In this simple room, the goal is to figure out which username and password combination will unlock the rest of the site. So let’s get cracking.

First Steps: nmap Link to heading

nmap is a universal first step to see what’s what is a room. It’ll help us get the lay of the land and may help find our first real foothold. So let’s see what we have:


nmap -sS -A $TARGET_IP
Starting Nmap 7.80 ( https://nmap.org ) at 2020-07-24 22:10 CEST
Nmap scan report for $TARGET_IP
Host is up (0.029s latency).
Not shown: 999 closed ports
PORT   STATE SERVICE VERSION
80/tcp open  http    nginx 1.14.0 (Ubuntu)
| http-git:
|   $TARGET_IP:80/.git/
|     Git repository found!
|_    Repository description: Unnamed repository; edit this file 'description' to name the...
|_http-server-header: nginx/1.14.0 (Ubuntu)
|_http-title: Super Awesome Site!
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.80%E=4%D=7/24%OT=80%CT=1%CU=42951%PV=Y%DS=2%DC=T%G=Y%TM=5F1B404
OS:B%P=x86_64-pc-linux-gnu)SEQ(SP=107%GCD=1%ISR=105%TI=Z%CI=Z%II=I%TS=A)OPS
OS:(O1=M508ST11NW7%O2=M508ST11NW7%O3=M508NNT11NW7%O4=M508ST11NW7%O5=M508ST1
OS:1NW7%O6=M508ST11)WIN(W1=F4B3%W2=F4B3%W3=F4B3%W4=F4B3%W5=F4B3%W6=F4B3)ECN
OS:(R=Y%DF=Y%T=40%W=F507%O=M508NNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=A
OS:S%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R
OS:=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F
OS:=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%
OS:T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD
OS:=S)

Network Distance: 2 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using port 587/tcp)
HOP RTT      ADDRESS
1   29.11 ms 10.11.0.1
2   29.17 ms $TARGET_IP

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 23.30 seconds

We can see that there’s only 1 server running on port 80, and an exposed git repository. This may come in handy later on.

Checking Out The Server Link to heading

So we can explore the server a bit with our good friend curl.


curl 10.10.124.73
&lt;!DOCTYPE html&gt;
&lt;html lang=&#34;en&#34;&gt;
  &lt;head&gt;
    &lt;meta charset=&#34;UTF-8&#34; /&gt;
    &lt;meta name=&#34;viewport&#34; content=&#34;width=device-width, initial-scale=1.0&#34; /&gt;
    &lt;title&gt;Super Awesome Site!&lt;/title&gt;
    &lt;link rel=&#34;stylesheet&#34; href=&#34;/css/style.css&#34;&gt;
  &lt;/head&gt;
  &lt;body&gt;
    &lt;h1&gt;Login&lt;/h1&gt;
    &lt;form class=&#34;login-form&#34; id=&#34;login-form&#34;&gt;
     &lt;div class=&#34;flex-row&#34;&gt;
         &lt;p class=&#34;error&#34; id=&#34;error&#34;&gt;&lt;/p&gt;
     &lt;/div&gt;
      &lt;div class=&#34;flex-row&#34;&gt;
        &lt;label class=&#34;lf--label&#34; for=&#34;username&#34;&gt;
          &lt;svg x=&#34;0px&#34; y=&#34;0px&#34; width=&#34;12px&#34; height=&#34;13px&#34;&gt;
            &lt;path
              fill=&#34;#B1B7C4&#34;
              d=&#34;M8.9,7.2C9,6.9,9,6.7,9,6.5v-4C9,1.1,7.9,0,6.5,0h-1C4.1,0,3,1.1,3,2.5v4c0,0.2,0,0.4,0.1,0.7 C1.3,7.8,0,9.5,0,11.5V13h12v-1.5C12,9.5,10.7,7.8,8.9,7.2z M4,2.5C4,1.7,4.7,1,5.5,1h1C7.3,1,8,1.7,8,2.5v4c0,0.2,0,0.4-0.1,0.6 l0.1,0L7.9,7.3C7.6,7.8,7.1,8.2,6.5,8.2h-1c-0.6,0-1.1-0.4-1.4-0.9L4.1,7.1l0.1,0C4,6.9,4,6.7,4,6.5V2.5z M11,12H1v-0.5 c0-1.6,1-2.9,2.4-3.4c0.5,0.7,1.2,1.1,2.1,1.1h1c0.8,0,1.6-0.4,2.1-1.1C10,8.5,11,9.9,11,11.5V12z&#34;
            /&gt;
          &lt;/svg&gt;
        &lt;/label&gt;
        &lt;input
          id=&#34;username&#34;
          name=&#34;username&#34;
          class=&#34;lf--input&#34;
          placeholder=&#34;Username&#34;
          type=&#34;text&#34;
        /&gt;
      &lt;/div&gt;
      &lt;div class=&#34;flex-row&#34;&gt;
        &lt;label class=&#34;lf--label&#34; for=&#34;password&#34;&gt;
          &lt;svg x=&#34;0px&#34; y=&#34;0px&#34; width=&#34;15px&#34; height=&#34;5px&#34;&gt;
            &lt;g&gt;
              &lt;path
                fill=&#34;#B1B7C4&#34;
                d=&#34;M6,2L6,2c0-1.1-1-2-2.1-2H2.1C1,0,0,0.9,0,2.1v0.8C0,4.1,1,5,2.1,5h1.7C5,5,6,4.1,6,2.9V3h5v1h1V3h1v2h1V3h1 V2H6z M5.1,2.9c0,0.7-0.6,1.2-1.3,1.2H2.1c-0.7,0-1.3-0.6-1.3-1.2V2.1c0-0.7,0.6-1.2,1.3-1.2h1.7c0.7,0,1.3,0.6,1.3,1.2V2.9z&#34;
              /&gt;
            &lt;/g&gt;
          &lt;/svg&gt;
        &lt;/label&gt;
        &lt;input
          id=&#34;password&#34;
          name=&#34;password&#34;
          class=&#34;lf--input&#34;
          placeholder=&#34;Password&#34;
          type=&#34;password&#34;
        /&gt;
      &lt;/div&gt;
      &lt;input class=&#39;lf--submit&#39; type=&#34;button&#34; value=&#34;LOGIN&#34; onclick=&#34;login()&#34; /&gt;
    &lt;/form&gt;
   &lt;script&gt;
        const _0x4368=[&#39;+(\x20+[^&#39;,&#39;471197&#39;,&#39;value&#39;,&#39;RegExp&#39;,&#39;functi&#39;,&#39;test&#39;,&#39;CbRnH&#39;,&#39;passwo&#39;,&#39;userna&#39;,&#39;TML&#39;,&#39;tml&#39;,&#39;a865c5&#39;,&#39;+[^\x20]}&#39;,&#39;a5f298&#39;,&#39;cookie&#39;,&#39;admin&#39;,&#39;3a71fd&#39;,&#39;getEle&#39;,&#39;login-&#39;,&#39;^([^\x20]&#39;,&#39;TEhxP&#39;,&#39;href&#39;,&#39;f64cb3&#39;,&#39;51a151&#39;,&#39;d84319&#39;,&#39;D\x20USER&#39;,&#39;digest&#39;,&#39;R\x20PASS&#39;,&#39;oard.h&#39;,&#39;error&#39;,&#39;\x20]+)+)&#39;,&#39;19a3c0&#39;,&#39;f80f67&#39;,&#39;/dashb&#39;,&#39;bea070&#39;,&#39;3ec9cb&#39;,&#39;padSta&#39;,&#39;from&#39;,&#39;4004c2&#39;,&#39;WORD!&#39;,&#39;map&#39;,&#39;NAME\x20O&#39;,&#39;encode&#39;,&#39;INVALI&#39;,&#39;a5106e&#39;,&#39;baf89f&#39;,&#39;6a7c7c&#39;,&#39;elemen&#39;,&#39;9a88db&#39;,&#39;log&#39;,&#39;join&#39;,&#39;innerH&#39;,&#39;SaltyB&#39;,&#39;apply&#39;,&#39;ned&#39;,&#39;442a9d&#39;,&#39;mentBy&#39;];(function(_0x1ef2d8,_0x436806){const _0x2c2818=function(_0x302738){while(--_0x302738){_0x1ef2d8[&#39;push&#39;](_0x1ef2d8[&#39;shift&#39;]());}},_0x6f8b4a=function(){const _0x2e9681={&#39;data&#39;:{&#39;key&#39;:&#39;cookie&#39;,&#39;value&#39;:&#39;timeout&#39;},&#39;setCookie&#39;:function(_0x329b53,_0x28dc3d,_0x22f4a3,_0x6012c1){_0x6012c1=_0x6012c1||{};let _0x3d8f23=_0x28dc3d+&#39;=&#39;+_0x22f4a3,_0x18026e=0x0;for(let _0x4175c9=0x0,_0x25d1be=_0x329b53[&#39;length&#39;];_0x4175c9&lt;_0x25d1be;_0x4175c9++){const _0x109e81=_0x329b53[_0x4175c9];_0x3d8f23+=&#39;;\x20&#39;+_0x109e81;const _0x1e9a27=_0x329b53[_0x109e81];_0x329b53[&#39;push&#39;](_0x1e9a27),_0x25d1be=_0x329b53[&#39;length&#39;],_0x1e9a27!==!![]&amp;&amp;(_0x3d8f23+=&#39;=&#39;+_0x1e9a27);}_0x6012c1[&#39;cookie&#39;]=_0x3d8f23;},&#39;removeCookie&#39;:function(){return&#39;dev&#39;;},&#39;getCookie&#39;:function(_0x3e797a,_0x2a5b7d){_0x3e797a=_0x3e797a||function(_0x242cdf){return _0x242cdf;};const _0x996bc1=_0x3e797a(new RegExp(&#39;(?:^|;\x20)&#39;+_0x2a5b7d[&#39;replace&#39;](/([.$?*|{}()[]\/+^])/g,&#39;$1&#39;)+&#39;=([^;]*)&#39;)),_0x51d0ee=function(_0x439650,_0x52fa41){_0x439650(++_0x52fa41);};return _0x51d0ee(_0x2c2818,_0x436806),_0x996bc1?decodeURIComponent(_0x996bc1[0x1]):undefined;}},_0x17997b=function(){const _0x383e88=new RegExp(&#39;\x5cw+\x20*\x5c(\x5c)\x20*{\x5cw+\x20*[\x27|\x22].+[\x27|\x22];?\x20*}&#39;);return _0x383e88[&#39;test&#39;](_0x2e9681[&#39;removeCookie&#39;][&#39;toString&#39;]());};_0x2e9681[&#39;updateCookie&#39;]=_0x17997b;let _0x39ee22=&#39;&#39;;const _0xad377=_0x2e9681[&#39;updateCookie&#39;]();if(!_0xad377)_0x2e9681[&#39;setCookie&#39;]([&#39;*&#39;],&#39;counter&#39;,0x1);else _0xad377?_0x39ee22=_0x2e9681[&#39;getCookie&#39;](null,&#39;counter&#39;):_0x2e9681[&#39;removeCookie&#39;]();};_0x6f8b4a();}(_0x4368,0xe6));const _0x2c28=function(_0x1ef2d8,_0x436806){_0x1ef2d8=_0x1ef2d8-0x0;let _0x2c2818=_0x4368[_0x1ef2d8];return _0x2c2818;};const _0x22f4a3=function(){let _0x36b504=!![];return function(_0x1087c7,_0x108f32){if(_0x2c28(&#39;0x4&#39;)===_0x2c28(&#39;0x4&#39;)){const _0x52d1da=_0x36b504?function(){if(_0x2c28(&#39;0x12&#39;)!==_0x2c28(&#39;0x12&#39;)){function _0x382a78(){document[_0x2c28(&#39;0xf&#39;)+_0x2c28(&#39;0x36&#39;)+&#39;Id&#39;](_0x2c28(&#39;0x1b&#39;))[&#39;innerH&#39;+_0x2c28(&#39;0x7&#39;)]=_0x2c28(&#39;0x29&#39;)+_0x2c28(&#39;0x17&#39;)+&#39;NAME\x20O&#39;+_0x2c28(&#39;0x19&#39;)+_0x2c28(&#39;0x25&#39;);}}else{if(_0x108f32){const _0x725292=_0x108f32[_0x2c28(&#39;0x33&#39;)](_0x1087c7,arguments);return _0x108f32=null,_0x725292;}}}:function(){};return _0x36b504=![],_0x52d1da;}else{function _0x323170(){const _0x2ed5f9=_0x36b504?function(){if(_0x108f32){const _0x407994=_0x108f32[_0x2c28(&#39;0x33&#39;)](_0x1087c7,arguments);return _0x108f32=null,_0x407994;}}:function(){};return _0x36b504=![],_0x2ed5f9;}}};}(),_0x28dc3d=_0x22f4a3(this,function(){const _0x5b8de6=typeof window!==&#39;undefi&#39;+_0x2c28(&#39;0x34&#39;)?window:typeof process===&#39;object&#39;&amp;&amp;typeof require===_0x2c28(&#39;0x2&#39;)+&#39;on&#39;&amp;&amp;typeof global===&#39;object&#39;?global:this,_0x4d9f75=function(){const _0x1eee2f=new _0x5b8de6[(_0x2c28(&#39;0x1&#39;))](_0x2c28(&#39;0x11&#39;)+_0x2c28(&#39;0x37&#39;)+_0x2c28(&#39;0x1c&#39;)+_0x2c28(&#39;0xa&#39;));return!_0x1eee2f[_0x2c28(&#39;0x3&#39;)](_0x28dc3d);};return _0x4d9f75();});_0x28dc3d();async function login(){let _0x110afb=document[_0x2c28(&#39;0xf&#39;)+_0x2c28(&#39;0x36&#39;)+&#39;Id&#39;](_0x2c28(&#39;0x10&#39;)+&#39;form&#39;);console[_0x2c28(&#39;0x2f&#39;)](_0x110afb[_0x2c28(&#39;0x2d&#39;)+&#39;ts&#39;]);let _0x383cb8=_0x110afb[_0x2c28(&#39;0x2d&#39;)+&#39;ts&#39;][_0x2c28(&#39;0x6&#39;)+&#39;me&#39;][_0x2c28(&#39;0x0&#39;)],_0x5b6063=await digest(_0x110afb[_0x2c28(&#39;0x2d&#39;)+&#39;ts&#39;][_0x2c28(&#39;0x5&#39;)+&#39;rd&#39;][_0x2c28(&#39;0x0&#39;)]);_0x383cb8===_0x2c28(&#39;0xd&#39;)&amp;&amp;_0x5b6063===_0x2c28(&#39;0x24&#39;)+_0x2c28(&#39;0xe&#39;)+&#39;6ba9b0&#39;+_0x2c28(&#39;0x21&#39;)+&#39;7eed08&#39;+_0x2c28(&#39;0x38&#39;)+_0x2c28(&#39;0x16&#39;)+_0x2c28(&#39;0x9&#39;)+_0x2c28(&#39;0x35&#39;)+_0x2c28(&#39;0x2c&#39;)+_0x2c28(&#39;0x20&#39;)+&#39;f3cb6a&#39;+_0x2c28(&#39;0x2a&#39;)+_0x2c28(&#39;0x1e&#39;)+_0x2c28(&#39;0x2e&#39;)+_0x2c28(&#39;0x2b&#39;)+_0x2c28(&#39;0x14&#39;)+_0x2c28(&#39;0x15&#39;)+_0x2c28(&#39;0xb&#39;)+_0x2c28(&#39;0x1d&#39;)+&#39;94eceb&#39;+&#39;bb&#39;?(document[_0x2c28(&#39;0xc&#39;)]=&#39;login=&#39;+&#39;1&#39;,window[&#39;locati&#39;+&#39;on&#39;][_0x2c28(&#39;0x13&#39;)]=_0x2c28(&#39;0x1f&#39;)+_0x2c28(&#39;0x1a&#39;)+_0x2c28(&#39;0x8&#39;)):document[&#39;getEle&#39;+_0x2c28(&#39;0x36&#39;)+&#39;Id&#39;](_0x2c28(&#39;0x1b&#39;))[_0x2c28(&#39;0x31&#39;)+_0x2c28(&#39;0x7&#39;)]=_0x2c28(&#39;0x29&#39;)+_0x2c28(&#39;0x17&#39;)+_0x2c28(&#39;0x27&#39;)+_0x2c28(&#39;0x19&#39;)+_0x2c28(&#39;0x25&#39;);}async function digest(_0x35521d){const _0x179c00=new TextEncoder(),_0x713734=_0x179c00[_0x2c28(&#39;0x28&#39;)](_0x35521d+(_0x2c28(&#39;0x32&#39;)+&#39;ob&#39;)),_0x39b76f=await crypto[&#39;subtle&#39;][_0x2c28(&#39;0x18&#39;)](&#39;SHA-51&#39;+&#39;2&#39;,_0x713734),_0x558ac0=Array[_0x2c28(&#39;0x23&#39;)](new Uint8Array(_0x39b76f)),_0x34e00e=_0x558ac0[_0x2c28(&#39;0x26&#39;)](_0x468ec7=&gt;_0x468ec7[&#39;toStri&#39;+&#39;ng&#39;](0x10)[_0x2c28(&#39;0x22&#39;)+&#39;rt&#39;](0x2,&#39;0&#39;))[_0x2c28(&#39;0x30&#39;)](&#39;&#39;);return _0x34e00e;}
  &lt;/script&gt;
  &lt;/body&gt;
&lt;/html&gt;

So we have what looks like a login form and some heavily obfuscated javascript. This probably looks like a dead end. Or does it?

Silliness and Version Control Link to heading

With some luck (for us), the developpers left the entire history of the codebase open for all to see. We can abuse this and download the git repository using wget:


wget --mirror -I .git $TARGET_IP/.git/
Connecting to 10.10.124.73:80... connected.
HTTP request sent, awaiting response... 200 OK

...Some Time Later...

FINISHED --2020-07-24 22:33:48--
Total wall clock time: 3.1s
Downloaded: 48 files, 20K in 0s (55.0 MB/s)

I won’t put the whole command here because it’s kind of verbose and pointless. Basically because the directory listing was left on by inadvertence, we can easily mirror the site. Had this not been the case, we would have to rebuild the repository piece by bloody piece. And that’s just no fun at all.

If we enter the newly created directory, we can see a plain .git directory, and nothing else.


pwd
/home/hydra/.../git-happens/$TARGET_IP
ls -la
total 12
drwxr-xr-x 3 hydra hydra 4096 Jul 24 22:35 .
drwxr-xr-x 3 hydra hydra 4096 Jul 24 22:35 ..
drwxr-xr-x 8 hydra hydra 4096 Jul 24 22:35 .git

We can use the standard git commands to see what’s up:


git status
On branch master
Changes not staged for commit:
  (use "git add/rm ..." to update what will be committed)
  (use "git restore ..." to discard changes in working directory)
        deleted:    .gitlab-ci.yml
        deleted:    Dockerfile
        deleted:    README.md
        deleted:    css/style.css
        deleted:    dashboard.html
        deleted:    default.conf
        deleted:    index.html

no changes added to commit (use "git add" and/or "git commit -a")
git reset HEAD --hard
HEAD is now at d0b3578 Update .gitlab-ci.yml
ls -la
total 44
drwxr-xr-x 4 hydra hydra 4096 Jul 24 22:41 .
drwxr-xr-x 3 hydra hydra 4096 Jul 24 22:35 ..
drwxr-xr-x 2 hydra hydra 4096 Jul 24 22:41 css
-rw-r--r-- 1 hydra hydra 3775 Jul 24 22:41 dashboard.html
-rw-r--r-- 1 hydra hydra 1115 Jul 24 22:41 default.conf
-rw-r--r-- 1 hydra hydra  120 Jul 24 22:41 Dockerfile
drwxr-xr-x 8 hydra hydra 4096 Jul 24 22:41 .git
-rw-r--r-- 1 hydra hydra  792 Jul 24 22:41 .gitlab-ci.yml
-rw-r--r-- 1 hydra hydra 6890 Jul 24 22:41 index.html
-rw-r--r-- 1 hydra hydra   54 Jul 24 22:41 README.md

So here we used git status to get a feel for what’s going on, git reset to reset the repository state to what the master branch should be, and behold! files!

We see that the site has a dashboard.html file, let’s see if there’s a flag hiding there.


curl 10.10.124.73/dashboard.html
&lt;!DOCTYPE html&gt;
&lt;html lang=&#34;en&#34;&gt;
  &lt;head&gt;
    &lt;meta charset=&#34;UTF-8&#34; /&gt;
    &lt;meta name=&#34;viewport&#34; content=&#34;width=device-width, initial-scale=1.0&#34; /&gt;
    &lt;title&gt;Awesome!&lt;/title&gt;
    &lt;link rel=&#34;stylesheet&#34; href=&#34;/css/style.css&#34; /&gt;
  &lt;/head&gt;
  &lt;body onload=&#34;checkCookie()&#34;&gt;
    &lt;p class=&#34;rainbow-text&#34;&gt;Awesome! Use the password you input as the flag!&lt;/p&gt;
  &lt;script&gt;
      var _0x13f2=[&#39;The\x20co&#39;,&#39;test&#39;,&#39;href&#39;,&#39;okie\x20\x22&#39;,&#39;RegExp&#39;,&#39;locati&#39;,&#39;+[^\x20]}&#39;,&#39;\x20value&#39;,&#39;hvvqf&#39;,&#39;split&#39;,&#39;apply&#39;,&#39;\x20has\x20\x22&#39;,&#39;UmvzZ&#39;,&#39;+(\x20+[^&#39;,&#39;undefi&#39;,&#39;includ&#39;,&#39;functi&#39;,&#39;/index&#39;,&#39;object&#39;,&#39;login\x22&#39;,&#39;BzWoi&#39;,&#39;JSjhF&#39;,&#39;1\x22\x20for&#39;,&#39;.html&#39;,&#39;log&#39;];(function(_0x25afd6,_0x13f2ae){var _0x293e02=function(_0x39bb51){while(--_0x39bb51){_0x25afd6[&#39;push&#39;](_0x25afd6[&#39;shift&#39;]());}},_0x4e9f94=function(){var _0x664dc3={&#39;data&#39;:{&#39;key&#39;:&#39;cookie&#39;,&#39;value&#39;:&#39;timeout&#39;},&#39;setCookie&#39;:function(_0x5504a4,_0x228943,_0x1cdb91,_0x1e9670){_0x1e9670=_0x1e9670||{};var _0x39bcf8=_0x228943+&#39;=&#39;+_0x1cdb91,_0x53f475=0x0;for(var _0x13cc7b=0x0,_0x264136=_0x5504a4[&#39;length&#39;];_0x13cc7b&lt;_0x264136;_0x13cc7b++){var _0x44c799=_0x5504a4[_0x13cc7b];_0x39bcf8+=&#39;;\x20&#39;+_0x44c799;var _0x42ecce=_0x5504a4[_0x44c799];_0x5504a4[&#39;push&#39;](_0x42ecce),_0x264136=_0x5504a4[&#39;length&#39;],_0x42ecce!==!![]&amp;&amp;(_0x39bcf8+=&#39;=&#39;+_0x42ecce);}_0x1e9670[&#39;cookie&#39;]=_0x39bcf8;},&#39;removeCookie&#39;:function(){return&#39;dev&#39;;},&#39;getCookie&#39;:function(_0x1baf49,_0x45f075){_0x1baf49=_0x1baf49||function(_0x2f4c45){return _0x2f4c45;};var _0x19df86=_0x1baf49(new RegExp(&#39;(?:^|;\x20)&#39;+_0x45f075[&#39;replace&#39;](/([.$?*|{}()[]\/+^])/g,&#39;$1&#39;)+&#39;=([^;]*)&#39;)),_0x264820=function(_0x344491,_0x554a27){_0x344491(++_0x554a27);};return _0x264820(_0x293e02,_0x13f2ae),_0x19df86?decodeURIComponent(_0x19df86[0x1]):undefined;}},_0x1feb05=function(){var _0x16aab2=new RegExp(&#39;\x5cw+\x20*\x5c(\x5c)\x20*{\x5cw+\x20*[\x27|\x22].+[\x27|\x22];?\x20*}&#39;);return _0x16aab2[&#39;test&#39;](_0x664dc3[&#39;removeCookie&#39;][&#39;toString&#39;]());};_0x664dc3[&#39;updateCookie&#39;]=_0x1feb05;var _0x4984a0=&#39;&#39;;var _0x29b714=_0x664dc3[&#39;updateCookie&#39;]();if(!_0x29b714)_0x664dc3[&#39;setCookie&#39;]([&#39;*&#39;],&#39;counter&#39;,0x1);else _0x29b714?_0x4984a0=_0x664dc3[&#39;getCookie&#39;](null,&#39;counter&#39;):_0x664dc3[&#39;removeCookie&#39;]();};_0x4e9f94();}(_0x13f2,0x102));var _0x293e=function(_0x25afd6,_0x13f2ae){_0x25afd6=_0x25afd6-0x0;var _0x293e02=_0x13f2[_0x25afd6];return _0x293e02;};var _0x1cdb91=function(){var _0x371b4e=!![];return function(_0x595c10,_0x69462f){var _0x2b09a3=_0x371b4e?function(){if(_0x69462f){if(_0x293e(&#39;0x4&#39;)!==_0x293e(&#39;0x0&#39;)){var _0x97fad5=_0x69462f[_0x293e(&#39;0x2&#39;)](_0x595c10,arguments);return _0x69462f=null,_0x97fad5;}else{function _0x38efef(){var _0x850131=_0x371b4e?function(){if(_0x69462f){var _0x568ca6=_0x69462f[_0x293e(&#39;0x2&#39;)](_0x595c10,arguments);return _0x69462f=null,_0x568ca6;}}:function(){};return _0x371b4e=![],_0x850131;}}}}:function(){};return _0x371b4e=![],_0x2b09a3;};}(),_0x228943=_0x1cdb91(this,function(){var _0x3b903a=typeof window!==_0x293e(&#39;0x6&#39;)+&#39;ned&#39;?window:typeof process===_0x293e(&#39;0xa&#39;)&amp;&amp;typeof require===_0x293e(&#39;0x8&#39;)+&#39;on&#39;&amp;&amp;typeof global===&#39;object&#39;?global:this,_0x2859ed=function(){if(_0x293e(&#39;0xd&#39;)!==_0x293e(&#39;0xc&#39;)){var _0x1ea358=new _0x3b903a[(_0x293e(&#39;0x15&#39;))](&#39;^([^\x20]&#39;+_0x293e(&#39;0x5&#39;)+&#39;\x20]+)+)&#39;+_0x293e(&#39;0x17&#39;));return!_0x1ea358[_0x293e(&#39;0x12&#39;)](_0x228943);}else{function _0x454428(){console[_0x293e(&#39;0x10&#39;)](_0x293e(&#39;0x11&#39;)+_0x293e(&#39;0x14&#39;)+_0x293e(&#39;0xb&#39;)+&#39;\x20has\x20\x22&#39;+&#39;1\x22\x20for&#39;+_0x293e(&#39;0x18&#39;));}}};return _0x2859ed();});_0x228943();function checkCookie(){document[&#39;cookie&#39;][_0x293e(&#39;0x1&#39;)](&#39;;&#39;)[&#39;some&#39;](_0x5b421e=&gt;_0x5b421e[_0x293e(&#39;0x7&#39;)+&#39;es&#39;](&#39;login=&#39;+&#39;1&#39;))?console[_0x293e(&#39;0x10&#39;)](_0x293e(&#39;0x11&#39;)+_0x293e(&#39;0x14&#39;)+_0x293e(&#39;0xb&#39;)+_0x293e(&#39;0x3&#39;)+_0x293e(&#39;0xe&#39;)+_0x293e(&#39;0x18&#39;)):window[_0x293e(&#39;0x16&#39;)+&#39;on&#39;][_0x293e(&#39;0x13&#39;)]=_0x293e(&#39;0x9&#39;)+_0x293e(&#39;0xf&#39;);}
  &lt;/script&gt;
  &lt;/body&gt;
&lt;/html&gt;

Drats, looks like we need that password afterall. We can use the git log command to see the history


git log --oneline --graph
* d0b3578 (HEAD -> master, tag: v1.0) Update .gitlab-ci.yml
* 77aab78 add gitlab-ci config to build docker file.
* 2eb93ac setup dockerfile and setup defaults.
* d6df400 Make sure the css is standard-ish!
* d954a99 re-obfuscating the code to be really secure!
* bc8054d Security says obfuscation isn't enough.
* e56eaa8 Obfuscated the source code.
* 395e087 Made the login page, boss!
* 2f42369 Initial commit

We can explore the source some, but from the logs, it looks like commit number 395e087 is interesting. let’s check it out (literally)


git checkout 395e087
Note: switching to '395e087'.

You are in 'detached HEAD' state. You can look around, make experimental
changes and commit them, and you can discard any commits you make in this
state without impacting any branches by switching back to a branch.

If you want to create a new branch to retain commits you create, you may
do so (now or later) by using -c with the switch command. Example:

  git switch -c 

Or undo this operation with:

  git switch -

Turn off this advice by setting config variable advice.detachedHead to false

HEAD is now at 395e087 Made the login page, boss!

Looking at the code for index.html:

Cracking the code Link to heading

We can plainly see that the script checks for the username admin and the password which is obscured here for spoiler reasons. Let’s try this password on the site:

$Login: admin, password: \*\*\*\*$

Hitting the login button takes us to the dashboard.html page

Congrats! You’ve cracked the box

Conclusions Link to heading

There are many advantages to using git, but be aware of the pitfalls as well. Many sites expose git repositories to the internet, While most are benign, some can contain secrets that are best kept hidden. Disabling directory traversal is one method to obscure the use of tool such as wget to mirror git repos, but other tools exist which don’t necessarily need a directory listing. The best option is to delete the .git folder outright, or at the very least, use the webserver to deny access.