What is this?

Platform: TaipanByte | Category: Misc | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-02-14 | Status: Solved Techniques: base64_decoding, custom_js_environment, jsfuck_execution, jsfuck_recognition

Summary

Task: "Try decode this" — a file wtf.tb is provided for download.

What is this? — TaipanByte

Description

Task: "Try decode this" — a file wtf.tb is provided for download.

Flag format: TB{...}

Analysis

1. File Identification

The downloaded file wtf.tb (9657 bytes) is identified as ASCII text with one very long line:

 bash read-only • copy allowed Copy
$ file wtf.tb
wtf.tb: ASCII text, with very long lines (9656)

The file contains a single line of 9656 characters.

2. Base64 Recognition

The file content consists exclusively of standard Base64 alphabet characters: A-Z, a-z, 0-9, +, /. This clearly indicates Base64 encoding. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 bash read-only • copy allowed Copy
$ base64 -d wtf.tb > decoded.txt
$ wc -c decoded.txt
7242 decoded.txt

3. JSFuck Recognition

The decoded content (7242 bytes) consists exclusively of 6 characters: []()!+. This is JSFuck — an esoteric JavaScript representation using only these characters.

 bash read-only • copy allowed Copy
$ cat decoded.txt | head -c 100
[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+(![]+[]...

4. How JSFuck Works

JSFuck exploits JavaScript's type coercion mechanism:

From these primitives, any string can be constructed and arbitrary JavaScript code can be executed. In this case, the JSFuck code calls alert() with the flag.

Solution

Step 1: Download and Decode

 bash read-only • copy allowed Copy
# Download the file
curl -o wtf.tb <URL>

# Identify the format
file wtf.tb
# ASCII text, with very long lines (9656)

# Base64 decoding
base64 -d wtf.tb > decoded.js

Step 2: Execute JSFuck in Node.js

The JSFuck code calls alert(), which doesn't exist in Node.js (it's a browser function). We need to define it manually: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 javascript read-only • copy allowed Copy
// run.js — execute JSFuck in Node.js
const fs = require('fs');

// Define alert for Node.js
global.alert = function(msg) {
    console.log(msg);
};

// Read and execute JSFuck
const code = fs.readFileSync('decoded.js', 'utf-8');
eval(code);

 bash read-only • copy allowed Copy
$ node run.js
TB{REDACTED}

Alternative Method: Browser

You can also execute JSFuck directly in the browser console (DevTools → Console) by pasting the decoded content. The browser has a built-in alert().

Complete Solution Script

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 python read-only • copy allowed Copy
#!/usr/bin/env python3
"""
What is this? — TaipanByte CTF
Base64 → JSFuck → alert(flag)
"""
import base64
import subprocess
import tempfile
import os

# Read the file
with open('wtf.tb', 'r') as f:
    encoded = f.read().strip()

# Base64 decoding
decoded = base64.b64decode(encoded).decode('utf-8')

# Verify it's JSFuck (only 6 characters)
unique_chars = set(decoded)
assert unique_chars.issubset(set('[]()!+')), f"Unexpected chars: {unique_chars - set('[]()!+')}"
print(f"[*] JSFuck detected: {len(decoded)} bytes, chars: {''.join(sorted(unique_chars))}")
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Execute via Node.js with custom alert
with tempfile.NamedTemporaryFile(mode='w', suffix='.js', delete=False) as tmp:
    tmp.write('global.alert = function(msg) { console.log(msg); };\n')
    tmp.write(decoded)
    tmp_path = tmp.name

try:
    result = subprocess.run(['node', tmp_path], capture_output=True, text=True)
    flag = result.stdout.strip()
    print(f"[+] Flag: {flag}")
finally:
    os.unlink(tmp_path)

# Flag: TB{REDACTED}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍