This is the official developer writeup for the challenge "A door by any other name" that was created for the Digital Overdose Autumn 2021 CTF.

The two other writeups published for this event are:

• Outage - The usual suspect
• A door by any other name

Summary

• Challenge description and statistics
• Context
• Writeup

Challenge description and statistics

The text reads:

(but naming conventions)

Go to the challenge website, find the correct password, submit it as flag, difficult, difficult, lemon difficult

Out of the 5 correct submissions (First blood by Ruy-Lopez), this challenge was rated 100% by all contestants.

Context

For a while now I have been producing source analysis / reversal challenges at various CTFs, be it AppSecVillage@RSACon, AppSecVillage@DefCon29, ShellConLA, or others.

The premise for these challeneges is always the same: the user must find the password, which is the flag.

However, this is not steganography, and some work is involved.

Writeup

The challenge is provided in the form of 4 files:

• index.html: The core markup file, it deals with setting up the various challenge elements.
• styles.css: The styles sheet, which can be safely ignored.
• f0.js: The main script, it deals with reacting to user input and providing m - an empty dictionary - to the ecosystem.
• f1.js: Adds an anonymous namespace into m and calls the comparison function therein. This file is the big fish, and is heavily obfuscated.

Deobfuscation

The code, as partially seen below, is heavily obfuscated using something called JSFuck. JSFuck is an esoteric language that is composed of the characters []()!+. For issues of content size (and to mess up automatic deobfuscators) I have also added the *.

So, what is going on here? That... is an excellent question.

Let us start with Φ and Ξ:

• Φ is a string. Specifically it is the string "UvSgI5/_M26b<z]Ks+e)rn!l}1=p 0Z$`3A.kf^jD>a{yBC(4Y|9;c-G%N?8xho,7:t[iWmuF&"d*LE". Like with any other array-like type in JS, you can then use Φ[i] to access the character at index i.
• Ξ is an empty dictionary. By applying the unpack operator (...) in front of it, we can use it as an element in a new array, thus helping it maintain state.

Now what about the (+!+[]+!+[])**(+![]) and similar things?

Well, if you try out these patterns in the console, you'll get the following results:

• +![] is equal to 0
• +!+[] is equal to 1

So (+!+[]+!+[]) is equal to 1+1 and thus 2.

The ** operator is the power operator, as in a ** b is equal to a, to the power of b.

So our current pattern is regularly 2**(n). Why is that?

This may remind people of binary notation of numbers, but for those that have missed it, the way to write in binary is to decompose the number into a sum of powers of 2.

0b10100111 = 2**7+2**5+2**2+2**1+2**0 = 167. It is much shorter to write then 1+1+1+1+1+1+1+1...+1+1 (167 times) and as such is lighter than the default JSFuck implementation and also harder to automatically deobfuscate using a tool.

Afterwards, since you access characters in Φ, and are appending them one to another, you are producing a new string, which is then a method in JavaScript.

If you didn't want to deobfuscate manually however, you could have used a breakpoint at the correct line to possibly bypass this step.

Once deobfuscated, the code looks like this:

At this point, you are probably thinking something along the lines of "What the hell, Maya?"... and I wouldn't blame you if you did.

So, what is going on here? One thing that gave a few people an idea to start with was the get__s method. Why? Because it is instantly recognizeable as Rijndael's SBox, a permutation table used in the AES algorithm.

This knowledge was not advantageous though, because the algorithm written here is not perfect. There is in fact an intentional mistake when it comes to the generation of subkeys, which breaks tools used for the decryption of the encrypted message.

Another point is that although the AES algoritm implements many steps, most of them can be inserted in secondary functions. This was done here, but most of those functions were then added back as anonymous functions (read: an unnamed function that exists in a namespace and that is then called on the spot).

So, what does the "unclumped" algorithm look like? See below.

Well. This doesn't really help. Let's break it down.

• _: The 192-bit AES key, which -- unhelpfully -- spells out ¬FLAG{TH1$_1$_B1T_T4NG0} (a false flag, because of course).
• __: The encrypted flag.
• p: A function that pads a provided message to a length divisible by 16 (128-bit). It is reversible because the X newly added elements are all of value X.
• u: Converts a string into the list of ASCII values it is composed of.
• stb: Converts a list of all the values to a list of blocks, that are 128-bit.
• get__s: Gets the permutated values using Rijndael's SBOX.
• xr: Performs a linear XOR on a set of lists.
  xr([1,2,3,4], [9,8,7,6]) => [1^9, 2^8, 3^7, 4^6]
• rcon: The round constant used.
• n: Number of 32-bit words composing the key.
• r: Number of rounds for the algorithm.
• sk: Split key into blocks of 4 32-bit words.
• ro: Rotate a 32-bit word, either to the left or to the right.
• gsk: Generate the subkey array for encryption/decryption
• bm: Converts a block (a list of 16 elements / a 128-bit word) into a matrix (a list of 4 lists of 4 elements / of 32-bit words)
• mb: Converts a matrix into a block.
• tsm: Transposes a matrix of size (n*n)
• sr: Shifts the rows of a matrix (row 1 is untouched, row 2 is rotated once, row 3 is rotated twice and row 4 is rotated thrice).
• gm: Perfoms the GF2 (Gallois Field 2) multiplication of 2 numbers.
• zip: Zips two lists together based on index.
  zip([1,2,3,4], [9,8,7,6]) => [[1,9], [2,8], [3,7], [4,6]]
• mc: Performs the mix column operation on the matrix.
• e: The encryption function.
• h: A "hashing" function, which just converts a list of numbers into a string of their hexadecimal representations, because JavaScript isn't good at comparing lists.
• t: The test function, which takes user input, converts it to a list, pads it, encrypts it and checks the "hash" with the hash of the stored encrypted flag.
• c: The constant interface to the code, returns the status of the function execution.

Once we have the code broken down, the decryption function can be written as such:

So... yeah... this produces the flag: DO{Y0UVE_JU$T_D34LT_W1TH_AES-ECB}. It may have been slightly too hard, not too sorry about that.