Featured image of post From a username to an exposed .git repository - PwnMe 2023
OSINT

From a username to an exposed .git repository - PwnMe 2023

Pivoting from a Facebook username to an exposed .git directory, then recovering the repo and flag. PwnMe 2023 OSINT write-up.

Introduction

This challenge is an OSINT challenge from PWNME CTF.

Context Explanation

To understand the context of the challenge, refer to the introduction challenge description.

Task

As a budding developer, find information about this undeveloped passion.

Solution

On John Droper’s Facebook profile, we can see that he has a username: jdthetraveller.

We keep this in mind for later.

Facebook profile

On his feed, we have information about his username. He says that he chose it on AFNIC, which is a domain name registry solution.

Facebook profile

https://jdthetraveller.fr/ leads to an under-construction blog, probably John’s.

Nothing obvious on the page, so I ran dirsearch against the server:

Dirsearch

It turns up an exposed /.git directory, and its config file points at the repo. Grab it with wget:

┌──(root㉿kali)-[~]
└─# wget https://jdthetraveller.fr/.git/config
--2023-05-07 23:46:11--  https://jdthetraveller.fr/.git/config
Resolving jdthetraveller.fr (jdthetraveller.fr)... 13.48.131.55
Connecting to jdthetraveller.fr (jdthetraveller.fr)|13.48.131.55|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 271 [application/octet-stream]
Saving to: ‘config’

config                          100%[=======================================================>]     271  --.-KB/s    in 0s

2023-05-07 23:46:11 (3.60 MB/s) - ‘config’ saved [271/271]


┌──(root㉿kali)-[~]
└─# cat config
[core]
        repositoryformatversion = 0
        filemode = true
        bare = false
        logallrefupdates = true
[remote "origin"]
        url = https://github.com/droperkingjohn/myOwnWebsite.git
        fetch = +refs/heads/*:refs/remotes/origin/*
[branch "main"]
        remote = origin
        merge = refs/heads/main

Two things here: a new alias, droperkingjohn (worth keeping), and the repo URL https://github.com/droperkingjohn/myOwnWebsite.

Github

Digging through the commit history, one of them holds the flag:

Github

Flag: PWNME{W0w_th15_l00k_l1ke_4n_e4sY_Fl4G}

Tips & Tricks

  • Use dirsearch to find hidden directories.
  • In a .git directory, you can retrieve information about the Git repository using the config file.
  • Use git log to view the commits in a Git repository.
  • Use git show to view the contents of a commit.
  • Examine the different commits and their comments to find information.