picoCTF Write-up 02 / 06 · Git / Impersonation / Supply Chain · 2025
MyGit.
Git repository challenge where pushing a commit as root:root@picoctf triggers automated flag reveal. Demonstrates supply-chain trust in commit authorship.
GitSSHImpersonation
Method
Solution path.
01
Cloned remote repo over SSH with unknown host key
02
Configured local git identity to
root / root@picoctf03
Created
flag.txt with placeholder, committed and pushed04
Remote validated author identity and returned the flag
Flag (spoiler)
picoCTF{1mp3rs0n4t4_g17_345y_05f9a904}