{"id":269,"date":"2019-01-17T05:31:53","date_gmt":"2019-01-17T05:31:53","guid":{"rendered":"https:\/\/mrjsec.co.uk\/blog\/?p=269"},"modified":"2019-01-17T05:32:01","modified_gmt":"2019-01-17T05:32:01","slug":"objective-4-data-repo-analysis","status":"publish","type":"post","link":"https:\/\/mrjsec.co.uk\/blog\/objective-4-data-repo-analysis\/","title":{"rendered":"
Objective 4: Data Repo Analysis<\/center>"},"content":{"rendered":"\n

Objective 4 needs us to retrieve the encrypted ZIP file from the North Pole Git repository “https:\/\/git.kringlecastle.com\/Upatree\/santas_castle_automation” and find the password to open it.<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

If we have compleated Cranberry Pi terminal challenge by Wunorse Openslae, then we get given a hint which is.<\/p>\n\n\n\n

“Thank goodness for command line passwords – and thanks for your help!
\nSpeaking of good ways to find credentials, have you heard of Trufflehog?
\nIt’s a cool way to dig through repositories for passwords, RSA keys, and more.
\nI mean, no one EVER uploads sensitive credentials to public repositories, right? However, if they did, this would be an excellent tool for finding them.
\nListen to me ramble. If you’re interested in Trufflehog, you should check out Brian Hostetler’s talk!
\nHave you tried the entropy=True option when running Trufflehog? It is amazing how much thicker it digs!”<\/p>\n\n\n\n

Also, we get a YouTube link to check out Brian Hostetler’s talk on Trufflehog<\/a>.<\/p>\n\n\n\n

Heading to the GitLab page “https:\/\/git.kringlecastle.com\/Upatree\/santas_castle_automation” we can see many files; we could clone the whole git\u2026 However, as the hint suggests we only need to find the ZIP file.<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

Using the built-in “Find the file” within GitLab were able to locate and download the ZIP file (Well, the only ZIP file).<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

Moreover, when trying to access the .jpg files, we need a password! We could try and brute force it with a password list. However, this could take days, maybe even weeks?\u2026 There are many programs out there some free, i.e. John the ripper, and some that cost money. However, again nothing guaranteed here!<\/p>\n\n\n\n

Alternatively, maybe it’s referring too “Known-plaintext attack (ZIP)”ZIP files have a strong encryption algorithm. First, the password isn’t stored anywhere in a password-protected archive. The ZIP archiver converts the password you’ve entered into three 32-bit encryption keys, and then uses them to encrypt the whole archive.” (https:\/\/www.elcomsoft.com\/help\/en\/archpr\/known_plaintext_attack_(zip).html)<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

However, let’s not over think all of this! Do you remember the Dev Ops Fail Cranberry Pi terminal challenge by Sparkle Redberry<\/a>?
Where we check the git project and check the commits to find a password that has removed. Maybe it’s the same thing here. Maybe!<\/p>\n\n\n\n

Going back to the GitLab page again, let’s check out the commits made, when scrolling down I notice this one with the “stands out” name called “important update.”<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

Checking the changes made to “important update”, we. Well, we find the password!<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

So the answer\/password here is Yippee-ki-yay.<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

=======================<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n

Hang on, is this the map for Google Ventilation Maze?
\nHmmm.<\/p>\n","protected":false},"excerpt":{"rendered":"

Objective 4 needs us to retrieve the encrypted ZIP file from the North Pole Git repository “https:\/\/git.kringlecastle.com\/Upatree\/santas_castle_automation” and find the password to open it. If we have compleated Cranberry Pi terminal challenge by Wunorse Openslae,…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[10],"tags":[13,14,12],"class_list":["post-269","post","type-post","status-publish","format-standard","hentry","category-kringlecon-2018","tag-13","tag-ctf","tag-kringlecon"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/paD3U6-4l","_links":{"self":[{"href":"https:\/\/mrjsec.co.uk\/blog\/wp-json\/wp\/v2\/posts\/269","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mrjsec.co.uk\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mrjsec.co.uk\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mrjsec.co.uk\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mrjsec.co.uk\/blog\/wp-json\/wp\/v2\/comments?post=269"}],"version-history":[{"count":1,"href":"https:\/\/mrjsec.co.uk\/blog\/wp-json\/wp\/v2\/posts\/269\/revisions"}],"predecessor-version":[{"id":279,"href":"https:\/\/mrjsec.co.uk\/blog\/wp-json\/wp\/v2\/posts\/269\/revisions\/279"}],"wp:attachment":[{"href":"https:\/\/mrjsec.co.uk\/blog\/wp-json\/wp\/v2\/media?parent=269"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mrjsec.co.uk\/blog\/wp-json\/wp\/v2\/categories?post=269"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mrjsec.co.uk\/blog\/wp-json\/wp\/v2\/tags?post=269"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}