# Corruption 
 
## FLAG:`RS{se3_that_wasnt_s0_bad_just_som3_git_plumbing}`### SolutionThe challenge was complicated from the beginning as there were various problems to be solved and few ideas from which to take inspiration.
The first problem that arose is the impossibility of cloning the git repository, in fact if you tried to do it the following error came out```consoleasd@asd:~/Scrivania/CTF/RITSECctf$ git clone git://git.ritsec.club:9418/corruption.gitClone in 'corruption' in corso...remote: Enumerating objects: 5, done.remote: Counting objects: 100% (5/5), done.remote: Compressing objects: 100% (2/2), done.remote: Total 5 (delta 0), reused 0 (delta 0), pack-reused 0remote: aborting due to possible repository corruption on the remote side.Ricezione degli oggetti: 100% (5/5), fatto.fatal: EOF prematurofatal: index-pack non riuscito
```So I tried to modify the git configurations with the following parameters and try to clone again, but nothing, same error!```git config --global pack.windowMemory "100m"git config --global pack.packSizeLimit "100m" git config --global pack.threads "1"git config --global pack.window "0"git clone git://git.ritsec.club:9418/corruption.git```So you had to find a way to clone the repository, but it is the description of the challenge itself that came to my aid with the word *remote*, in fact i immediately opened the *git manual* referring to *remote* and in the *EXAMPLES* section I found the solution to the problem.  We made it !```consoleasd@asd:~/Scrivania/CTF/RITSECctf$ mkdir corruption.gitasd@asd:~/Scrivania/CTF/RITSECctf$ cd corruption.git/asd@asd:~/Scrivania/CTF/RITSECctf/corruption.git$ git initsuggerimento: Using 'master' as the name for the initial branch. This default branch namesuggerimento: is subject to change. To configure the initial branch name to use in allsuggerimento: of your new repositories, which will suppress this warning, call:suggerimento: suggerimento:   git config --global init.defaultBranch <name>suggerimento: suggerimento: Names commonly chosen instead of 'master' are 'main', 'trunk' andsuggerimento: 'development'. The just-created branch can be renamed via this command:suggerimento: suggerimento:   git branch -m <name>Inizializzato repository Git vuoto in /home/asd/Scrivania/CTF/RITSECctf/corruption.git/.git/asd@asd:~/Scrivania/CTF/RITSECctf/corruption.git$ git remote add -f -t master -m master origin git://git.ritsec.club:9418/corruption.gitAggiornamento di originremote: Enumerating objects: 4, done.remote: Counting objects: 100% (4/4), done.remote: Compressing objects: 100% (2/2), done.remote: Total 4 (delta 0), reused 0 (delta 0), pack-reused 0remote: aborting due to possible repository corruption on the remote side.Decompressione degli oggetti in corso: 100% (4/4), 274 byte | 137.00 KiB/s, fatto.fatal: early EOFfatal: unpack-objects non riuscito                                                                                error: Impossibile recuperare origin                                                                              asd@asd:~/Scrivania/CTF/RITSECctf/corruption.git$ ls -al                                                          totale 12                                                                                                         drwxr-xr-x 3 asd asd 4096 apr 12 21:50 .                                                                          drwxr-xr-x 6 asd asd 4096 apr 12 21:49 ..                                                                         drwxr-xr-x 7 asd asd 4096 apr 12 21:50 .git ```                       
 
Now i had to print, somehow, the contents of the objects (for more information see https://stackoverflow.com/questions/14790681/what-is-the-internal-format-of-a-git-tree-object) and looking at the *git manual* referring to *cat-file*, i found two interesting options:1. `--batch, --batch=<format>`: *Print object information and contents for each object provided on stdin. May not be combined with any other options or arguments except --textconv or --filters, in which case the input lines also need to specify the                                 path, separated by whitespace. See the section BATCH OUTPUT below for details.*2. `--batch-all-objects`: *Instead of reading a list of objects on stdin, perform the requested batch operation on all objects in the repository and any alternate object stores (not just reachable objects). Requires --batch or --batch-check be                           specified. Note that the objects are visited in order sorted by their hashes.*
So I ran the command `git cat-file --batch --batch-all-objects`, bu i didn't get the result i expected ...```consoleasd@asd:~/Scrivania/CTF/RITSECctf/corruption.git$  git cat-file --batch --batch-all-objects59840b46d591b3dc35c0b22340ff3fb8d980b351 tree 73100644 README.md��Ɓ���%��oO5���{k100644 flag.txt�l�c�OūMn��B                                                             �O�c46c1ead63e74fc5ab4d116e9695420b20aa4f8a blob 6!flag
c517fdc681c0a2b7258691116f4f35fee6a97b6b blob 36# Corruption
Is this git hell yet?
f7fe593ca04a5d2a835d0e72225752fa588e0685 commit 167tree 59840b46d591b3dc35c0b22340ff3fb8d980b351author knif3 <[email protected]> 1617947351 +0000committer knif3 <[email protected]> 1617947351 +0000
Initial Commit```
Something was missing from what i had done and so i started looking on the internet until i open a site that provides me with the part i was looking for. The site in question is https://git-scm.com/book/it/v2/Git-Basics-Working-with-Remotes in which it says that, to download the branches and/or tags (depending on the our preferences) from the remote repository, you use the command ``git fetch``.
Reading the *git manual* for *fetch* i saw the *--all* option.
So I first ran the `git fetch --all` command, then `git cat-file --batch --batch-all-objects` and **BINGO**, i got the flag !```consoleasd@asd:~/Scrivania/CTF/RITSECctf/corruption.git$ git fetch --allRecupero di origin in corsoDa git://git.ritsec.club:9418/corruption * [nuovo branch]    error      -> origin/errorasd@asd:~/Scrivania/CTF/RITSECctf/corruption.git$ git cat-file --batch --batch-all-objects59840b46d591b3dc35c0b22340ff3fb8d980b351 tree 73100644 README.md��Ɓ���%��oO5���{k100644 flag.txt�l�c�OūMn��B                                                             �O�c09b32987380e63e93d93f699e1dbfeae839f8e2 blob 49RS{se3_that_wasnt_s0_bad_just_som3_git_plumbing}
c46c1ead63e74fc5ab4d116e9695420b20aa4f8a blob 6!flag
c517fdc681c0a2b7258691116f4f35fee6a97b6b blob 36# Corruption
Is this git hell yet? f7fe593ca04a5d2a835d0e72225752fa588e0685 commit 167                                                               tree 59840b46d591b3dc35c0b22340ff3fb8d980b351                                                                     author knif3 <[email protected]> 1617947351 +0000                                                                committer knif3 <[email protected]> 1617947351 +0000                                                              Initial Commit  ```