Hacker Holidays Day 2: Room 404

The Byte Lotus guest platform went live in a hurry and the night shift developer shipped more than the website. The task is to dump the exposed source and find the flag. The lesson is how a leftover .git folder hands over the whole history of a codebase, including the parts the developer thought they deleted.

Confirming the exposure

.git/HEAD is a tiny file every git repo has, which makes it a good canary:

curl -i http://10.114.133.85:8080/.git/HEAD

It returned ref: refs/heads/main. If the server hands you that instead of a 404, a full .git directory is sitting there in the open.

Rebuilding and walking the history

There is no directory listing, so I used git-dumper to crawl the objects, refs and packs and rebuild a working repo:

pip install git-dumper --break-system-packages
git-dumper http://10.114.133.85:8080/.git/ ./bytelotus

Deleting a secret in a later commit does not remove it, it just hides it from HEAD, so I walked every commit on every branch, diffs included:

cd bytelotus
git log --all -p | less

--all covers every branch and ref, -p shows the actual diff of each commit. The flag turned up in the diff of an old commit that had since been tidied up on HEAD. Redacted here.