莲城杯DASCTF[Minesweepe]

题目名：Minesweepe
作者：Hopeace
靶场地址：183.129.189.60:10005

0x01 分析题目

游戏类的题目一般就是两种思路：

第一是玩儿游戏，当然难度比较大，第三关的扫雷确实难，做了两次运气不太好，没解出来

第二是修改js代码

0x02 修改js代码

利用chrome自带的开发者工具

进去发现，右键被禁用了（怪不得右键没法点检查）

找到了success的函数

里面有一串加密的代码

明显是flag

var _0x5a3c=['w7bDkcO+wo3Cig3Cq0Q=','N8KrS3hvwr5GwrA4XgXCpwo=','aFxHw49Ww4bCsMOV','fTl2AMKhwphYOxXCl8KEd8O0','wpvCvX4eI8K3P8Ke','w78YwopFw77DtVrCh27DiRkHw7bDuQ=='];var _0x4cf3=function(_0x5a3c3e,_0x4cf3a9){
    
    _0x5a3c3e=_0x5a3c3e-0x0;var _0x46bb75=_0x5a3c[_0x5a3c3e];if(_0x4cf3['pyRNGP']===undefined){
    
    (function(){
    
    var _0x279a73;try{
    
    var _0x25b2df=Function('return\x20(function()\x20'+'{}.constructor(\x22return\x20this\x22)(\x20)'+');');_0x279a73=_0x25b2df();}catch(_0x44bb3a){
    
    _0x279a73=window;}var _0x3a8cf0='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=';_0x279a73['atob']||(_0x279a73['atob']=function(_0x5e6cb3){
    
    var _0x251399=String(_0x5e6cb3)['replace'](/=+$/,'');var _0x3be520='';for(var _0x31ea4a=0x0,_0x1689fd,_0x11a08e,_0x1c83ef=0x0;_0x11a08e=_0x251399['charAt'](_0x1c83ef++);~_0x11a08e&&(_0x1689fd=_0x31ea4a%0x4?_0x1689fd*0x40+_0x11a08e:_0x11a08e,_0x31ea4a++%0x4)?_0x3be520+=String['fromCharCode'](0xff&_0x1689fd>>(-0x2*_0x31ea4a&0x6)):0x0){
    
    _0x11a08e=_0x3a8cf0['indexOf'](_0x11a08e);}return _0x3be520;});}());var _0xc16ed0=function(_0x2d2765,_0x4fc2c5){
    
    var _0x48499b=[],_0x3bf0fd=0x0,_0x4ccf46,_0x12f248='',_0x1112ff='';_0x2d2765=atob(_0x2d2765);for(var _0x5e74db=0x0,_0x2a6c1f=_0x2d2765['length'];_0x5e74db<_0x2a6c1f;_0x5e74db++){
    
    _0x1112ff+='%'+('00'+_0x2d2765['charCodeAt'](_0x5e74db)['toString'](0x10))['slice'](-0x2);}_0x2d2765=decodeURIComponent(_0x1112ff);var _0x436da0;for(_0x436da0=0x0;_0x436da0<0x100;_0x436da0++){
    
    _0x48499b[_0x436da0]=_0x436da0;}for(_0x436da0=0x0;_0x436da0<0x100;_0x436da0++){
    
    _0x3bf0fd=(_0x3bf0fd+_0x48499b[_0x436da0]+_0x4fc2c5['charCodeAt'](_0x436da0%_0x4fc2c5['length']))%0x100;_0x4ccf46=_0x48499b[_0x436da0];_0x48499b[_0x436da0]=_0x48499b[_0x3bf0fd];_0x48499b[_0x3bf0fd]=_0x4ccf46;}_0x436da0=0x0;_0x3bf0fd=0x0;for(var _0x54447d=0x0;_0x54447d<_0x2d2765['length'];_0x54447d++){
    
    _0x436da0=(_0x436da0+0x1)%0x100;_0x3bf0fd=(_0x3bf0fd+_0x48499b[_0x436da0])%0x100;_0x4ccf46=_0x48499b[_0x436da0];_0x48499b[_0x436da0]=_0x48499b[_0x3bf0fd];_0x48499b[_0x3bf0fd]=_0x4ccf46;_0x12f248+=String['fromCharCode'](_0x2d2765['charCodeAt'](_0x54447d)^_0x48499b[(_0x48499b[_0x436da0]+_0x48499b[_0x3bf0fd])%0x100]);}return _0x12f248;};_0x4cf3['kjKZbT']=_0xc16ed0;_0x4cf3['fRfqwz']={
    
    };_0x4cf3['pyRNGP']=!![];}var _0x38f5b2=_0x4cf3['fRfqwz'][_0x5a3c3e];if(_0x38f5b2===undefined){
    
    if(_0x4cf3['uRleIp']===undefined){
    
    _0x4cf3['uRleIp']=!![];}_0x46bb75=_0x4cf3['kjKZbT'](_0x46bb75,_0x4cf3a9);_0x4cf3['fRfqwz'][_0x5a3c3e]=_0x46bb75;}else{
    
    _0x46bb75=_0x38f5b2;}return _0x46bb75;};if(this[_0x4cf3('0x0','8)D!')]==0xa)alert(_0x4cf3('0x1','2$t7'));if(this[_0x4cf3('0x2','#Ckz')]==0xf)alert(_0x4cf3('0x3','1vj%'));if(this[_0x4cf3('0x4','%sR9')]==0x14)alert(_0x4cf3('0x5','@2yf'));

第一想法是解密，找相关的开源项目

发现难度太大

后来干脆把这一段代码加到failed函数里

这样故意碰到雷会提示游戏结束，但会继续执行这段代码

得到部分flag

拼凑可得完整flag

DASCTF{c4a204599255589b065eb366cf514aee}

0x03 反思

能不要玩儿游戏就不要玩游戏！！！