# ArpCon CTF Misc Challenge
### Name: Git The Flag
### Points: 700
###### tags: `CTF` `arpconctf` `misc` `git` `log` `history`

### Challenge

> At the time of this write up, the Arpcon CTF has ended and I no longer have access to the challenge details for screenshot.

### Solution
We were provided with a `secret.zip` file. Extracting the file with `unzip secret.zip` and navigating to the extracted folder, looks like we got ourselves a git repo.


We start by checking the commits using `git log` and we can find some interesting commits.


First we checked out the `added bin` commit and we have the flag.bin, which is the encrypted flag


That's seems to be all in that commit, so we check another one. Checking out the `some codes` commit, we have a `main.py `

import pyaes
import base64
import os
from dotenv import load_dotenv


load_dotenv()
SECRET = os.getenv("SECRET")

flag=open("flag.txt").read()

aes = pyaes.AESModeOfOperationCTR(SECRET.encode())
ciphertext = aes.encrypt(flag)
base_cipher = base64.b64encode(ciphertext)

with open("flag.bin","wb") as file:
  file.write(base_cipher)

Now it looks like we can reverse the code and get our flag, but first we need to find the secret, so we move to checkout another commit. Checking out the `remove flag.py` commit,we have the `.env` file which contains the secret.


Now, let's get started. Import the necessary stuff first.

import pyaes
import base64

Then set our secret

SECRET = "qyrJxvPFAbo8YDYNrCzSSj1DkHjGpLtW"

You can take the flag.bin and read from it, here I will just set it directly in the script.

flag_enc = "/A8Mm2hbkL5yEuss8EelU8xaBsELiJOpilIqpp8="

Next the actual reversing

aes = pyaes.AESModeOfOperationCTR(SECRET.decode())
flag_plaintext = aes.decrypt(base64.b64decode(flag_enc.encode()))
print("FLAG: %s " % flag_plaintext)

We set the aes mode to decode, then base64 decode the encrypted flag and then use aes to decrypt. The full script is

import pyaes
import base64

SECRET = "qyrJxvPFAbo8YDYNrCzSSj1DkHjGpLtW"

flag_enc = "/A8Mm2hbkL5yEuss8EelU8xaBsELiJOpilIqpp8="

aes = pyaes.AESModeOfOperationCTR(SECRET.decode())

flag_plaintext = aes.decrypt(base64.b64decode(flag_enc.encode()))

print("FLAG: %s " % flag_plaintext)

### Flag
And we have the flag as: `arpcon{h1570RY_4lw4Y5_M4773R}`

FLAG: arpcon{h1570RY_4lw4Y5_M4773R}