<- FORENSICS

Illumination

2 minutes to read

This is a JavaScript project that is using Git as version control. In the project there is a bot.js file and a config.json file. In the second one there is a string encoded in Base64:

{
  "token": "Replace me with token when in use! Security Risk!",
  "prefix": "~",
  "lightNum": "1337",
  "username": "UmVkIEhlcnJpbmcsIHJlYWQgdGhlIEpTIGNhcmVmdWxseQ==",  
  "host": "127.0.0.1"
}

$ echo UmVkIEhlcnJpbmcsIHJlYWQgdGhlIEpTIGNhcmVmdWxseQ== | base64 -d  
Red Herring, read the JS carefully

The token key seems interesting. Maybe the flag can be found in older commits. Using git log we are able to see the commit history:

$ git log
commit edc5aabf933f6bb161ceca6cf7d0d2160ce333ec (HEAD -> master)
Author: SherlockSec <dan@lights.htb>
Date:   Fri May 31 14:16:43 2019 +0100

    Added some white space for readability!

commit 47241a47f62ada864ec74bd6dedc4d33f4374699
Author: SherlockSec <dan@lights.htb>
Date:   Fri May 31 12:00:54 2019 +0100

    Thanks to contributors, I removed the unique token as it was a security risk. Thanks for reporting responsibly!  

commit ddc606f8fa05c363ea4de20f31834e97dd527381
Author: SherlockSec <dan@lights.htb>
Date:   Fri May 31 09:14:04 2019 +0100

    Added some more comments for the lovely contributors! Thanks for helping out!

commit 335d6cfe3cdc25b89cae81c50ffb957b86bf5a4a
Author: SherlockSec <dan@lights.htb>
Date:   Thu May 30 22:16:02 2019 +0100

    Moving to Git, first time using it. First Commit!

After looking at all the commits with git diff, we notice the following in the first commit:

$ git diff 335d6cfe3cdc25b89cae81c50ffb957b86bf5a4a config.json
diff --git a/config.json b/config.json
index 316dc21..a5b75d2 100644
--- a/config.json
+++ b/config.json
@@ -1,9 +1,9 @@
-{
-
-       "token": "SFRCe3YzcnNpMG5fYzBudHIwbF9hbV9JX3JpZ2h0P30=",
-       "prefix": "~",
-       "lightNum": "1337",
-       "username": "UmVkIEhlcnJpbmcsIHJlYWQgdGhlIEpTIGNhcmVmdWxseQ==",
-       "host": "127.0.0.1"
-
+{^M
+^M
+       "token": "Replace me with token when in use! Security Risk!",^M
+       "prefix": "~",^M
+       "lightNum": "1337",^M
+       "username": "UmVkIEhlcnJpbmcsIHJlYWQgdGhlIEpTIGNhcmVmdWxseQ==",^M    
+       "host": "127.0.0.1"^M
+^M
 }
\ No newline at end of file

Decoding the token, we find the flag:

$ echo SFRCe3YzcnNpMG5fYzBudHIwbF9hbV9JX3JpZ2h0P30= | base64 -d  
HTB{v3rsi0n_c0ntr0l_am_I_right?}