Challenge 12

javascript challenge

소스를 보면 다음과 같이 되어 있다.

String.fromCharCode() 함수 안에 들어가 있는 내용들을 파이썬을 이용해서 디코딩할 수도 있고 더 간단하게는 자바스크립트 콘솔에 wtf만 입력하면 해당 값을 알 수 있다.

#!/usr/bin/python
# -*- coding: utf-8 -*-
# do9dark
 
import sys
 
wtf = "118,97,114,32,101,110,99,111,61,39,39,59,13,10,118,97,114,32,101,110,99,111,50,61,49,50,54,59,13,10,118,97,114,32,101,110,99,111,51,61,51,51,59,13,10,118,97,114,32,99,107,61,100,111,99,117,109,101,110,116,46,85,82,76,46,115,117,98,115,116,114,40,100,111,99,117,109,101,110,116,46,85,82,76,46,105,110,100,101,120,79,102,40,39,61,39,41,41,59,13,10,32,13,10,32,13,10,102,111,114,40,105,61,49,59,105,60,49,50,50,59,105,43,43,41,13,10,123,13,10,101,110,99,111,61,101,110,99,111,43,83,116,114,105,110,103,46,102,114,111,109,67,104,97,114,67,111,100,101,40,105,44,48,41,59,13,10,125,13,10,32,13,10,102,117,110,99,116,105,111,110,32,101,110,99,111,95,40,120,41,13,10,123,13,10,114,101,116,117,114,110,32,101,110,99,111,46,99,104,97,114,67,111,100,101,65,116,40,120,41,59,13,10,125,13,10,32,13,10,105,102,40,99,107,61,61,34,61,34,43,83,116,114,105,110,103,46,102,114,111,109,67,104,97,114,67,111,100,101,40,101,110,99,111,95,40,50,52,48,41,41,43,83,116,114,105,110,103,46,102,114,111,109,67,104,97,114,67,111,100,101,40,101,110,99,111,95,40,50,50,48,41,41,43,83,116,114,105,110,103,46,102,114,111,109,67,104,97,114,67,111,100,101,40,101,110,99,111,95,40,50,51,50,41,41,43,83,116,114,105,110,103,46,102,114,111,109,67,104,97,114,67,111,100,101,40,101,110,99,111,95,40,49,57,50,41,41,43,83,116,114,105,110,103,46,102,114,111,109,67,104,97,114,67,111,100,101,40,101,110,99,111,95,40,50,50,54,41,41,43,83,116,114,105,110,103,46,102,114,111,109,67,104,97,114,67,111,100,101,40,101,110,99,111,95,40,50,48,48,41,41,43,83,116,114,105,110,103,46,102,114,111,109,67,104,97,114,67,111,100,101,40,101,110,99,111,95,40,50,48,52,41,41,43,83,116,114,105,110,103,46,102,114,111,109,67,104,97,114,67,111,100,101,40,101,110,99,111,95,40,50,50,50,45,50,41,41,43,83,116,114,105,110,103,46,102,114,111,109,67,104,97,114,67,111,100,101,40,101,110,99,111,95,40,49,57,56,41,41,43,34,126,126,126,126,126,126,34,43,83,116,114,105,110,103,46,102,114,111,109,67,104,97,114,67,111,100,101,40,101,110,99,111,50,41,43,83,116,114,105,110,103,46,102,114,111,109,67,104,97,114,67,111,100,101,40,101,110,99,111,51,41,41,13,10,123,13,10,97,108,101,114,116,40,34,80,97,115,115,119,111,114,100,32,105,115,32,34,43,99,107,46,114,101,112,108,97,99,101,40,34,61,34,44,34,34,41,41,59,13,10,125,13,10"
wtf_word = wtf.split(',')
 
for i in range(0, len(wtf_word)):
    sys.stdout.write(chr(int(wtf_word[i])))

var enco='';

var enco2=126;

var enco3=33;

var ck=document.URL.substr(document.URL.indexOf('='));

 

for(i=1;i<122;i++)

{

enco=enco+String.fromCharCode(i,0);

}

 

function enco_(x)

{

return enco.charCodeAt(x);

}

 

if(ck=="="+String.fromCharCode(enco_(240))+String.fromCharCode(enco_(220))+String.fromCharCode(enco_(232))+String.fromCharCode(enco_(192))+String.fromCharCode(enco_(226))+String.fromCharCode(enco_(200))+String.fromCharCode(enco_(204))+String.fromCharCode(enco_(222-2))+String.fromCharCode(enco_(198))+"~~~~~~"+String.fromCharCode(enco2)+String.fromCharCode(enco3))

{

alert("Password is "+ck.replace("=",""));

}

디코딩된 코드를 보면 ck 값과 어떠한 값과 비교하여 같을 경우 ck에서 '=(equal)'를 제거하고 Password 값이 출력된다.

ck 값과 비교하는 어떠한 값에 대한 정보를 알아내기 위해서는 해당 구문을 그대로 복사해서 자바스크립트 콘솔에 입력하면 해당 값을 알 수 있다.

String.fromCharCode(enco_(240))+String.fromCharCode(enco_(220))+String.fromCharCode(enco_(232))+String.fromCharCode(enco_(192))+String.fromCharCode(enco_(226))+String.fromCharCode(enco_(200))+String.fromCharCode(enco_(204))+String.fromCharCode(enco_(222-2))+String.fromCharCode(enco_(198))+"~~~~~~"+String.fromCharCode(enco2)+String.fromCharCode(enco3)

"youaregod~~~~~~~!"

위 소스를 보면 ck는 URL에서 '=(equal)'을 기준으로 뒷부분의 문자열을 가져와서 비교하기 때문에 URL에 ?=youaregod~~~~~~~! 을 입력해주면 패스워드를 알 수 있다.

여기에서 URL에 입력하지 않아도 소스를 보면 '=(equal)'만 제거한 값이 패스워드인 것을 알 수 있다.

패스워드를 인증하면 문제를 풀 수 있다.