Secuinside Quals 2014: Javascript Jail (Misc 200)

david@systemoverlord.com (David Tomaschik) — Mon, 02 Jun 2014 03:43:33 +0000

The challenge was pretty straightforward: connect to a service that’s running a Javascript REPL, and extract the flag. You were provided a check function that was created by the checker function given below:

#!javascript
function checker(flag, myRand) {
 return function (rand) {
 function stage1() {
 var a = Array.apply(null, new Array(Math.floor(Math.random() * 20) + 10)).map(function () {return Math.random() * 0x10000;});
 var b = rand(a.length);

 if (!Array.isArray(b)) {
 print("You're a cheater!");
 return false;
 }

 if (b.length < a.length) {
 print("hmm.. too short..");
 for (var i = 0, n = a.length - b.length; i < n; i++) {
 delete b[b.length];
 b[b.length] = [Math.random() * 0x10000];
 }
 } else if (b.length > a.length) {
 print("hmm.. too long..");
 for (var i = 0, n = b.length - a.length; i < n; i++)
 Array.prototype.pop.apply(b);
 }

 for (var i = 0, n = b.length; i < n; i++) {
 if (a[i] != b[i]) {
 print("ddang~~");
 return false;
 }
 }

 return true;
 }

 function stage2() {
 var a = Array.apply(null, new Array((myRand() % 20) + 10)).map(function () {return myRand() % 0x10000;});
 var b = rand(a.length);

 if (!Array.isArray(b)) {
 print("You're a cheater!");
 return false;
 }

 if (b.length < a.length) {
 print("hmm.. too short..");
 for (var i = 0, n = a.length - b.length; i < n; i++) {
 delete b[b.length];
 b[b.length] = [Math.random() * 0x10000];
 }
 } else if (b.length > a.length) {
 print("hmm.. too long..");
 for (var i = 0, n = b.length - a.length; i < n; i++)
 Array.prototype.pop.apply(b);
 }

 for (var i = 0, n = b.length; i < n; i++) {
 if (a[i] != b[i]) {
 print("ddang~~");
 return false;
 }
 }

 return true;
 }

 print("stage1");

 if (!stage1())
 return;

 print("stage2");

 if (!stage2())
 return;

 print("awesome!");
 return flag;
 };
}

As you can tell, there are two nearly identical stages that create an array of random length (10-30) consisting of random values. The only difference is in how the random values are generated: once from Math.random, and, in stage 2, from a function provided by the factory function. This function was not available to us to reverse the functionality of.

Javascript on System Overlord

Secuinside Quals 2014: Javascript Jail (Misc 200)