Мистер Дино (Mr. Dino)

Platform: hackerlab | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: XESXOR | Date: 2025-12-24 | Status: Solved Techniques: NA

Summary

Task: Chrome Dino game clone with obfuscated JavaScript and score submission. Solution: Deobfuscate JS to find RC4 encryption using document.domain as key, then send forged score request.

Мистер Дино (Mr. Dino) — hackerlab.pro

Description

Тревога!!! Интернет пропал

URL: http://62.173.140.174:16037

Analysis

1. Initial Reconnaissance

The site contains a Chrome Dino game clone (the dinosaur game). When starting the game, an alert appears:

Do you wanna a flag? Show me your skill in dinosaur by reaching a 31337 count.

The goal is to score 31337 points. Obviously, playing honestly would take too long and be difficult, so we need to find a way to bypass the check.

2. JavaScript Analysis

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The main code is located in output.js. The code is heavily obfuscated using a custom LCa() function for string shuffling.

After deobfuscation, the chScore() function was discovered, which sends the score to the server:

 javascript read-only • copy allowed Copy
function chScore() {
    var score = Runner.instance_.distanceMeter.digits.join('');
    var encrypted = rc4(document.domain, score.toString());
    var encoded = btoa(encrypted);
    
    fetch('/', {
        method: 'POST',
        headers: {'Content-Type': 'application/json'},
        body: JSON.stringify({hs: encoded})
    });
}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

3. Encryption Scheme

• Algorithm: RC4 (stream cipher)
• Key: document.domain (server IP: 62.173.140.174)
• Data: score as a string
• Request format: {hs: base64(RC4(domain, score))}
• Endpoint: POST /

Solution

Implement RC4 encryption and send a request with the required score:

 python read-only • copy allowed Copy
#!/usr/bin/env python3
import requests
import base64

def rc4_encrypt(key: str, plaintext: str) -> bytes:
    """RC4 encryption implementation"""
    # Key-scheduling algorithm (KSA)
    S = list(range(256))
    j = 0
    for i in range(256):
        j = (j + S[i] + ord(key[i % len(key)])) % 256
        S[i], S[j] = S[j], S[i]
    
    # Pseudo-random generation algorithm (PRGA)
    i = j = 0
    result = []
    for char in plaintext:
        i = (i + 1) % 256
        j = (j + S[i]) % 256
        S[i], S[j] = S[j], S[i]
        result.append(ord(char) ^ S[(S[i] + S[j]) % 256])
    
    return bytes(result)
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Parameters
domain = "62.173.140.174"
target_score = 31337

# Encrypt score
encrypted = rc4_encrypt(domain, str(target_score))
encoded = base64.b64encode(encrypted).decode()

# Send request
response = requests.post(
    "http://62.173.140.174:16037/",
    json={"hs": encoded}
)

print(response.json())

Result:

 json read-only • copy allowed Copy
{"result": "CODEBY{REDACTED}"}

Deobfuscation Techniques

1. Find the deobfuscation function: Look for functions like LCa(), decode(), decrypt()
2. Call in console: Use DevTools to call the function on obfuscated strings
3. Analyze network requests: Network tab shows API request format
4. Breakpoints: Set breakpoints on fetch/XMLHttpRequest to analyze data ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Alternative Approaches

1. Modify score variable: Change Runner.instance_.distanceMeter.digits in console
2. Intercept fetch: Replace fetch with your own function that modifies data
3. Replay attack: Intercept a valid request and modify encrypted data (doesn't work with RC4) ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍