From a username to an exposed .git repository - PwnMe 2023

Sun, 07 May 2023 00:00:00 +0000

Introduction

This challenge is an OSINT challenge from PWNME CTF.

Context Explanation

To understand the context of the challenge, refer to the introduction challenge description.

Task

As a budding developer, find information about this undeveloped passion.

Solution

On John Droper’s Facebook profile, we can see that he has a username: jdthetraveller.

We keep this in mind for later.

On his feed, we have information about his username. He says that he chose it on AFNIC, which is a domain name registry solution.

Trying to access https://jdthetraveller.fr/ leads to a construction blog likely owned by John Droper.

At this point, we do not have much information, so we will try to find information on the server with dirsearch.

We find a /.git directory that contains a config file with information about the git repository.

We can retrieve this file with wget http://jdthetraveller.fr/.git/config.

┌──(root㉿kali)-[~]
└─# wget https://jdthetraveller.fr/.git/config
--2023-05-07 23:46:11--  https://jdthetraveller.fr/.git/config
Resolving jdthetraveller.fr (jdthetraveller.fr)... 13.48.131.55
Connecting to jdthetraveller.fr (jdthetraveller.fr)|13.48.131.55|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 271 [application/octet-stream]
Saving to: ‘config’

config                          100%[=======================================================>]     271  --.-KB/s    in 0s

2023-05-07 23:46:11 (3.60 MB/s) - ‘config’ saved [271/271]


┌──(root㉿kali)-[~]
└─# cat config
[core]
        repositoryformatversion = 0
        filemode = true
        bare = false
        logallrefupdates = true
[remote "origin"]
        url = https://github.com/droperkingjohn/myOwnWebsite.git
        fetch = +refs/heads/*:refs/remotes/origin/*
[branch "main"]
        remote = origin
        merge = refs/heads/main

First, there is a new nickname belonging to John Droper: droperkingjohn. We keep it in mind for the future.

We also find a link to a git repository: https://github.com/droperkingjohn/myOwnWebsite

If we look through the commits, we find this one:

Flag: PWNME{W0w_th15_l00k_l1ke_4n_e4sY_Fl4G}

Tips & Tricks