Flagbox 2

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Medium | OS: N/A | **Author: XESXOR Techniques: Algorithm reverse engineering, Cookie-based IP manipulation, Digit sum calculation, PHP str_rot13 deobfuscation

Summary

Walkthrough of the CUSTOM Web Flagbox 2. Task: PHP web challenge with str_rot13 obfuscated code and IP-based secret generation. Solution: Deobfuscate str_rot13 strings, reverse engineer xFunc900() algorithm that calculates secret word from I

Description

Прошлая коробка была не такой сложной. Попробуй открыть новую версию! (The previous box wasn't that hard. Try to open the new version!)

URL: http://62.173.140.174:16049/

Analysis

Reconnaissance

Web page with a form requesting a "secret word" to get the flag.

• Server: Apache + PHP
• Source code: available in task.zip

Source Code (index.php)

 php read-only • copy allowed Copy
<?php
// Obfuscated code using str_rot13()
$word_param = str_rot13('jbeq');     // 'word' (POST parameter)
$ip_cookie = str_rot13('vc');        // 'ip' (cookie name)
$prefix = str_rot13('PBQROL');       // 'CODEBY'
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

// IP retrieval logic
if (isset($_COOKIE[$ip_cookie])) {
    $ip = $_COOKIE[$ip_cookie];
} elseif (isset($_SESSION['ip'])) {
    $ip = $_SESSION['ip'];
} elseif (isset($_SERVER['REMOTE_ADDR'])) {
    $ip = $_SERVER['REMOTE_ADDR'];
} elseif (isset($_SERVER['HTTP_X_FORWARDED_FOR'])) {
    $ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
} else {
    $ip = rand(1,255).'.'.rand(1,255).'.'.rand(1,255).'.'.rand(1,255);
}

// Store IP in cookie and session
setcookie($ip_cookie, $ip, time() + 3600);
$_SESSION['ip'] = $ip;
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

// Calculate digit sums for each octet
$octets = explode('.', $ip);
$sums = [];
foreach ($octets as $octet) {
    $sum = 0;
    foreach (str_split($octet) as $digit) {
        $sum += intval($digit);
    }
    $sums[] = $sum;
}
$maxSum = max($sums);

// Generate secret word
function xFunc900($word, $xSum, $xLen) {
    $multipliedXSum = $xSum;
    for ($xm = 0; $xm < $xLen; $xm++) {
        $multipliedXSum += $multipliedXSum * $xSum;
    }
    return $word . $multipliedXSum;
}

$secretWord = xFunc900($prefix, $maxSum, 6);
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

// Check submitted word
if (isset($_POST[$word_param]) && $_POST[$word_param] === $secretWord) {
    echo $flag;
}
?>

str_rot13 Deobfuscation

Secret Word Generation Algorithm

1. IP retrieval: from cookie ip, session, REMOTE_ADDR, X-Forwarded-For, or random
2. IP splitting: into 4 octets
3. Digit sum: for each octet, the sum of its digits is calculated
4. Maximum: the maximum sum from all 4 octets is taken
5. Generation: xFunc900() function creates the secret word ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

xFunc900() Analysis

 php read-only • copy allowed Copy
function xFunc900($word, $xSum, $xLen) {
    $multipliedXSum = $xSum;
    for ($xm = 0; $xm < $xLen; $xm++) {
        $multipliedXSum += $multipliedXSum * $xSum;
    }
    return $word . $multipliedXSum;
}

Math:

• Initial value: m = xSum
• On each iteration: m = m + m * xSum = m * (1 + xSum)
• After 6 iterations: m = xSum * (1 + xSum)^6

Example for xSum = 12:

m = 12
m = 12 + 12*12 = 12 + 144 = 156
m = 156 + 156*12 = 156 + 1872 = 2028
m = 2028 + 2028*12 = 2028 + 24336 = 26364
m = 26364 + 26364*12 = 26364 + 316368 = 342732
m = 342732 + 342732*12 = 342732 + 4112784 = 4455516
m = 4455516 + 4455516*12 = 4455516 + 53466192 = 57921708

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Result: CODEBY57921708

Solution

Step 1: Get IP from Cookie

 bash read-only • copy allowed Copy
curl -s -c cookies.txt http://62.173.140.174:16049/
cat cookies.txt
# ip=147.45.101.108

Step 2: Calculate Digit Sum for Each Octet

Maximum sum: 12

Step 3: Calculate Secret Word

 php read-only • copy allowed Copy
<?php
function xFunc900($word, $xSum, $xLen) {
    $multipliedXSum = $xSum;
    for ($xm = 0; $xm < $xLen; $xm++) {
        $multipliedXSum += $multipliedXSum * $xSum;
    }
    return $word . $multipliedXSum;
}
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

echo xFunc900("CODEBY", 12, 6);
// Output: CODEBY57921708
?>

Step 4: Submit Request

 bash read-only • copy allowed Copy
curl -s -X POST http://62.173.140.174:16049/ \
  -b "ip=147.45.101.108; PHPSESSID=..." \
  -d "word=CODEBY57921708"

Python Exploit

 python read-only • copy allowed Copy
#!/usr/bin/env python3
import requests

url = "http://62.173.140.174:16049/"

# Step 1: Get IP cookie
session = requests.Session()
r = session.get(url)
ip = session.cookies.get('ip')
print(f"[*] IP from cookie: {ip}")

# Step 2: Calculate digit sums
octets = ip.split('.')
sums = [sum(int(d) for d in octet) for octet in octets]
max_sum = max(sums)
print(f"[*] Digit sums: {sums}")
print(f"[*] Max sum: {max_sum}")
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

# Step 3: Calculate secret word (xFunc900)
def xFunc900(word, xSum, xLen):
    m = xSum
    for _ in range(xLen):
        m += m * xSum
    return word + str(m)

secret = xFunc900("CODEBY", max_sum, 6)
print(f"[*] Secret word: {secret}")

# Step 4: Submit
r = session.post(url, data={"word": secret})
if "CODEBY{" in r.text:
    import re
    flag = re.search(r'CODEBY\{[^}]+\}', r.text).group()
    print(f"[+] Flag: {flag}")

Comparison with Flagbox 1

Lessons

1. str_rot13 is weak obfuscation: easily deobfuscated (ROT13 = ROT13^-1)
2. Cookie-based IP: allows controlling input data
3. Reverse engineering: algorithm analysis is more important than brute force
4. Sequels: often use similar patterns but with added complexity ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Key Takeaways / Lessons

• Mastering Algorithm reverse engineering, Cookie-based IP manipulation, Digit sum calculation, PHP str_rot13 deobfuscation was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-01-04 • CUSTOM • Flagbox 2 • Difficulty: Medium