Description
A git hosting service. Log in and find the flag hidden somewhere you should not have access to.
Setup
Open the challenge URL and create an account.
# Open http://mercury.picoctf.net:<PORT_FROM_INSTANCE>/ in your browserSolution
Walk me through it- Step 1Create an account and explore the serviceRegister a user account on the Bithug service. Explore the repository listing, user profiles, and any administrative pages. Look for IDOR vulnerabilities by modifying numeric IDs in URLs.
Learn more
IDOR (Insecure Direct Object Reference) occurs when an application exposes internal implementation objects (database IDs, file paths, etc.) in URLs or parameters without proper authorization checks. By changing
/repo/1to/repo/2, you might access another user's private repository.On a git hosting service, explore: repository listings (
/repos), individual repos (/user/repo), commits (/user/repo/commits), raw file access (/user/repo/raw/branch/path), and admin panels (/admin,/admin/users). - Step 2Probe the admin namespace before assuming a pathWalk /admin/, /admin/repos/, and the git smart-HTTP refs endpoints. ../ sequences in repository paths are also worth trying if the server doesn't normalize.bash
# Probe the admin treebashcurl -s -u user:pass http://mercury.picoctf.net:<PORT_FROM_INSTANCE>/admin/bashcurl -s -u user:pass http://mercury.picoctf.net:<PORT_FROM_INSTANCE>/admin/repos/bash# Smart HTTP negotiation (any reachable repo's path)bashcurl -s -u user:pass 'http://mercury.picoctf.net:<PORT_FROM_INSTANCE>/admin/flag.git/info/refs?service=git-upload-pack'bash# Once you know the path, clone with gitbashgit clone http://user:pass@mercury.picoctf.net:<PORT_FROM_INSTANCE>/admin/flag.gitLearn more
Git smart HTTP, briefly. A git server speaks two endpoints per repo:
GET /repo.git/info/refs?service=git-upload-packfor the ref-advertising negotiation, andPOST /repo.git/git-upload-packfor the pack transfer. Hittinginfo/refsfor a repo you don't own is the cheapest probe: a 200 with refs means the auth check is missing, a 401 means it's enforced. Path traversal in the repo segment (e.g./yourname/../admin/flag.git/info/refs) sometimes slips past per-user authorization that's keyed on the URL prefix rather than the resolved repo.Git hosting IDOR scenarios:
- A private admin repository is accessible to all users if the authorization check is missing
- The git clone URL accepts relative paths that escape the intended repository directory
- File read endpoints don't check repository ownership before returning file contents
- A poorly implemented fork or star feature creates a public reference to a private repository's commit hash
- Step 3Clone or access the flag repositoryOnce you identify the vulnerable endpoint, use curl or git to retrieve the flag. Try accessing the admin's repositories or any repository named 'flag'.bash
git clone http://your_user:your_pass@mercury.picoctf.net:<PORT_FROM_INSTANCE>/admin/flag.gitbashcat flag.git/flag.txtbash# Or use the web interface to browse repository contentsLearn more
If the service uses git's smart HTTP protocol, the endpoint
/user/repo.git/info/refs?service=git-upload-packis part of the git protocol negotiation. A path traversal here (e.g.,/../admin/flag.git/info/refs) might allow cloning unauthorized repositories. Test with git and check if standard git protocol requests succeed. For a tour of the broader bug class this lives in, see web challenge bug patterns.
Flag
picoCTF{...}
Bithug demonstrates IDOR and insufficient authorization checks in a git hosting service - accessing another user's private repository by manipulating URL parameters or bypassing access controls reveals the flag.