My Buddy Erik

Description

My buddy Erik wants to play Minecraft so I set up a server for us to play on. I've commited my configuration to GitHub because it's so convenient! Can you make sure that everything is secure?

https://github.com/VikeSec/vikeCTF-2024-minecraft-server

Solution

The github commit history is not that interesting, but we do we a reverted commit: Revert "Add RCON password".

erik-1

Since the commit has been deleted locally and uploaded to remote cloning wont give satisfactory results. We need to search github for deleted commits.

If we go to branches we see update 2 days ago by malcolmseyd. That's weird... because commit history shows update from last week.

erik-2

We can dig further into this Activity, by going to 3 dot -> Activity.

erik-3

Compare Changes: Disable Mojang telemetry (3 dots)

Add RCON password

Flag: vikeCTF{Y0u_c4N7_3rA5e_H1sT0Ry}