HacktheBox 邀请码挑战------can you hack the box?

àì夳堔傛蜴生んèń 2023-07-17 14:14 20阅读 0赞

### Invite Challenge ###

can you hack the box？注册hackthebox的时候会让你输入hackthebox邀请码

F12调出开发者工具，发现一个名为`inviteapi.min.js`的文件比较像是破解关键

eval(function (p, a, c, k, e, d) { 
      e = function (c) { 
        return c.toString(36)
      };
      if (!''.replace(/^/, String)) { 
        while (c--) { 
          d[c.toString(a)] = k[c] || c.toString(a)
        }
        k = [
          function (e) { 
            return d[e]
          }
        ];
        e = function () { 
          return '\\w+'
        };
        c = 1
      };
      while (c--) { 
        if (k[c]) { 
          p = p.replace(new RegExp('\\b' + e(c) + '\\b', 'g'), k[c])
        }
      }
      return p
    }('1 i(4){h 8={"4":4};$.9({a:"7",5:"6",g:8,b:\'/d/e/n\',c:1(0){3.2(0)},f:1(0){3.2(0)}})}1 j(){$.9({a:"7",5:"6",b:\'/d/e/k/l/m\',c:1(0){3.2(0)},f:1(0){3.2(0)}})}', 24, 24, 'response|function|log|console|code|dataType|json|POST|formData|ajax|type|url|success|api|invite|error|data|var|verifyInviteCode|makeInviteCode|how|to|generate|verify'.split('|'), 0, { 
    }))

一看就很复杂是吗？解决不清楚的JS代码就是运行它，奥利给！！！运行一遍无回显，但不难发现程序最后return了p，一个小技巧就是在执行return前我们插入一句`console.log(p);`看看。参数p打印出来为

function verifyInviteCode(code) { 
        var formData = { "code": code};
        $.ajax({ 
            type: "POST", dataType: "json", data: formData, url: '/api/invite/verify', success: function (response) { 
                console.log(response)
            }, error: function (response) { 
                console.log(response)
            }
        })
    }
    
    function makeInviteCode() { 
        $.ajax({ 
            type: "POST", dataType: "json", url: '/api/invite/how/to/generate', success: function (response) { 
                console.log(response)
            }, error: function (response) { 
                console.log(response)
            }
        })
    }

这段代码的意思就简单明了了，makeInviteCode()应该就是获取邀请码的函数。

F12 console口运行makeInviteCode()拿到一段base64编码的字符串

SW4gb3JkZXIgdG8gZ2VuZXJhdGUgdGhlIGludml0ZSBjb2RlLCBtYWtlIGEgUE9TVCByZXF1ZXN0IHRvIC9hcGkvaW52aXRlL2dlbmVyYXRl

解码得到

In order to generate the invite code, make a POST request to /api/invite/generate

使用POST方法访问`https://www.hackthebox.eu//api/invite/generate`得到

{ "success":1,"data":{ "code":"VUlXQU4tVEFMSEstTllZWFUtVFhWREQtVUNFSFg=","format":"encoded"},"0":200}

很明显又是base64，解码得到邀请码

UIWAN-TALHK-NYYXU-TXVDD-UCEHX

实测每次获取的邀请码不一样，验证邀请码有效性有基于IP的判断，注册页面有个谷歌人机验证要能刷出来才能注册成功。