Challenge Description
We want to update our website but we are unable to because the developer who coded this left today. Can you take a look?
Provided Files
$ ls -R
.:
css dashboard.html index.html js
./css:
style.css
./js:
login.js
Solution
The login.js file has been obfuscated:
$ cat js/login.js
var _0x4e0b=['\x74\x6f\x53\x74\x72\x69\x6e\x67','\x75\x73\x65\x72\x6e\x61\x6d\x65','\x63\x6f\x6e\x73\x6f\x6c\x65','\x67\x65\x74\x45\x6c\x65\x6d\x65\x6e\x74\x42\x79\x49\x64','\x6c\x6f\x67','\x62\x69\x6e\x64','\x64\x69\x73\x61\x62\x6c\x65\x64','\x61\x70\x70\x6c\x79','\x61\x64\x6d\x69\x6e','\x70\x72\x6f\x74\x6f\x74\x79\x70\x65',
<SNIP>
Code obfuscation is the process of making code difficult to understand for humans, often with the goal of making it harder for attackers to reverse engineer software or for competitors to copy it.
Once the we deobfuscate the code, at the end of the file we find this variable:
var res = String.fromCharCode(72, 84, 66, 123, 87, 51, 76, 99, 48, 109, 51, 95, 55, 48, 95, 74, 52, 86, 52, 53, 67, 82, 49, 112, 55, 95, 100, 51, 48, 98, 70, 117, 53, 67, 52, 55, 49, 48, 78, 125, 10);
Converting the String.fromCharCode()
static function parameters from ASCII codes to text characters gives us the flag:
HTB{W3L************************10N}