Description:

As deephax, you can see this member keeps a little tooling project in his home directory. deephax swears he scrubbed the credentials out of it.

He’s wrong. Recover the password for the next member, become that user, and read their flag.

Solution:

With the credentials from the Looking Back challenge where we escalated to the user deephax and got the flag, we also spotted a notes.txt and a folder called kingmaker-scraper.

charon:~$ ls -la
total 20
drwxr-x---    3 deephax  deephax       4096 Oct 18 01:14 .
drwxr-xr-x    1 root     root          4096 Oct 18 01:14 ..
-rw-r-----    1 deephax  deephax         34 Oct 18 01:14 flag.txt
drwxr-xr-x    3 deephax  deephax       4096 Oct 18 01:14 kingmaker-scraper
-rw-r-----    1 deephax  deephax        141 Oct 18 01:14 notes.txt
charon:~$ cat notes.txt
reminder: I committed the scraper service pw by accident and "removed" it
in the next commit. must scrub git history properly at some point.
charon:~$ 

The folder kingmaker-scraper is a git repository.

charon:~$ cd kingmaker-scraper/
charon:~/kingmaker-scraper$ ls -la
total 24
drwxr-xr-x    3 deephax  deephax       4096 Oct 18 01:14 .
drwxr-x---    3 deephax  deephax       4096 Oct 18 01:14 ..
drwxr-xr-x    8 deephax  deephax       4096 Oct 18 01:14 .git
-rw-r--r--    1 deephax  deephax        144 Oct 18 01:14 config.py
-rw-r--r--    1 deephax  deephax        163 Oct 18 01:14 gh0st404_note.txt
-rw-r--r--    1 deephax  deephax        232 Oct 18 01:14 scraper.py
charon:~/kingmaker-scraper$ 

Check git log:

Run git checkout 49df4e8cc so we can check out the initial commit: