TryHackMe — Commited

Commited preview

TASK 1

Oh no, not again! One of our developers accidentally committed some sensitive code to our GitHub repository. Well, at least, that is what they told us… the problem is, we don’t remember what or where! Can you track down what we accidentally committed?

Access this Lab by deploying the machine attached to this task by pressing the green “Start Machine” button. You will need to use the in-browser view to complete this room. Don’t see anything? Press the “Show Split Screen” button at the top of the page.

The files you need are located in /home/ubuntu/commited on the VM attached to this task.

Check out similar content on TryHackMe:

Git Happens

Git and Crumpets

Executive summary

In this TryHackMe lab tittled “Commited”, we are tasked with investigating a Github Repository where a developer accidentally commited sensitive information. Unfortunately, the team does not remember what data was exposed or wher it was commited. The Objective of this Lab is to analyze Git Repository. explore its commit history, and identif any sensitive data that was mistakenly uploaded. this lab highlights a common-real security issue: mismanagement of source code and poor version control hygine.

Technical Report

1. Initial Acces

After deploying the machine and opening in split mode in browser, I was presented with a machine view with the committed.zip file

once this open, i open terminal too for unzip this file and i saw the hidden files after i unzipped it

ubuntu@thm-comitted:~/commited/commited$ ls -la
total 20
drwxrwxr-x 3 ubuntu ubuntu 4096 Feb 13  2022 .
drwxrwxr-x 3 ubuntu ubuntu 4096 Jan  6 09:14 ..
drwxrwxr-x 8 ubuntu ubuntu 4096 Feb 13  2022 .git
-rw-rw-r-- 1 ubuntu ubuntu  393 Feb 13  2022 Readme.md
-rw-rw-r-- 1 ubuntu ubuntu  982 Feb 13  2022 main.py
ubuntu@thm-comitted:~/commited/commited$ 

2. check the contents of the folder

the folder has 2 file and 1 hidden folder, and I took the initiative to check main.py

ubuntu@thm-comitted:~/commited/commited$ cat main.py 
import mysql.connector

def create_db():
    mydb = mysql.connector.connect(
    host="localhost",
    user="", # Username Goes Here
    password="" # Password Goes Here
    )

    mycursor = mydb.cursor()

    mycursor.execute("CREATE DATABASE commited")

def create_tables():
    mydb = mysql.connector.connect(
    host="localhost",
    user="", #username Goes here
    password="", #password Goes here
    database="commited"
    )

    mycursor = mydb.cursor()

    mycursor.execute("CREATE TABLE customers (name VARCHAR(255), address VARCHAR(255))")

def populate_tables():
    mydb = mysql.connector.connect(
    host="localhost",
    user="",
    password="",
    database="commited"
    )

    mycursor = mydb.cursor()

    sql = "INSERT INTO customers (name, address) VALUES (%s, %s)"
    val = ("John", "Highway 21")
    mycursor.execute(sql, val)

    mydb.commit()

    print(mycursor.rowcount, "record inserted.")

create_db()
create_tables()
populate_tables()

and it turned out that the pass that would be the flag was not there, yeah the answer in the git history, so i check with the command:

git log --all

the history has 4 commit and the 3rd commit so suspicious, so i check the history for rewind the time and jump into it

git checkout 56c470a2a9dfb5cfbd54cd614a9fdb1644412b5

after checkout the commit and open main.py again, i see a username “root” on main.py, that’s unethical.

but, the i still dont have the flag? where’s the flag? maybe on the last commit ?? yeah i checked commit 4 to make sure

git checkout 3a8cc16f919b8ac43651d68dceacbb28ebb9b625

and yap after i check this commit and cat main.py, i got the flag on the password line

flag{a489a9dbf8eb9d37c6e0cc1a92cda17b}

Conclusion

The Committed TryHackMe Lab is a simple but powerful reminder that small mistakes in version control can cause serious security issues. Something that looks like a harmless commit, or a problem that was “fixed” later, can still expose sensitive information to anyone who knows how to check Git history.

In the end, this lab teaches an important lesson in cybersecurity: once a secret is committed, it should be treated as compromised. Practices like scanning for secrets, using environment variables, and keeping good Git habits are not optional, they are necessary.