[b01lers2020]Welcome to Earth

一直自動跳轉/die/頁面，只能抓包看

看到有個/chase/，進去看一下

去/leftt/中看一眼

后面就一路找，但是沒找到什么有用的信息
看了wp才知道，關鍵點在js文件中

/static/js/door.js

最后來到static/js/fight.js

// Run to scramble original flag
//console.log(scramble(flag, action));
function scramble(flag, key) {
  for (var i = 0; i < key.length; i++) {
    let n = key.charCodeAt(i) % flag.length;
    let temp = flag[i];
    flag[i] = flag[n];
    flag[n] = temp;
  }
  return flag;
}

function check_action() {
  var action = document.getElementById("action").value;
  var flag = ["{hey", "_boy", "aaaa", "s_im", "ck!}", "_baa", "aaaa", "pctf"];

  // TODO: unscramble function
}

看起來flag順序被打亂了，排列組合一下就行

#coding:utf-8
from itertools import permutations

flag = ["{hey", "_boy", "aaaa", "s_im", "ck!}", "_baa", "aaaa", "pctf"]

item = permutations(flag)
for i in item:
	k = ''.join(list(i))
	if k.startswith('pctf{hey_boys') and k[-1] == '}':
		print(k)

最后flagpctf{hey_boys_im_baaaaaaaaaack!}
參考
https://www.yuque.com/u390550/kdmol2/ul9gfw