Challenge Context#

The archive contained a 1337 piscine project repository. The visible files looked normal, but the flag was hidden in Git history rather than the working tree.

Reconnaissance#

The challenge title and project layout pointed at Git forensics. The key commands were:

1
unzip pool.zip
2
cd Exams42
3
find .git -type f | head
4
git fsck --lost-found
5
git log --all --oneline

Vulnerability / Core Idea#

Git stores objects even when commits are no longer reachable from a branch. If a secret was committed and then removed or orphaned, it may still exist as a dangling commit/blob.

Exploitation#

git fsck revealed dangling commits. Inspecting each commit recovered five backup secret parts. Combining the parts produced the flag.

1
git fsck --lost-found
2
for c in $(git fsck --no-reflogs 2>/dev/null | awk '/dangling commit/ {print $3}'); do
3
  git show --stat --patch "$c"
4
done

Flag#

1
leet{d4ngl1ng_c0mm1t5_4r3_1mp0rt4nt}

Lesson Learned#

Deleting a secret from the working tree does not delete it from Git history. In CTFs and in real incidents, always inspect unreachable commits and blobs.

Cover: Wallhaven k81776.