Git Happens
This room is a really easy one on TryHackMe only you know a few important things about Git. Just like most of people I am not much familiar with Git but do know how it works. This room lets you understand how you can work with Git in a safe way. So, let's begin!
Enumeration
Once we deploy the machine, we can go and visit the IP address and see that a login page is located over there. The first thing that can come to our mind is SQL injection. So, we can try a few basic attacks along with starting a directory brute force attack using any tool like GoBuster, Dirb etc.
We can try simple SQLi attacks by passing values like ' or 1=1 --' or passing admin in both username and password. But none of these work. Meanwhile, from the directory brute force attack, we find that a .git directory has been discovered.
We can go and check the /.git path and see that an entire Git repository is present over there.
Looking at the repository, the immediate thought that can come to our mind is to clone it and check the files present in it. This can be usually done using the command git clone as:
But here, it says that the repository was not found. After some googling, we can find a tool named GitTools through which we can download the repository on our machine.
There are three tools in the GitTools repository which are Dumper, Extractor and Finder. Out of these three, we will be using dumper as we want to dump the entire repository on our local machine.
So, here we have now dumped the entire repository on our local machine. We can now use one of the best features of git that helps us to view all the changes that were made to the repository since it was initialized.
P.S. I used '../../../' just because I wanted to dump the repository to a specific directory which was three steps above the current one.
Remember that we have dumped .git. Hence by default, it will be hidden.
We can now use the commandgit logsto read thecommitmessages for each change that was made to the repository.
From the Date value, we can determine that the oldest change and its commit message are at the bottom and the most recent changes are at the top. All these commit messages tell us how things changed in this repository i.e from the creation of a login page through adding obfuscation and implementing SHA-512 to building a docker. But this does not provide any information that we can use directly.
Using the commit value, we can see what changes were made at that point in time using the command git show <commit value>:
This is how the first commit looks like in the repository, but there are multiple commits in the repository and viewing each and every commit this way would be quite tedious. Hence, we can work around a little bit like:
What we are doing over here is:
git log: This shows all the basic details like commit value, date, author and commit message.grep commit: With this command, we are fetching only those lines that contain the commit value which can pass togit show.cut -d " " -f 2: Thegrepcommand captures the entire line but we need only the commit value and not the term 'commit' along with it. So, we cut the line by defining the space (" ") as delimiter and then selecting the second part (commit value) using the switch-f.xargs git show: The commandxargsis used when you want to pass multiple arguments. Here, we know thatgit showtakes only one commit value at a time and soxargscan be helpful in this case.
As we know, the oldest changes are at the bottom, we should immediately go to the end of the output and start looking for all the changes that were made. And in the details of the second last commit, we can see the username and password for the login page.
We can now use these credentials and try to login through login page.
Once logged in, it just says to submit the password as the flag. With this, we have solved the room!
Some Key Points to Take Away
Use GitTools when you need to perform some operations related to Git.
To see the changes made to a repository use
git log.Remember that the changes are shown in descending order of date and time.
Last updated
Was this helpful?