Skills Assessment — JavaScript Deobfuscation / API Keys

Target: 154.57.164.69:30116

---

Question 1 — Identify the JavaScript file

Try to study the HTML code of the webpage, and identify used JavaScript code within it. What is the name of the JavaScript file being used?

Answer:

api.min.js

How: A GET / request returns the index page. Inspecting the HTML source shows a script tag:

<script src="api.min.js"></script>

---

Question 2 — Run the JavaScript code

Once you find the JavaScript code, try to run it to see if it does any interesting functions. Did you get something in return?

Answer:

HTB{j4v45cr1p7_3num3r4710n_15_k3y}

How: The file api.min.js is an obfuscated eval() (a "p,a,c,k,e,d" packer). Running it executes a console.log() that prints:

HTB{j4v45cr1p7_3num3r4710n_15_k3y}

Note: the empty strings in the keyword array are falsy, so if (k[c]) skips replacing tokens j and n, leaving them as literal letters in the output.

---

Question 3 — Deobfuscate and retrieve the flag variable

As you may have noticed, the JavaScript code is obfuscated. Try applying the skills you learned in this module to deobfuscate the code, and retrieve the 'flag' variable.

Answer:

HTB{n3v3r_run_0bfu5c473d_c0d3!}

How: Deobfuscating the packed code yields:

function apiKeys() {
    var flag = 'HTB{' + 'n' + '3v3r_' + 'run_0' + 'bfu5c' + '473d_' + 'c0d3!' + '}',
        xhr = new XMLHttpRequest(),
        _0x437f8b = '/keys' + '.php';
    xhr['open']('POST', _0x437f8b, !![]);
    xhr['send'](null);
}
console['log']('HTB{' + 'j' + '4v45c' + 'r1p7_' + '3num3' + 'r4710' + 'n_15_' + 'k3y}');

Concatenating the flag variable pieces gives HTB{n3v3r_run_0bfu5c473d_c0d3!}.

---

Question 4 — Replicate the functionality to get the secret key

Try to Analyze the deobfuscated JavaScript code, and understand its main functionality. Once you do, try to replicate what it's doing to get a secret key. What is the key?

Answer:

4150495f70336e5f37333537316e365f31355f66756e

How: The deobfuscated code performs a POST request to /keys.php. Replicating it with a POST /keys.php request returns:

4150495f70336e5f37333537316e365f31355f66756e

---

Question 5 — Decode the key and retrieve the flag

Once you have the secret key, try to decide it's encoding method, and decode it. Then send a 'POST' request to the same previous page with the decoded key as "key=DECODED_KEY". What is the flag you got?

Answer:

HTB{r34dy_70_h4ck_my_w4y_1n_2_HTB}

How: The key is hexadecimal. Decoding it:

41 50 49 5f 70 33 6e 5f 37 33 35 37 31 6e 36 5f 31 35 5f 66 75 6e
API_p3n_73571n6_15_fun

Decoded key: API_p3n_73571n6_15_fun

Sending a POST /keys.php with key=API_p3n_73571n6_15_fun returns the flag:

HTB{r34dy_70_h4ck_my_w4y_1n_2_HTB}