← Back to Writeups

misc/new-challenge | LACTF 2023

Ruien Luo, Sun Feb 12 2023 • Tags: misc, LACTF 2023

This challenge was part of LACTF 2023, where asmhole placed 33rd out of nearly 1,400 teams.

Challenge description

Author: arcblroth
@bliutech could you push an updated description for this challenge thx

git clone git://lac.tf:31152/new-challenge.git

Challenge Files Mirror: new-challenge.zip

Solution

I was quite confused by this at first, until I cloned the repository and saw the pre-receive file. It simply declared 7 emails as being allowed to write to the repository, and checked that I was "Benson Liu" with an email of "[email protected]" before allowing me to write to the repo and get a flag.

pre-receive

Time to frame Benson!

I did some research online to figure out how to impersonate someone using git. Turns out it's pretty easy (stackoverflow coming in clutch as usual)! All I had to do was enter the following two commands:

git config --global user.name "Benson Liu"
git config --global user.email "[email protected]"

imposter

The flag is spit out by the program since the conditions to get it are satisfied, and the commit/push is rejected because obviously it is.

Now they'll never be able to (git) blame me!

Flag: lactf{wh3n_th3_1mp0st3r_1s_5us}

Questions/comments?

Send me an email at [email protected].