> For the complete documentation index, see [llms.txt](https://kabinet.gitbook.io/ctf-writeup/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kabinet.gitbook.io/ctf-writeup/authored/cyber-league-2025-major-1/catalog-commits.md).

# catalog commits

## Description

We have hired a talented developer to join our Azure team. However he is a serial yapper always yapping about his new project `cat-a-log`.

View Hint

```
You'll need to call upon the powers of OSINT to find what you're looking for.
```

## Solve

Given the title catalog commits as well as the free hint mentioning osint, this is most likely a github osint challenge.

Searching on Github for the repository `cat-a-log`as sorting it by recent, we can see a Repository that is recently updated near the start time of the CTF.

<figure><img src="/files/MOPhYybIlkUBr4H2qkVy" alt=""><figcaption></figcaption></figure>

Looking at the GitHub Organization of the repo, we noticed a cipher string in the description.

<figure><img src="/files/TsoqGwyBeThV71ibvk0O" alt=""><figcaption></figcaption></figure>

Plugging it into CyberChef returns the value `cyberleague2025`which suggest that we are on the right track.

<figure><img src="/files/6AoADVInPOXBcmaqj4fw" alt=""><figcaption></figcaption></figure>

Looking at the git commits, there are only 2 commits, both being relatively short.

<figure><img src="/files/3o01EdjV9cbJhZkhwic5" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/oTM0fGbqZKC9m4FrY6jO" alt=""><figcaption></figcaption></figure>

Looking at the git diff, we noticed that it is using SAS Tokento access the storage account. Note that there is two seperate SAS Token. As SAS Token is pretty well documented, I will not be doing any further explantion, NetSPI has very good blog documenting in depth on how SAS token works.

{% embed url="<https://www.netspi.com/blog/technical-blog/web-application-penetration-testing/azure-sas-tokens/>" %}

Using Azure storage explorer, we are able to attach to the container and retrieve the flag.

<figure><img src="/files/gzvfNkG8Jf2OrIYgyHBt" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/hlCNhZS1QmRgh5bakO0V" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/TuEe6QEJVSLFjQbuqAi0" alt=""><figcaption></figcaption></figure>

Attempting to paste the SAS token will say URL must not have a path.

<figure><img src="/files/Ce3vzdSgmB6dY7kBbsUl" alt=""><figcaption></figcaption></figure>

This is because the SAS token is referring to the specific object /public/my-awesome-content.zip. If we remove the path, we should be able to connect succesfully.

<figure><img src="/files/3sgiHlFrTRNUHMJqra5B" alt=""><figcaption></figcaption></figure>

Azure Storage Explorer is also able to parse the token and let us know what permission we have.

<figure><img src="/files/0EeMrvpwE4qxyeIzjLSf" alt=""><figcaption></figcaption></figure>

Connecting to the container, we noticed that there is a private folder, and within it contain the file `flag.txt`

<figure><img src="/files/p0pSfUXxkD1Zkk9VSNpI" alt=""><figcaption></figcaption></figure>

```
Flag: CYBERLEAGUE{aLw4ys_cH3ck_y0uR-s@s}
```

## Further Discussion

This challenge was actually inspired by a IRL case study I found from a wiz security blog few years ago.

<https://www.wiz.io/blog/38-terabytes-of-private-data-accidentally-exposed-by-microsoft-ai-researchers>