🔐 JavaScript Deobfuscation

MEDIUM

Decode the obfuscated JavaScript

📋 Challenge Description

A developer has obfuscated their JavaScript code to hide sensitive information. Your task is to deobfuscate the code and extract the hidden flag. The code uses various obfuscation techniques including hex encoding, string manipulation, and variable substitution.


Objective: Analyze the obfuscated code, understand what it does, and extract the flag.

📄 obfuscated.js 
var _0x4f2a=['\x43\x54\x46\x7b','\x6a\x34\x76\x34','\x73\x63\x72\x31',
'\x70\x74\x5f\x30','\x62\x66\x75\x73','\x63\x34\x74\x31','\x30\x6e\x5f\x6d',
'\x34\x73\x74\x33','\x72\x7d'];

(function(_0x2d8f05,_0x4b81bb){
    var _0x4d74cb=function(_0x32719f){
        while(--_0x32719f){
            _0x2d8f05['push'](_0x2d8f05['shift']());
        }
    };
    _0x4d74cb(++_0x4b81bb);
}(_0x4f2a,0x1f4));

var _0x3d2a=function(_0x2d8f05,_0x4b81bb){
    _0x2d8f05=_0x2d8f05-0x0;
    var _0x4d74cb=_0x4f2a[_0x2d8f05];
    return _0x4d74cb;
};

function getFlag(){
    return _0x3d2a('0x0')+_0x3d2a('0x1')+_0x3d2a('0x2')+
           _0x3d2a('0x3')+_0x3d2a('0x4')+_0x3d2a('0x5')+
           _0x3d2a('0x6')+_0x3d2a('0x7')+_0x3d2a('0x8');
}

console.log(getFlag());

🧪 Test the Code

Click the button to execute the obfuscated code and see the output:

Output will appear here...

💡 Hints to Get Started:

1. Hex Encoding: The strings use \x escape sequences for hex encoding. \x43\x54\x46 = "CTF"
2. Array Manipulation: The IIFE (immediately invoked function) shuffles the array elements.
3. Run It: The easiest way is to simply run the code in the browser console or click "Run Code" above!
4. Manual Decode: Convert each hex string: \x43\x54\x46\x7b = "CTF{", etc.
5. Use Tools: Online hex decoders or JavaScript console can help decode the strings.
6. Ask a Chatbot: "Help me deobfuscate this JavaScript code" and paste the code.
Flag Format: CTF{...}