picoCTF Writeup picoGym Practice Challenges Client-side-again (注意<spoiler>)

# Client-side-again
htmlをダウンロードして編集する
```
<html>
    <head>
        <title>Secure Login Portal V2.0</title>
    </head>
    <body background="barbed_wire.jpeg">
        <!-- standard MD5 implementation -->
        <script type="text/javascript" src="md5.js"></script>
        <script type="text/javascript">
            var _0x5a46 = ['f49bf}', '_again_e', 'this', 'Password\x20Verified', 'Incorrect\x20password', 'getElementById', 'value', 'substring', 'picoCTF{', 'not_this'];
            (function(_0x4bd822, _0x2bd6f7) {
                var _0xb4bdb3 = function(_0x1d68f6) {
                    while (--_0x1d68f6) {
                        _0x4bd822['push'](_0x4bd822['shift']());
                    }
                };
                _0xb4bdb3(++_0x2bd6f7);
            }(_0x5a46, 0x1b3));
            var _0x4b5b = function(_0x2d8f05, _0x4b81bb) {
                _0x2d8f05 = _0x2d8f05 - 0x0;
                var _0x4d74cb = _0x5a46[_0x2d8f05];
                return _0x4d74cb;
            };
            function verify() {
                checkpass = document[_0x4b5b('0x0')]('pass')[_0x4b5b('0x1')];
                split = 0x4;
                alert(0x0 +'-'+ split * 0x2 + '\n' + 0x7 +'-'+ 0x9 +'\n'+ split * 0x2 +'-'+ split * 0x2 * 0x2 + '\n' + 0x3 +'-'+ 0x6 + '\n' + split * 0x3 * 0x2 +'-'+ split * 0x4 * 0x2 + '\n' + 0x6 +'-'+ 0xb + '\n' + split * 0x2 * 0x2 +'-'+ split * 0x3 * 0x2 + '\n' + 0xc +'-'+ 0x10);
                alert(_0x4b5b('0x3')+'\n'+'{n'+'\n'+_0x4b5b('0x4')+'\n'+'oCT'+'\n'+_0x4b5b('0x5')+'\n'+'F{not'+'\n'+_0x4b5b('0x6')+'\n'+_0x4b5b('0x7'));
                if (checkpass[_0x4b5b('0x2')](0x0, split * 0x2) == _0x4b5b('0x3')) {
                    if (checkpass[_0x4b5b('0x2')](0x7, 0x9) == '{n') {
                        if (checkpass[_0x4b5b('0x2')](split * 0x2, split * 0x2 * 0x2) == _0x4b5b('0x4')) {
                            if (checkpass[_0x4b5b('0x2')](0x3, 0x6) == 'oCT') {
                                if (checkpass[_0x4b5b('0x2')](split * 0x3 * 0x2, split * 0x4 * 0x2) == _0x4b5b('0x5')) {
                                    if (checkpass['substring'](0x6, 0xb) == 'F{not') {
                                        if (checkpass[_0x4b5b('0x2')](split * 0x2 * 0x2, split * 0x3 * 0x2) == _0x4b5b('0x6')) {
                                            if (checkpass[_0x4b5b('0x2')](0xc, 0x10) == _0x4b5b('0x7')) {
                                                alert(_0x4b5b('0x8'));
                                            }
                                        }
                                    }
                                }
                            }
                        }
                    }
                } else {
                    alert(_0x4b5b('0x9'));
                }
            }
        </script>
        <div style="position:relative; padding:5px;top:50px; left:38%; width:350px; height:140px; background-color:gray">
            <div style="text-align:center">
                <p>New and Improved Login</p>
                <p>Enter valid credentials to proceed</p>
                <form action="index.html" method="post">
                    <input type="password" id="pass" size="8"/>
                    <br/>
                    <input type="submit" value="verify" onclick="verify(); return false;"/>
                </form>
            </div>
        </div>
    </body>
</html>


```

if分で書かれている文字を出力するような文を書く

```
alert(0x0 +'-'+ split * 0x2 + '\n' + 0x7 +'-'+ 0x9 +'\n'+ split * 0x2 +'-'+ split * 0x2 * 0x2 + '\n' + 0x3 +'-'+ 0x6 + '\n' + split * 0x3 * 0x2 +'-'+ split * 0x4 * 0x2 + '\n' + 0x6 +'-'+ 0xb + '\n' + split * 0x2 * 0x2 +'-'+ split * 0x3 * 0x2 + '\n' + 0xc +'-'+ 0x10);
                alert(_0x4b5b('0x3')+'\n'+'{n'+'\n'+_0x4b5b('0x4')+'\n'+'oCT'+'\n'+_0x4b5b('0x5')+'\n'+'F{not'+'\n'+_0x4b5b('0x6')+'\n'+_0x4b5b('0x7'));
```

0-8
7-9
8-16
3-6
24-32
6-11
16-24
12-16



0 1 2 3 4 5 6 7 8
8 9
9 10 11 12 13 14 15 16
4 5 6
25 26 27 28 29 30 31 32
7 8 9 10 11
17 18 19 20 21 22 23 24
13 14 15 16

picoctf{
{n
not_this
oCT
f49bf}
F{not
_again_e
this

整理すると

picoCTF{not_this_again_ef49bf}