Reverse Staticology

Category

Reversing

Solution

The attached JavaScript is obfuscated using JSFuck. After deobfuscating we get the following script.

const flag=[209,16,229,16,229,73,156,57,220,121,204,112,240,76,13,145,228,44,228,241,176,229,228,220,208,156,84,232,228,229,45,145,172,152,224,220,128,149,48,133,73,225,4,33,105,177];
const v = [87,65,12,122];

function toCharcodeArr(t){
    const n=[];
    for(let e=0;e<t.length;e++) n.push(t.charCodeAt(e));
    return n
};
    
function slice(t){
    p=[];
    q=[];
    for(i=0,j=t.length-1;i<t.length;i+=2,j-=2){
        p.push(t[i]);
        q.push(t[j])
    }
    console.log(p.length/2)
    return [...p.slice(0,p.length/2),...q.slice(),...p.slice(p.length/2)]
};

function stuff(t){
    n=[];
    for (e=0;e<t.length;e++){
        a=(t[e]>>>0).toString(2).padStart(8,"0");
        n.push(parseInt(a.slice(4)+a.slice(2, 4)+a.slice(0, 2), 2))
    }
    return n
};

function encode(t,k){
    n=[];
    for (let e = 0; e < t.length; e++) n.push(t[e]^(v[(e+k)%4])); 
    return n
};

function toHex(t){
    return t.map(t=>{const n=t.toString(16);return 1==n.length?`0${n}`:`${n}`}).join("")
};

function check(t){
    return (t=toHex(slice(stuff(encode(toCharcodeArr(t),"¬flag{1~AM~H3R3}".charCodeAt(10))))))==toHex(flag)
};

const c=(n,e)=>{
    if(document.getElementById("wqxmbGFne0FUT01JQ19XMSRIM1NfWTBVX0cwMERfTFVDS30=")&&n.length%2==0){
        if(check(n)) return e({status:!0,flag:n}),!0} else e({status:!1});return!1};this[0][0]=c;

Reversing the operations in check we end up with the following script.

#!/usr/bin/env python3

flag = [209, 16, 229, 16, 229, 73, 156, 57, 220, 121, 204, 112, 240, 76, 13, 145, 228, 44, 228, 241, 176, 229,
        228, 220, 208, 156, 84, 232, 228, 229, 45, 145, 172, 152, 224, 220, 128, 149, 48, 133, 73, 225, 4, 33, 105, 177]


def rearrange_arr(arr):
    q = arr[:11] + arr[-12:]
    p = arr[11:-12]

    rearranged = []

    for idx in range(len(p)):
        rearranged.append(q[idx])
        rearranged.append(p[len(p) - 1 - idx])

    return rearranged


def fix_binary(arr):
    fixed = []
    for idx in range(len(arr)):
        binary = format(arr[idx], 'b').zfill(8)
        rearranged_binary = int(binary[6:] + binary[4:6] + binary[:4], 2)
        fixed.append(rearranged_binary)

    return fixed


def decode(arr):
    v = [87, 65, 12, 122]
    add_val = 126

    decoded = bytearray()

    for idx in range(len(arr)):
        val = (arr[idx]) ^ v[(idx+add_val) % len(v)]

        decoded.append(val)

    return decoded


rearranged = rearrange_arr(flag)
fixed = fix_binary(rearranged)
decoded = decode(fixed)

print(decoded)

Running the script gives us the flag.

ASV{R3V3R$3_5T4T1C0L0GY_1$_JU5T_TH3_B3G1NN1NG}

n00bz

Home of the n00bz CTF team.


By n00bz, 2021-08-20