Grok's Git Leak

Platform: caplag | Category: Forensics | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-02-22 | Status: Solved Techniques: git_history_recovery, git_show_deleted_file

Summary

Grok's Git Leak — caplag

Description

В замке AI-агента Grok царит хаос. Говорят, что в спешке он забыл удалить служебные файлы со своего сервера. Сможете ли вы найти среди них секрет?

(In the castle of AI agent Grok, there is chaos. They say that in a hurry, he forgot to delete service files from his server. Can you find the secret among them?)

Analysis

The task hints at "forgotten service files" — a classic sign of a .git/ directory leak. After downloading and extracting the site.7z archive, the site structure was revealed: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

site/
├── index.html
├── style.css
└── .git/          ← "forgotten service files"

The presence of a .git/ directory means the entire commit history is available locally. Even if a file was "deleted" in a subsequent commit, git stores all objects in its object store and allows recovering any file from any commit.

Solution

Step 1: Download and extract the archive

 bash read-only • copy allowed Copy
7z x site.7z

Step 2: View commit history

 bash read-only • copy allowed Copy
git log --oneline --all

Output:

b611f9a Remove secret scroll
c9f0df2 Add secret scroll
39c0a7c Initial commit: castle page

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Two suspicious commits: one added secret.txt (Add secret scroll), another deleted it (Remove secret scroll). This is a classic situation — the secret was "deleted" but remains in git history.

Step 3: Recover the deleted file

 bash read-only • copy allowed Copy
git show c9f0df2:secret.txt

Output:

caplag{REDACTED}

Useful Commands for Similar Tasks

 bash read-only • copy allowed Copy
# View full history of all branches
git log --oneline --all

# Show changes in a specific commit
git show <commit_hash>

# Recover a file from a specific commit
git show <commit_hash>:<path/to/file>
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Find all files that ever existed
git log --all --full-history -- "**/*"

# Show all objects in git object store
git cat-file --batch-all-objects --batch-check

# Search strings across entire history
git log -p --all | grep -i "flag\|secret\|password"

Notes

• Git never deletes data from the object store with a regular git rm + git commit
• Data is physically deleted only after git gc (garbage collection) — and not immediately
• Leaking a .git/ directory on a web server is a real vulnerability (CVE class: Information Disclosure)
• Tools for automatic .git/ dumping from web servers: git-dumper, GitHack ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍