# Information disclosure in version control history

## Description

This lab discloses sensitive information via its version control history. To solve the lab, obtain the password for the `administrator` user then log in and delete the user `carlos`.

## Solution

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2FUo9KxKMMIaRkIYOrG4xJ%2Fimage.png?alt=media&#x26;token=303d846c-1502-471a-8f0d-ec3db7beee86" alt=""><figcaption></figcaption></figure>

Adding `.git` we obtain a version control history:

<https://0afe00be03be902083195529004100e5.web-security-academy.net/.git>

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2FdGNjaXVKP5AcrC1bCkvT%2Fimage.png?alt=media&#x26;token=263cbbb0-0002-4623-8e33-03944542e96e" alt=""><figcaption></figcaption></figure>

Deep dive to each dir/file to check if there're some interesting data:

#### HEAD

<https://0afe00be03be902083195529004100e5.web-security-academy.net/.git/HEAD>

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2F1jSHhbvPV5jzfERwXmOe%2Fimage.png?alt=media&#x26;token=2319ae80-aff2-424a-86dc-34a5322f0560" alt=""><figcaption></figcaption></figure>

```
ref: refs/heads/master
```

#### CONFIG

<https://0afe00be03be902083195529004100e5.web-security-academy.net/.git/config>

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2FwfbukrV2sqrafPCNAcDy%2Fimage.png?alt=media&#x26;token=86f6ded9-85ed-47bf-835b-4968f0063ed9" alt=""><figcaption></figcaption></figure>

```
[user]
	email = carlos@carlos-montoya.net
	name = Carlos Montoya
```

#### COMMIT\_EDITMSG

<https://0afe00be03be902083195529004100e5.web-security-academy.net/.git/COMMIT_EDITMSG>

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2FLlrXjF13xxLCyFvGxKsM%2Fimage.png?alt=media&#x26;token=237abe98-d7bb-4d53-a2d2-6705b4f797ca" alt=""><figcaption></figcaption></figure>

#### /refs/heads/master

In the 'Head' page there's a potential path, trying to go there: `/refs/heads/master`

there's an alphanumeric string:&#x20;

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2FEMqdjVUHMX5mwjqPs4dN%2Fimage.png?alt=media&#x26;token=6350bb26-afdd-4220-a590-4609cfaec062" alt=""><figcaption></figcaption></figure>

```
ff5435104086dbedd8f46b0a70ffb51cca1b1a44
```

#### /logs/HEAD

and remembering COMMIT\_EDITMSG page and searching into others directories, theres a great info into: `/logs/HEAD`

<https://0afe00be03be902083195529004100e5.web-security-academy.net/.git/logs/HEAD>

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2Fmm3AnY9AJ5OLMKsI4jsK%2Fimage.png?alt=media&#x26;token=1588dfe7-c89b-4783-9565-78e3e67d993f" alt=""><figcaption></figcaption></figure>

```
0000000000000000000000000000000000000000 b25706d68b5971f903aadce94f299ef2371ee46f Carlos Montoya <carlos@carlos-montoya.net> 1742510797 +0000	commit (initial): Add skeleton admin panel
b25706d68b5971f903aadce94f299ef2371ee46f ff5435104086dbedd8f46b0a70ffb51cca1b1a44 Carlos Montoya <carlos@carlos-montoya.net> 1742510797 +0000	commit: Remove admin password from config
```

#### index

<https://0afe00be03be902083195529004100e5.web-security-academy.net/.git/index>

Downloading and opening index file there're an encoded text in hex:

```
DIRC\00\00\00\02\00\00\00\02\67\DC\9A\CD\0D\1F\F9\23\67\DC\9A\CD\0D\1F\F9\23\00\00\00\4B\00\31\42\CF\00\00\81\A4\00\00\2E\E2\00\00\2E\E2\00\00\00\25\21\D2\3F\13\CE\6C\70\4B\81\85\73\79\A3\E2\47\E3\43\6F\4B\26\00\0A\61\64\6D\69\6E\2E\63\6F\6E\66\00
\00\00\00\00\00\00\00\67\DC\9A\CD\01\AE\43\06\67\DC\9A\CD\01\AE\43\06\00\00\00\4B\00\31\42\CE\00\00\81\A4\00\00\2E\E2\00\00\2E\E2\00\00\00\58\89\44\E3\B9\85\36\91\43\1D\C5\8D\5F\49\78\D3\94\0C\EA\4A\F2\00\0F\61\64\6D\69\6E\5F\70\61\6E\65\6C
\2E\70\68\70\00\00\00\54\52\45\45\00\00\00\19\00\32\20\30\0A\21\54\55\59\44\00\27\91\A4\D2\74\12\BF\6E\9A\6F\29\E9\42\FA\0E\DD\0E\69\1B\C0\88\2E\F4\9C\F4\9F\4A\5B\13\19\96\04\1A\B7sa
```

that in clear text contains interesting data:

* `admin.conf`
* `admin_panel.php`

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2FpmIxS4DWC9tCayka2XAP%2Fimage.png?alt=media&#x26;token=8ccce4bc-5000-4d1e-955e-7b6b76f71ea4" alt=""><figcaption></figcaption></figure>

Adding those paths, I've not found a solution, so i decided to download the entire git directories and use a dedicated tool.

Download Git Dir: `wget -r https://0afe00be03be902083195529004100e5.web-security-academy.net/.git`

Now we've download all git files locally, so go there to investigate well (`cd ~/Documents/0a2000e40417d00885e2135600ed00cb.web-security-academy.net/.git`), files are hidden by default, so we can see them using the flag -h `(ls -lah`).

It seems the same thing, so we can try to use git commands to check logs: `git log`

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2FJc0jtUKhOI2dP6H8pWkz%2Fimage.png?alt=media&#x26;token=b85f9637-a2d0-4daf-84de-75f007a9427f" alt=""><figcaption></figcaption></figure>

Great, only now i've undestand that those values were about git commits, so the first one seems more interesting, explore it using git show command:

`git show e06350084adb1d7a44eef13faf0a9cd6cac55bd5`

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2FSWCvTBbEE8OoHIZ70B88%2Fimage.png?alt=media&#x26;token=53c6259b-0db7-44c5-b1d0-4e92b71e5ea9" alt=""><figcaption></figcaption></figure>

and finally we obtain the admin password value!

Awesome, now we can login us as administrator (`administrator::bohd9ui3rn3yqzgsktq1`)&#x20;

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2FXp1R1smczPm0TSShnSy1%2Fimage.png?alt=media&#x26;token=0ff087cd-1de2-4574-9646-03226fa2d9c4" alt=""><figcaption></figcaption></figure>

go to admin portal page:

<https://0a3f00cb040ae66c819d1b8e00a700ea.web-security-academy.net/admin>

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2FoDHMvmFYtNZAgDtc3VlF%2Fimage.png?alt=media&#x26;token=ca81f55b-1cda-4855-8f87-53231020733f" alt=""><figcaption></figcaption></figure>

and delete 'Carlos' user completing the lab.

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2FXw1ZnKGMBrgSIwftRQDY%2Fimage.png?alt=media&#x26;token=8c217933-3f3c-43da-9d18-0c722604f3c1" alt=""><figcaption></figcaption></figure>