ShaktiCTF 2021 - Pot Of Gold

문제

 

 

 

 

사이트

 

 

 

 

form태그를 보니깐

cuser, cpass로 id, 비번을 주는 걸 볼 수 있다.

 

 

 

 

$(document).ready(function(){
    $("form").submit(function(){
            var usr = $("#cuser").val();
            var pswd = $("#cpass").val();
            var magic = ""; 
            
            var _0x3150=["","\x6C\x65\x6E\x67\x74\x68","\x6D\x61\x78","\x63\x68\x61\x72\x41\x74","\x63\x68\x61\x72\x43\x6F\x64\x65\x41\x74","\x66\x72\x6F\x6D\x43\x68\x61\x72\x43\x6F\x64\x65","\x73\x68\x61\x6B\x74\x69"];function merge(_0xd4c8x2,_0xd4c8x3){for(var _0xd4c8x4=0,_0xd4c8x5=_0x3150[0],_0xd4c8x6=Math[_0x3150[2]](_0xd4c8x2[_0x3150[1]],_0xd4c8x3[_0x3150[1]]);_0xd4c8x4< _0xd4c8x6;_0xd4c8x4++){_0xd4c8x5+= _0xd4c8x2[_0x3150[3]](_0xd4c8x4)|| _0x3150[0];_0xd4c8x5+= _0xd4c8x3[_0x3150[3]](_0xd4c8x4)|| _0x3150[0]};return _0xd4c8x5}function encryptXor(_0xd4c8x8){var _0xd4c8x9=_0x3150[0];for(var _0xd4c8x4=0,_0xd4c8xa=1;_0xd4c8x4< _0xd4c8x8[_0x3150[1]];_0xd4c8x4++,_0xd4c8xa++){if(_0xd4c8xa== _0xd4c8x8[_0x3150[1]]){_0xd4c8xa= 0};_0xd4c8x9+= String[_0x3150[5]](_0xd4c8x8[_0x3150[4]](_0xd4c8x4)^ _0xd4c8x8[_0x3150[4]](_0xd4c8xa))};return _0xd4c8x9}if(usr[_0x3150[1]]== 5){magic= btoa(encryptXor(merge(_0x3150[6],usr)))}

            if(usr){
                $.redirect("/check.php", {p : pswd, u : usr}, "POST", "_blank"); 
            }
    });
});

자바스크립트 코드다.

 

 

 

$(document).ready(function() {
    $("form").submit(function() {
        var usr = $("#cuser").val();
        var pswd = $("#cpass").val();
        var magic = "";

        var bector = ["", "length", "max", "charAt", "charCodeAt", "fromCharCode", "shakti"];

        function merge(a1, a2) {
            for (var i = 0, aa = bector[0], bb = Math[bector[2]](a1[bector[1]], a2[bector[1]]); i < bb; i++) {
                aa += a1[bector[3]](i) || bector[0];
                aa += a2[bector[3]](i) || bector[0];
            };
            return aa
        }

        function encryptXor(a11) {
            var blank_str = bector[0];
            for (var j = 0, aaa = 1; j < a11[bector[1]]; j++, aaa++) {
                if (aaa == a11[bector[1]]) {
                    aaa = 0
                };
                blank_str += String[bector[5]](   a11[bector[4]](j) ^ a11[bector[4]](aaa)         )
            };
            return blank_str
        }

        if (usr[bector[1]] == 5) {
            magic = btoa(encryptXor(merge(bector[6], usr)))
        }

        if (usr) {
            $.redirect("/check.php", {
                p: pswd,
                u: usr
            }, "POST", "_blank");
        }
    });
});

예쁘게 바꿔주었다.

 

 

 

 

from base64 import b64encode



usr = '12345'                           # 길이가 5여야 함 
# 내가 넣고싶은 5글자


def merge(a1, a2):
    aa = ""
    bb = max(len(a1), len(a2))
    for i in range(bb):
        try:
            aa += a1[i]
        except IndexError:
            pass

        try:
            aa += a2[i]
        except:
            pass
    return aa


def encryptXor(a11):
    blank_str = ""
    aaa = 1
    for j in range(len(a11)):
        if (aaa==len(a11)):
            aaa = 0
        blank_str += chr(ord(a11[j]) ^ ord(a11[aaa]))
        aaa+=1
    return blank_str



a = encryptXor(merge("shakti", usr))


b64 = b64encode(a.encode()).decode()
print(b64)

파이썬 코드로 변경하고 풀 수 있었다.

 

출력 값 : QllaU1JYX0BBXBo=

 

 

 

 

 

 

플래그 : shaktictf{901d_und3r_7h3_r41n60w_768ef91!!!}