드림핵 funjs

주어진 파일을 보면 로그인 창이 막 날라다니면서 값도 복잡하게 나온다

var box;

window.onload = init;

function init() {

box = document.getElementById("formbox");

setInterval(moveBox,1000);

}

function moveBox() {

box.posX = Math.random() * (window.innerWidth - 64);

box.posY = Math.random() * (document.documentElement.scrollHeight - 64);

box.style.marginLeft = box.posX + "px";

box.style.marginTop = box.posY + "px";

debugger;

}

​

function text2img(text){

var imglist = box.getElementsByTagName('img');

while(imglist.length > 0) {imglist[0].remove();}

var canvas = document.createElement("canvas");

canvas.width = 620;

canvas.height = 80;

var ctx = canvas.getContext('2d');

ctx.font = "30px Arial";

var text = text;

ctx.fillText(text,10,50);

var img = document.createElement("img");

img.src = canvas.toDataURL();

box.append(img);

};

​

function main(){

var _0x1046=['2XStRDS','1388249ruyIdZ','length','23461saqTxt','9966Ahatiq','1824773xMtSgK','1918853csBQfH','175TzWLTY','flag','getElementById','94hQzdTH','NOP\x20!','11sVVyAj','37594TRDRWW','charCodeAt','296569AQCpHt','fromCharCode','1aqTvAU'];

var _0x376c = function(_0xed94a5, _0xba8f0f) {

_0xed94a5 = _0xed94a5 - 0x175;

var _0x1046bc = _0x1046[_0xed94a5];

return _0x1046bc;

};

var _0x374fd6 = _0x376c;

(function(_0x24638d, _0x413a92) {

var _0x138062 = _0x376c;

while (!![]) {

try {

var _0x41a76b = -parseInt(_0x138062(0x17f)) + parseInt(_0x138062(0x180)) * -parseInt(_0x138062(0x179)) + -parseInt(_0x138062(0x181)) * -parseInt(_0x138062(0x17e)) + -parseInt(_0x138062(0x17b)) + -parseInt(_0x138062(0x177)) * -parseInt(_0x138062(0x17a)) + -parseInt(_0x138062(0x17d)) * -parseInt(_0x138062(0x186)) + -parseInt(_0x138062(0x175)) * -parseInt(_0x138062(0x184));

if (_0x41a76b === _0x413a92) break;

else _0x24638d['push'](_0x24638d['shift']());

} catch (_0x114389) {

_0x24638d['push'](_0x24638d['shift']());

}

}

}(_0x1046, 0xf3764));

var flag = document[_0x374fd6(0x183)](_0x374fd6(0x182))['value'],

_0x4949 = [0x20, 0x5e, 0x7b, 0xd2, 0x59, 0xb1, 0x34, 0x72, 0x1b, 0x69, 0x61, 0x3c, 0x11, 0x35, 0x65, 0x80, 0x9, 0x9d, 0x9, 0x3d, 0x22, 0x7b, 0x1, 0x9d, 0x59, 0xaa, 0x2, 0x6a, 0x53, 0xa7, 0xb, 0xcd, 0x25, 0xdf, 0x1, 0x9c],

_0x42931 = [0x24, 0x16, 0x1, 0xb1, 0xd, 0x4d, 0x1, 0x13, 0x1c, 0x32, 0x1, 0xc, 0x20, 0x2, 0x1, 0xe1, 0x2d, 0x6c, 0x6, 0x59, 0x11, 0x17, 0x35, 0xfe, 0xa, 0x7a, 0x32, 0xe, 0x13, 0x6f, 0x5, 0xae, 0xc, 0x7a, 0x61, 0xe1],

operator = [(_0x3a6862, _0x4b2b8f) => {

return _0x3a6862 + _0x4b2b8f;

}, (_0xa50264, _0x1fa25c) => {

return _0xa50264 - _0x1fa25c;

}, (_0x3d7732, _0x48e1e0) => {

return _0x3d7732 * _0x48e1e0;

}, (_0x32aa3b, _0x53e3ec) => {

return _0x32aa3b ^ _0x53e3ec;

}],

getchar = String[_0x374fd6(0x178)];

if (flag[_0x374fd6(0x17c)] != 0x24) {

text2img(_0x374fd6(0x185));

return;

}

for (var i = 0x0; i < flag[_0x374fd6(0x17c)]; i++) {

if (flag[_0x374fd6(0x176)](i) == operator[i % operator[_0x374fd6(0x17c)]](_0x4949[i], _0x42931[i])) {} else {

text2img(_0x374fd6(0x185));

return;

}

}

text2img(flag);

}

대충 이런 식으로 나오는데 값이 복잡해보인다고 너무 겁먹을 필요는 없다

for (var i = 0x0; i < flag[_0x374fd6(0x17c)]; i++) {

if (flag[_0x374fd6(0x176)](i) == operator[i % operator[_0x374fd6(0x17c)]](_0x4949[i], _0x42931[i])) {} else {

text2img(_0x374fd6(0x185));

return;

마지막에 이 부분을 보면 누가 보아도 flag를 검증하는 if문이라는 것을 파악할 수 있다

operator = [(_0x3a6862, _0x4b2b8f) => {

return _0x3a6862 + _0x4b2b8f;

}, (_0xa50264, _0x1fa25c) => {

return _0xa50264 - _0x1fa25c;

}, (_0x3d7732, _0x48e1e0) => {

return _0x3d7732 * _0x48e1e0;

}, (_0x32aa3b, _0x53e3ec) => {

return _0x32aa3b ^ _0x53e3ec;

}]

그 위에는 연산이 쭉 이어져 오는데 이러면 대략 리버싱 문제를 떠올리면 금방 풀 수 있다

​

main함수의 핵심을 끌어다 모으면

var _0x4949 = [0x20, 0x5e, 0x7b, 0xd2, 0x59, 0xb1, 0x34, 0x72, 0x1b, 0x69, 0x61, 0x3c, 0x11, 0x35, 0x65, 0x80, 0x9, 0x9d, 0x9, 0x3d, 0x22, 0x7b, 0x1, 0x9d, 0x59, 0xaa, 0x2, 0x6a, 0x53, 0xa7, 0xb, 0xcd, 0x25, 0xdf, 0x1, 0x9c]

var _0x42931 = [0x24, 0x16, 0x1, 0xb1, 0xd, 0x4d, 0x1, 0x13, 0x1c, 0x32, 0x1, 0xc, 0x20, 0x2, 0x1, 0xe1, 0x2d, 0x6c, 0x6, 0x59, 0x11, 0x17, 0x35, 0xfe, 0xa, 0x7a, 0x32, 0xe, 0x13, 0x6f, 0x5, 0xae, 0xc, 0x7a, 0x61, 0xe1]

​

var operator = [(_0x3a6862, _0x4b2b8f) => {

return _0x3a6862 + _0x4b2b8f;

}, (_0xa50264, _0x1fa25c) => {

return _0xa50264 - _0x1fa25c;

}, (_0x3d7732, _0x48e1e0) => {

return _0x3d7732 * _0x48e1e0;

}, (_0x32aa3b, _0x53e3ec) => {

return _0x32aa3b ^ _0x53e3ec;

}]

var flag = ""

for (var i = 0x0; i < 100; i++) {

flag += String.fromCharCode(operator[i % operator[_0x374fd6(0x17c)]](_0x4949[i], _0x42931[i]))

}

console.log(flag)

이렇게 된다 근데 이걸 개발자도구에 쳐도 오류만 나온다

그 이유는 _0x374fd6 등이 정의되어 있지 않기 때문이다 따라서

이 파일에서 제공해준 덤프값을 그대로 받으면

var _0x1046=['2XStRDS','1388249ruyIdZ','length','23461saqTxt','9966Ahatiq','1824773xMtSgK','1918853csBQfH','175TzWLTY','flag','getElementById','94hQzdTH','NOP\x20!','11sVVyAj','37594TRDRWW','charCodeAt','296569AQCpHt','fromCharCode','1aqTvAU'];

var _0x376c = function(_0xed94a5, _0xba8f0f) {

_0xed94a5 = _0xed94a5 - 0x175;

var _0x1046bc = _0x1046[_0xed94a5];

return _0x1046bc;

};

var _0x374fd6 = _0x376c;

(function(_0x24638d, _0x413a92) {

var _0x138062 = _0x376c;

while (!![]) {

try {

var _0x41a76b = -parseInt(_0x138062(0x17f)) + parseInt(_0x138062(0x180)) * -parseInt(_0x138062(0x179)) + -parseInt(_0x138062(0x181)) * -parseInt(_0x138062(0x17e)) + -parseInt(_0x138062(0x17b)) + -parseInt(_0x138062(0x177)) * -parseInt(_0x138062(0x17a)) + -parseInt(_0x138062(0x17d)) * -parseInt(_0x138062(0x186)) + -parseInt(_0x138062(0x175)) * -parseInt(_0x138062(0x184));

if (_0x41a76b === _0x413a92) break;

else _0x24638d['push'](_0x24638d['shift']());

} catch (_0x114389) {

_0x24638d['push'](_0x24638d['shift']());

}

}

}(_0x1046, 0xf3764));

var _0x4949 = [0x20, 0x5e, 0x7b, 0xd2, 0x59, 0xb1, 0x34, 0x72, 0x1b, 0x69, 0x61, 0x3c, 0x11, 0x35, 0x65, 0x80, 0x9, 0x9d, 0x9, 0x3d, 0x22, 0x7b, 0x1, 0x9d, 0x59, 0xaa, 0x2, 0x6a, 0x53, 0xa7, 0xb, 0xcd, 0x25, 0xdf, 0x1, 0x9c]

var _0x42931 = [0x24, 0x16, 0x1, 0xb1, 0xd, 0x4d, 0x1, 0x13, 0x1c, 0x32, 0x1, 0xc, 0x20, 0x2, 0x1, 0xe1, 0x2d, 0x6c, 0x6, 0x59, 0x11, 0x17, 0x35, 0xfe, 0xa, 0x7a, 0x32, 0xe, 0x13, 0x6f, 0x5, 0xae, 0xc, 0x7a, 0x61, 0xe1]

​

var operator = [(_0x3a6862, _0x4b2b8f) => {

return _0x3a6862 + _0x4b2b8f;

}, (_0xa50264, _0x1fa25c) => {

return _0xa50264 - _0x1fa25c;

}, (_0x3d7732, _0x48e1e0) => {

return _0x3d7732 * _0x48e1e0;

}, (_0x32aa3b, _0x53e3ec) => {

return _0x32aa3b ^ _0x53e3ec;

}]

var flag = ""

for (var i = 0x0; i < 100; i++) {

flag += String.fromCharCode(operator[i % operator[_0x374fd6(0x17c)]](_0x4949[i], _0x42931[i]))

}

console.log(flag)

대략 이런 식으로 값을 쳐 넣을 수 있다 그러면 flag가 나온다