HacktheBox 邀请码挑战------can you hack the box?

Invite Challenge

can you hack the box？注册hackthebox的时候会让你输入hackthebox邀请码

F12调出开发者工具，发现一个名为inviteapi.min.js的文件比较像是破解关键

eval(function (p, a, c, k, e, d) {
  e = function (c) {
    return c.toString(36)
  };
  if (!''.replace(/^/, String)) {
    while (c--) {
      d[c.toString(a)] = k[c] || c.toString(a)
    }
    k = [
      function (e) {
        return d[e]
      }
    ];
    e = function () {
      return '\\w+'
    };
    c = 1
  };
  while (c--) {
    if (k[c]) {
      p = p.replace(new RegExp('\\b' + e(c) + '\\b', 'g'), k[c])
    }
  }
  return p
}('1 i(4){h 8={"4":4};$.9({a:"7",5:"6",g:8,b:\'/d/e/n\',c:1(0){3.2(0)},f:1(0){3.2(0)}})}1 j(){$.9({a:"7",5:"6",b:\'/d/e/k/l/m\',c:1(0){3.2(0)},f:1(0){3.2(0)}})}', 24, 24, 'response|function|log|console|code|dataType|json|POST|formData|ajax|type|url|success|api|invite|error|data|var|verifyInviteCode|makeInviteCode|how|to|generate|verify'.split('|'), 0, {
}))

一看就很复杂是吗？解决不清楚的JS代码就是运行它，奥利给！！！运行一遍无回显，但不难发现程序最后return了p，一个小技巧就是在执行return前我们插入一句console.log(p);看看。参数p打印出来为

function verifyInviteCode(code) {
    var formData = {"code": code};
    $.ajax({
        type: "POST", dataType: "json", data: formData, url: '/api/invite/verify', success: function (response) {
            console.log(response)
        }, error: function (response) {
            console.log(response)
        }
    })
}

function makeInviteCode() {
    $.ajax({
        type: "POST", dataType: "json", url: '/api/invite/how/to/generate', success: function (response) {
            console.log(response)
        }, error: function (response) {
            console.log(response)
        }
    })
}

这段代码的意思就简单明了了，makeInviteCode()应该就是获取邀请码的函数。

F12 console口运行makeInviteCode()拿到一段base64编码的字符串

SW4gb3JkZXIgdG8gZ2VuZXJhdGUgdGhlIGludml0ZSBjb2RlLCBtYWtlIGEgUE9TVCByZXF1ZXN0IHRvIC9hcGkvaW52aXRlL2dlbmVyYXRl

解码得到

In order to generate the invite code, make a POST request to /api/invite/generate

使用POST方法访问https://www.hackthebox.eu//api/invite/generate得到

{"success":1,"data":{"code":"VUlXQU4tVEFMSEstTllZWFUtVFhWREQtVUNFSFg=","format":"encoded"},"0":200}

很明显又是base64，解码得到邀请码

UIWAN-TALHK-NYYXU-TXVDD-UCEHX

实测每次获取的邀请码不一样，验证邀请码有效性有基于IP的判断，注册页面有个谷歌人机验证要能刷出来才能注册成功。