Правила (Rules)

Platform: duckerz | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: XESXOR | Date: 2026-01-09 | Status: Solved Techniques: external_script_analysis, js_deobfuscation, xor_decryption

Summary

Task: Web page with a runaway button and external analytics.js script. Solution: Ignored the button distraction, found XOR-encrypted flag in the external JS file, decrypted with key 0x03.

Правила (Rules) - duckerz CTF

Description

Ваша цель - подтвердить, что вы прочитали статью 272 УК РФ и осознаёте всю серьёзность её последствий.

(Your goal is to confirm that you have read Article 272 of the Russian Criminal Code and understand the seriousness of its consequences.)

URL: http://tasks.duckerz.ru:30054

Analysis

Initial Inspection

The page displays the text of Article 272 of the Russian Criminal Code (about unauthorized access to computer information) with an "I acknowledge" button. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Trap: The button runs away from the mouse cursor! JavaScript moves it when you approach, making it impossible to click.

Source Code Investigation

HTML analysis revealed an external script:

 html read-only • copy allowed Copy
<script src="analytics.js"></script>

Analyzing analytics.js

The file contains obfuscated JavaScript code. Among the obfuscation, a suspicious string was found:

 javascript read-only • copy allowed Copy
'GV@HFQYxwkbw\\avwwlm\\tbp\\gfejmjwfoz\\mlw\\lmf\\le\\wkf\\wfqnp~'

Characteristic signs of XOR encryption:

• The string contains printable ASCII characters
• Starts with characters close to DUCKERZ by ASCII codes
• Contains escape sequences \\ ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

XOR Decryption

Analysis of the first characters:

• G (0x47) XOR D (0x44) = 0x03
• V (0x56) XOR U (0x55) = 0x03
• @ (0x40) XOR C (0x43) = 0x03

XOR key: 0x03

Decryption Script

 python read-only • copy allowed Copy
#!/usr/bin/env python3
"""
duckerz CTF - Правила (task 33)
XOR decryption of hidden flag in analytics.js
"""

encrypted = 'GV@HFQYxwkbw\\avwwlm\\tbp\\gfejmjwfoz\\mlw\\lmf\\le\\wkf\\wfqnp~'
key = 0x3

decrypted = ''.join(chr(ord(c) ^ key) for c in encrypted)
print(f"Flag: {decrypted}")

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Result

Flag: DUCKERZ{REDACTED}

Lessons Learned

1. Don't fall for distractions - the runaway button was bait
2. Always check external scripts - analytics.js is often used to hide data
3. XOR with a small key - easy to determine by comparing the first characters with the known flag format
4. Flag irony - "that button was definitely not one of the terms" confirms the button was a trap

Related Techniques

• XOR Cipher
• JavaScript Deobfuscation
• Client-Side Analysis ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍