15 March 2021
Meet The TeamChallenge Source: NahamCon CTF 2021
Challenge Category: mission
Author: @JohnHammond#6971 Recover the list of employees working at CONSTELLATIONS. With the flag of this challenge, you should find new information that will help with future challenges. You should find the flag for this challenge ON THIS constellations.page website. You will not find it on GitHub. HINT: "Can we please stop sharing our version control software out on our website?" HINT AGAIN: you are looking for a publicly accessible version control software folder published on the constellations.page website itself After solving this challenge, you may need to refresh the page to see the newly unlocked challenges.
- The hint for this challenge was the quote in the source code at https://constellations.page/meet-the-team.html:
<!-- Vela, can we please stop sharing our version control software out on the public internet? -->
- We see a Github link at the bottom of the page, which leads us to try:
We can’t browse the directory structure, unfortunately, so we have to try to access default files and figure out a path from there. There is an excellent resource here discussing some manual ways to discover files.
The path of least resistance, however, is automating this process via GitTools. Armed with this, we can run the “Dumper” tool first to find and pull the relevant contents from the site. (Note: Having spaces in your path breaks this script, so check for this first.)
- Next, we need to run the extractor script, which tries to iterate through the repo and recreate the contents by analyzing the commits.
- Finally, it’s just a matter of finding the flag in the reconstructed content.