Hackvent 2024: Day 22

[HV24.22] Santa's Secret Git Feature

Santa found a new awesome git feature to hide presents. However, he thinks it does not fit the Christmas theme, but maybe his good friend, the easter bunny, can use it... Can you find his hidden present?

https://github.com/santawoods/christmas-secret-feature

Analyze the git repository and get the flag.
Flag format: HV24{}

This challenge was written by explo1t. Luckily it's not a git zero day explo1t.

Solution

This challenge provides us with a link to this GitHub repository:

https://github.com/santawoods/christmas-secret-feature

The repository is quite bare-bones and contains only one commit and one file that are not interesting. We spend some time exploring the repository both locally and via the GitHub web API: https://api.github.com/repos/santawoods/christmas-secret-feature

Initially, we don't find anything important. However, we eventually stumble upon this page which lists the remote refs:
https://api.github.com/repos/santawoods/christmas-secret-feature/git/refs

// 20241222231938
// https://api.github.com/repos/santawoods/christmas-secret-feature/git/refs

[
  {
    "ref": "refs/heads/main",
    "node_id": "REF_kwDONQZc-q9yZWZzL2hlYWRzL21haW4",
    "url": "https://api.github.com/repos/santawoods/christmas-secret-feature/git/refs/heads/main",
    "object": {
      "sha": "5c1dff6bd6b05a44e41d786a99fa1f95219e2d62",
      "type": "commit",
      "url": "https://api.github.com/repos/santawoods/christmas-secret-feature/git/commits/5c1dff6bd6b05a44e41d786a99fa1f95219e2d62"
    }
  },
  {
    "ref": "refs/notes/commits",
    "node_id": "REF_kwDONQZc-rJyZWZzL25vdGVzL2NvbW1pdHM",
    "url": "https://api.github.com/repos/santawoods/christmas-secret-feature/git/refs/notes/commits",
    "object": {
      "sha": "9a2ab37322768d152595e4d49cdd91d1858d649a",
      "type": "commit",
      "url": "https://api.github.com/repos/santawoods/christmas-secret-feature/git/commits/9a2ab37322768d152595e4d49cdd91d1858d649a"
    }
  }
]

Notice the suspicious looking refs/notes/commits ref.

We open up the object URL: https://api.github.com/repos/santawoods/christmas-secret-feature/git/commits/9a2ab37322768d152595e4d49cdd91d1858d649a

Which links to the commit HTML URL: https://github.com/santawoods/christmas-secret-feature/commit/9a2ab37322768d152595e4d49cdd91d1858d649a

This is a commit which has since been deleted. Deleted commits on GitHub can remain accessible if their commit hash is known. This design ensures the functionality of forks, pull requests, and other features, and supports GitHub's backup mechanisms.

The content of the deleted commit is:

SGVyZSBpcyB0aGUgZmxhZzogSFYyNHtzM2NyM3RfbjB0M19mbDRnX2Z1bn0=

We decode this base64 encoded string to get this message which includes our daily flag:

Here is the flag: HV24{s3cr3t_n0t3_fl4g_fun}

Flag:

HV24{s3cr3t_n0t3_fl4g_fun}