Sunday, May 3, 2015

Volga CTF 2015 - Find Him (Recon) 250

Volga was a fun CTF, with many Recon and Stego challenges as well as challenging pwnables and reversing.  One of the challenges I helped with the most was the "Find Him" recon assignment.  You were given one hint to start with: "Find Greg Medichi he is from Sydney, his code contains a valuable data"

Simple enough, let's search google for an exact match of his name "Greg Medichi"
Cool, only 3 results!  And one of them is the Sydney G+ page, let's check it out.
Search on the page for his name again, hmmmmm no dice, but it was crawled returning his name so it must be in a comment or in the cache.  Cache didn't show a readable page so the next choice was to look through the source.  After pulling up the Chrome's element inspector and searching again for his name, it showed up in a few places.  Now is the point of preference, but I thought it may be a lot easier to search through this on the terminal, so I curled the G+ Sydney page to find a link to his profile image and personal G+ page.

Next after curling his G+ page I grepped for 'code' which returned a post to his github account.

After checking out his github page, he only had one repo with no other contributions.  The flag must be close....
Looking through the repo it looked like .gitignore could be interesting, but then there was also another branch.  After checking out the branch, the flag was found in a previous commit.

Simple Example Workflow:

curl https://plus.google.com/+Sydney | grep -i "greg medichi" | tr '"' '\n' | egrep -i "greg|http" | tail -n 3

G+ Profile Image: https://lh3.googleusercontent.com/-M-UOwrBR81s/AAAAAAAAAAI/AAAAAAAAABM/LA55YSwP-Bg/photo.jpg
G+ Profile Page: https://plus.google.com/100247380806038877359
curl https://plus.google.com/100247380806038877359 | grep -i code | tr '"' '\n' | grep -i greg | tail -n 3

Check out the github account... Only one repo....
git clone https://github.com/gregmedichi/todoapp
cd todoapp
git branch -a

Find the other branch "front_end"
git checkout origin/front_end
git log

Found a log entry mentioning "unfinished" changes
git checkout 6b5334844a19413124605b77507437924d233f27
git diff master

String Found in Diff:
+          <!-- TODO Add a logic Fl@g={LURK1NG_G1T_1S_PHUN} -->