Git Secrets (e9d0e0f2-1069-4f72-9d56-398c01c0a960)

Platform: hackerlab | Category: Misc | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2025-12-23 | Status: Solved Techniques: Deleted file recovery from git history, Git commit history analysis, git log with diff inspection

Summary

Task: Git repository archive provided with hints about mistakes. Solution: Analyze git commit history to find deleted secret.txt file containing the flag.

Git Secrets — hackerlab.pro

Description

Решил попробовать систему контроля версий "GIT". Без ошибок не обошлось... (Tried to use version control system "GIT". Mistakes were made...)

Provided archive taskgit.zip with a Git repository.

Analysis

1. Extracting the archive

 bash read-only • copy allowed Copy
unzip taskgit.zip
# Another archive inside
unzip task.zip
cd git-test/

2. Viewing commit history

 bash read-only • copy allowed Copy
git log --all --oneline

Result:

e8330ce final result
2b5cc30 x _ x
5dc63bd add some bio
65c8151 Initial commit

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Interesting commit x _ x — looks like a "dead face", hints at something being deleted.

3. Detailed history analysis

 bash read-only • copy allowed Copy
git log -p --all

Or viewing a specific commit:

 bash read-only • copy allowed Copy
git show 5dc63bd

In commit 5dc63bd ("add some bio") a file secret.txt was added:

 diff read-only • copy allowed Copy
+++ b/secret.txt
@@ -0,0 +1 @@
+CODEBY{REDACTED}

4. Verifying deletion

 bash read-only • copy allowed Copy
git show 2b5cc30

In the next commit 2b5cc30 ("x _ x") the file was deleted:

 diff read-only • copy allowed Copy
--- a/secret.txt
+++ /dev/null
@@ -1 +0,0 @@
-CODEBY{REDACTED}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

5. Alternative extraction methods

Restore file from a specific commit:

 bash read-only • copy allowed Copy
git checkout 5dc63bd -- secret.txt
cat secret.txt

Or view contents directly:

 bash read-only • copy allowed Copy
git show 5dc63bd:secret.txt

Solution

Git stores complete history of all changes. Deleting a file with a regular commit doesn't remove it from history — data remains accessible in previous commits.

 bash read-only • copy allowed Copy
# Quick way to find the flag
git log -p --all | grep -i "flag\|codeby\|secret"

Important Notes

Typical beginner mistake

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Many think that git rm secret.txt && git commit deletes the file forever. In reality:

• The file remains in repository history
• Anyone with repository access can restore it
• Even after git push the data remains in remote

Proper removal of secrets from Git

For actual removal of sensitive data, history must be rewritten:

 bash read-only • copy allowed Copy
# Method 1: git filter-branch (deprecated)
git filter-branch --force --index-filter \
  'git rm --cached --ignore-unmatch secret.txt' \
  --prune-empty --tag-name-filter cat -- --all
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Method 2: BFG Repo-Cleaner (recommended)
bfg --delete-files secret.txt
git reflog expire --expire=now --all
git gc --prune=now --aggressive

# Method 3: git filter-repo (modern)
git filter-repo --path secret.txt --invert-paths

After rewriting history, git push --force is needed, which may break work for other contributors.

Useful commands for Git forensics

 bash read-only • copy allowed Copy
# All commits with diff
git log -p --all

# Search by commit contents
git log -S "password" --all

# Search by commit messages
git log --grep="secret" --all
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Show all files in a specific commit
git ls-tree -r <commit_hash>

# Show file contents from a commit
git show <commit_hash>:<file_path>

# Find commits that modified a file
git log --all --full-history -- <file_path>

# Restore deleted file
git checkout <commit_hash>^ -- <file_path>

References

• Git Documentation - git-log
• BFG Repo-Cleaner
• GitHub: Removing sensitive data ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍