DASCTF[Minesweepe]
题目名:Minesweepe
作者:Hopeace
靶场地址:183.129.189.60:10005
0x01 分析题目
游戏类的题目一般就是两种思路:
第一是玩儿游戏,当然难度比较大,第三关的扫雷确实难,做了两次运气不太好,没解出来
第二是修改js代码
0x02 修改js代码
利用chrome自带的开发者工具
进去发现,右键被禁用了(怪不得右键没法点检查)
找到了success的函数
里面有一串加密的代码
明显是flag
var _0x5a3c=['w7bDkcO+wo3Cig3Cq0Q=','N8KrS3hvwr5GwrA4XgXCpwo=','aFxHw49Ww4bCsMOV','fTl2AMKhwphYOxXCl8KEd8O0','wpvCvX4eI8K3P8Ke','w78YwopFw77DtVrCh27DiRkHw7bDuQ=='];var _0x4cf3=function(_0x5a3c3e,_0x4cf3a9){_0x5a3c3e=_0x5a3c3e-0x0;var _0x46bb75=_0x5a3c[_0x5a3c3e];if(_0x4cf3['pyRNGP']===undefined){(function(){var _0x279a73;try{var _0x25b2df=Function('return\x20(function()\x20'+'{}.constructor(\x22return\x20this\x22)(\x20)'+');');_0x279a73=_0x25b2df();}catch(_0x44bb3a){_0x279a73=window;}var _0x3a8cf0='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=';_0x279a73['atob']||(_0x279a73['atob']=function(_0x5e6cb3){var _0x251399=String(_0x5e6cb3)['replace'](/=+$/,'');var _0x3be520='';for(var _0x31ea4a=0x0,_0x1689fd,_0x11a08e,_0x1c83ef=0x0;_0x11a08e=_0x251399['charAt'](_0x1c83ef++);~_0x11a08e&&(_0x1689fd=_0x31ea4a%0x4?_0x1689fd*0x40+_0x11a08e:_0x11a08e,_0x31ea4a++%0x4)?_0x3be520+=String['fromCharCode'](0xff&_0x1689fd>>(-0x2*_0x31ea4a&0x6)):0x0){_0x11a08e=_0x3a8cf0['indexOf'](_0x11a08e);}return _0x3be520;});}());var _0xc16ed0=function(_0x2d2765,_0x4fc2c5){var _0x48499b=[],_0x3bf0fd=0x0,_0x4ccf46,_0x12f248='',_0x1112ff='';_0x2d2765=atob(_0x2d2765);for(var _0x5e74db=0x0,_0x2a6c1f=_0x2d2765['length'];_0x5e74db<_0x2a6c1f;_0x5e74db++){_0x1112ff+='%'+('00'+_0x2d2765['charCodeAt'](_0x5e74db)['toString'](0x10))['slice'](-0x2);}_0x2d2765=decodeURIComponent(_0x1112ff);var _0x436da0;for(_0x436da0=0x0;_0x436da0<0x100;_0x436da0++){_0x48499b[_0x436da0]=_0x436da0;}for(_0x436da0=0x0;_0x436da0<0x100;_0x436da0++){_0x3bf0fd=(_0x3bf0fd+_0x48499b[_0x436da0]+_0x4fc2c5['charCodeAt'](_0x436da0%_0x4fc2c5['length']))%0x100;_0x4ccf46=_0x48499b[_0x436da0];_0x48499b[_0x436da0]=_0x48499b[_0x3bf0fd];_0x48499b[_0x3bf0fd]=_0x4ccf46;}_0x436da0=0x0;_0x3bf0fd=0x0;for(var _0x54447d=0x0;_0x54447d<_0x2d2765['length'];_0x54447d++){_0x436da0=(_0x436da0+0x1)%0x100;_0x3bf0fd=(_0x3bf0fd+_0x48499b[_0x436da0])%0x100;_0x4ccf46=_0x48499b[_0x436da0];_0x48499b[_0x436da0]=_0x48499b[_0x3bf0fd];_0x48499b[_0x3bf0fd]=_0x4ccf46;_0x12f248+=String['fromCharCode'](_0x2d2765['charCodeAt'](_0x54447d)^_0x48499b[(_0x48499b[_0x436da0]+_0x48499b[_0x3bf0fd])%0x100]);}return _0x12f248;};_0x4cf3['kjKZbT']=_0xc16ed0;_0x4cf3['fRfqwz']={};_0x4cf3['pyRNGP']=!![];}var _0x38f5b2=_0x4cf3['fRfqwz'][_0x5a3c3e];if(_0x38f5b2===undefined){if(_0x4cf3['uRleIp']===undefined){_0x4cf3['uRleIp']=!![];}_0x46bb75=_0x4cf3['kjKZbT'](_0x46bb75,_0x4cf3a9);_0x4cf3['fRfqwz'][_0x5a3c3e]=_0x46bb75;}else{_0x46bb75=_0x38f5b2;}return _0x46bb75;};if(this[_0x4cf3('0x0','8)D!')]==0xa)alert(_0x4cf3('0x1','2$t7'));if(this[_0x4cf3('0x2','#Ckz')]==0xf)alert(_0x4cf3('0x3','1vj%'));if(this[_0x4cf3('0x4','%sR9')]==0x14)alert(_0x4cf3('0x5','@2yf'));
第一想法是解密,找相关的开源项目
发现难度太大
后来干脆把这一段代码加到failed函数里
这样故意碰到雷会提示游戏结束,但会继续执行这段代码
得到部分flag
拼凑可得完整flag
DASCTF{c4a204599255589b065eb366cf514aee}
0x03 反思
能不要玩儿游戏就不要玩游戏!!!