catalog commits
Last updated
Last updated
We have hired a talented developer to join our Azure team. However he is a serial yapper always yapping about his new project cat-a-log.
View Hint
Given the title catalog commits as well as the free hint mentioning osint, this is most likely a github osint challenge.
Searching on Github for the repository cat-a-logas sorting it by recent, we can see a Repository that is recently updated near the start time of the CTF.
Looking at the GitHub Organization of the repo, we noticed a cipher string in the description.
Plugging it into CyberChef returns the value cyberleague2025which suggest that we are on the right track.
Looking at the git commits, there are only 2 commits, both being relatively short.
Looking at the git diff, we noticed that it is using SAS Tokento access the storage account. Note that there is two seperate SAS Token. As SAS Token is pretty well documented, I will not be doing any further explantion, NetSPI has very good blog documenting in depth on how SAS token works.
Using Azure storage explorer, we are able to attach to the container and retrieve the flag.
Attempting to paste the SAS token will say URL must not have a path.
This is because the SAS token is referring to the specific object /public/my-awesome-content.zip. If we remove the path, we should be able to connect succesfully.
Azure Storage Explorer is also able to parse the token and let us know what permission we have.
Connecting to the container, we noticed that there is a private folder, and within it contain the file flag.txt
This challenge was actually inspired by a IRL case study I found from a wiz security blog few years ago.
