Force Push
Introduction:
We pulled a copy of the crownspire-deploy repository off a leaked Cinderbound backup. Word is the production warden’s key for the reliquary got committed by mistake and then cleaned up before anyone noticed. The current history looks spotless. Recover what they tried to bury.
Description:
The Cinderbound backup wasn’t lying about the history looking “spotless”, the git log on main showed nothing but clean, well-documented commits. But a force-push never deletes a commit, it just moves a pointer. The old branch tip was still sitting right there in .git/ORIG_HEAD, like a warden who forgot to lock a back door: pointing straight at commit 3c8803d — temp: add reliquary.creds to debug 403 on manifest push (REVERT ME).
That commit didn’t exist in the visible history, but the object had never been garbage collected. Diffing it against the main branch made it clear it was the one divergent commit, and git show revealed the contents of reliquary.creds. The production warden’s key to the reliquary, briefly exposed and “cleaned up” without anyone actually cleaning the object database.
Investigation:
Extract the challenge:
1┌─[ballademageren@parrot]─[~/jutlandia/HTB_CA2026/Force_Push]
2└──╼ $unzip chal.zip
3Archive: chal.zip
4
5[...]
Let’s look at the .git/ folder:
1┌─[ballademageren@parrot]─[~/jutlandia/HTB_CA2026/Force_Push]
2└──╼ $ls -la crownspire-deploy/.git/
3total 28
4drwxr-xr-x 1 ballademageren ballademageren 158 20 jul 15:10 .
5drwxr-xr-x 1 ballademageren ballademageren 426 14 jul 15:21 ..
6-rw-r--r-- 1 ballademageren ballademageren 56 14 jul 15:12 COMMIT_EDITMSG
7-rw-r--r-- 1 ballademageren ballademageren 254 14 jul 15:12 config
8-rw-r--r-- 1 ballademageren ballademageren 73 14 jul 15:12 description
9-rw-r--r-- 1 ballademageren ballademageren 21 14 jul 15:12 HEAD
10drwxr-xr-x 1 ballademageren ballademageren 556 14 jul 15:21 hooks
11-rw-r--r-- 1 ballademageren ballademageren 4579 20 jul 15:10 index
12drwxr-xr-x 1 ballademageren ballademageren 14 14 jul 15:21 info
13drwxr-xr-x 1 ballademageren ballademageren 12 14 jul 16:09 lost-found
14drwxr-xr-x 1 ballademageren ballademageren 504 14 jul 16:07 objects
15-rw-r--r-- 1 ballademageren ballademageren 41 14 jul 15:12 ORIG_HEAD
16drwxr-xr-x 1 ballademageren ballademageren 18 14 jul 15:21 refs
17┌─[ballademageren@parrot]─[~/jutlandia/HTB_CA2026/Force_Push]
18└──╼ $
Someone likely ran a local git reset --hard <previous commit> to remove a not so great commit from the branch, and then they probably ran git push --force to overwrite the branch with the now cleaned history. But Git automatically sets ORIG_HEAD as a backup pointer when you do a local hard reset.
1┌─[ballademageren@parrot]─[~/jutlandia/HTB_CA2026/Force_Push]
2└──╼ $cat crownspire-deploy/.git/ORIG_HEAD
33c8803d7146cd07c75325d6b555116200f2569ee
4┌─[ballademageren@parrot]─[~/jutlandia/HTB_CA2026/Force_Push]
5└──╼ $
This commit wasn’t in the git log on the main branch. But I saw it in .git/lost-found/commit/.
Let’s match the hidden commit with the visible one:
1┌─[ballademageren@parrot]─[~/jutlandia/HTB_CA2026/Force_Push/crownspire-deploy]
2└──╼ $git log --oneline 3c8803d ^main
33c8803d temp: add reliquary.creds to debug 403 on manifest push (REVERT ME)
4┌─[ballademageren@parrot]─[~/jutlandia/HTB_CA2026/Force_Push/crownspire-deploy]
5└──╼ $
The ^main exclude whats already coming from main, so the output only shows commits that is unique for 3c8803d. Which results in one commit that was different.
Let’s look at the commit:
1┌─[ballademageren@parrot]─[~/jutlandia/HTB_CA2026/Force_Push/crownspire-deploy]
2└──╼ $git show 3c8803d
3commit 3c8803d7146cd07c75325d6b555116200f2569ee
4Author: Doran Ash <d.ash@crownspire.valyssar>
5Date: Wed May 27 23:47:19 2026 +0000
6
7 temp: add reliquary.creds to debug 403 on manifest push (REVERT ME)
8
9diff --git a/reliquary.creds b/reliquary.creds
10new file mode 100644
11index 0000000..12b1497
12--- /dev/null
13+++ b/reliquary.creds
14@@ -0,0 +1,6 @@
15+# Crownspire reliquary -- production warden's key. DO NOT COMMIT.
16+RELIQUARY_ENDPOINT=https://reliquary.crownspire.valyssar:9000
17+RELIQUARY_BUCKET=crownspire-reliquary-prod
18+AWS_ACCESS_KEY_ID=AKIACROWNSPIRE7WARD3N
19+AWS_SECRET_ACCESS_KEY=HTB{th3_r3l1qu4ry_n3v3r_f0rg3ts}
20+WARDEN_SIGNING_KEY=astrael-relic-sigil-2f9c
21┌─[ballademageren@parrot]─[~/jutlandia/HTB_CA2026/Force_Push/crownspire-deploy]
22└──╼ $
Awesomeness! AWS_SECRET_ACCESS_KEY=HTB{th3_r3l1qu4ry_n3v3r_f0rg3ts}
But i’m not gonna lie I was curious when I saw the extracting: crownspire-deploy/.git/lost-found/commit/3c8803d7146cd07c75325d6b555116200f2569ee line in the bottom of the output from back when i was extracting the chal and I did the git show 3c8803d by accident back there.
Completion:
