Skip to main content

Bandit Level 30 → 31

Shubham
Shubham
Cybersecurity Enthusiast

Login: ssh bandit30@bandit.labs.overthewire.org -p 2220
Password: qp30ex3VLz5MDG1n91YowTv4Q8l7CDZL

task​

There is a git repository at ssh://bandit30-git@bandit.labs.overthewire.org:2220/home/bandit30-git/repo. The password for the user bandit30-git is the same as the password for the user bandit30. Clone the repository and find the password for the next level.

theory lil bit​

  1. Git Tags: Tags are ref pointers to specific points in Git history, usually used to mark release points (like v1.0). Unlike branches, they don't change.
  2. Hidden References: Information isn't always in the files or the commit history logs. Sometimes secrets are hidden in metadata like tags or notes.
  3. Git Tag Command: git tag lists all existing tags in the repository.
  4. Inspecting Tags: Using git show [tag_name] allows you to see the object details or the content associated with that specific tag.

solution​

# Clone the repository
┌──(sssubhammm ⌘ macbook-air)-[~/repo/repo/repo]
└─$ git clone ssh://bandit30-git@bandit.labs.overthewire.org:2220/home/bandit30-git/repo
Cloning into 'repo'...
bandit30-git@bandit.labs.overthewire.org's password: 

# Enter the repository and check the files
┌──(sssubhammm ⌘ macbook-air)-[~/repo/repo/repo]
└─$ cd repo 
┌──(sssubhammm ⌘ macbook-air)-[~/repo/repo/repo/repo]
└─$ ls
README.md
┌──(sssubhammm ⌘ macbook-air)-[~/repo/repo/repo/repo]
└─$ cat README.md
just an epmty file... muahaha

# Check for any git tags
┌──(sssubhammm ⌘ macbook-air)-[~/repo/repo/repo/repo]
└─$ git tag
secret

# View the content of the 'secret' tag
┌──(sssubhammm ⌘ macbook-air)-[~/repo/repo/repo/repo]
└─$ git show secret
fb5S2xb7bRyFmAvQYQGEqsbhVyJqhnDy

<!-- truncate -->