Путь домой (Path Home)

Platform: duckerz | Category: Hardware | Type: Challenge | Difficulty: Easy | OS: NA | Author: XESXOR | Date: 2026-01-09 | Status: Solved Techniques: base64_decoding, js_deobfuscation, source_code_analysis, xor_decryption

Summary

Task: Interactive web game simulating RFID key cloning for an intercom. Solution: Deobfuscate JavaScript to extract Base64-encoded data and XOR key, then decrypt the flag.

Путь домой (Path Home) — duckerz CTF

Description

Я очень хочу попасть домой. (I really want to get home.)

URL: http://tasks.duckerz.ru:30059

Analysis

The task is an interactive web game simulating the process of cloning an RFID key fob for an intercom system.

Step 1: HTML Investigation

Upon loading the page, a game with drag-and-drop mechanics was discovered, simulating the process of cloning an RFID key for an intercom.

Step 2: JavaScript Analysis

In the file /static/js/script.js, obfuscated JavaScript code was found containing:

• String array for obfuscation
• xorDecrypt function for flag decryption
• Encrypted data in Base64 format
• XOR key (keyID) ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 3: Data Extraction

Critical data extracted from the obfuscated code:

• Encrypted flag (Base64): AhIHAQwdFjNiNhM4AxcbZiQ8LRUkeD4ZARkzaQskGSN0PBsOPDkNNQ==
• XOR key (keyID): FGDJIOLHFBFHJSDGJHHGGHSFHFDHGHFDGHDFSTHHGJKDLFJGK;ASLDHG;AKLJHSDFGJOKJKGHDTJADFGJHASFDG

Solution

XOR decryption using the extracted key:

 python read-only • copy allowed Copy
#!/usr/bin/env python3
"""
duckerz CTF - Путь домой (Path Home)
XOR decryption of the flag from obfuscated JavaScript
"""

import base64

# Extracted from obfuscated JavaScript
encrypted_b64 = 'AhIHAQwdFjNiNhM4AxcbZiQ8LRUkeD4ZARkzaQskGSN0PBsOPDkNNQ=='
keyID = 'FGDJIOLHFBFHJSDGJHHGGHSFHFDHGHFDGHDFSTHHGJKDLFJGK;ASLDHG;AKLJHSDFGJOKJKGHDTJADFGJHASFDG'
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Decode Base64
encrypted = base64.b64decode(encrypted_b64)

# XOR decrypt
decrypted = ''
for i, byte in enumerate(encrypted):
    decrypted += chr(byte ^ ord(keyID[i % len(keyID)]))

print(f"Flag: {decrypted}")

Output:

Flag: DUCKERZ{REDACTED}

Notes

• Despite the "Hardware" category, the task is solved through web code analysis
• The RFID theme is just a wrapper for a cryptographic challenge
• JavaScript obfuscation often hides simple operations (XOR, Base64)
• Always check the source code of web pages in CTF tasks ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍