First Steps — avitoctf

Description

А вот кстати и первый самый лёгкий флаг — до него можно дошагать несколькими способами.

The target presents a honeycomb browser game. The apparent goal is to finish its levels, but the real objective is to inspect the client-side implementation and recover the reward generated for each level.

Reconnaissance

Requesting the HTTP URL returns a 303 redirect to HTTPS. The HTTPS root is a static page that loads /assets/firststeps.js. There are no API calls or server-side game-completion endpoints involved in producing the reward.

The standard discovery file is also a dead end:

User-agent: *
Disallow: /

Thus, robots.txt neither discloses the reward nor points to a hidden endpoint. Its blanket disallow rule does not prevent direct inspection of the JavaScript asset.

JavaScript Analysis

The served source contains everything required to reproduce the reward calculation:

• LEVEL_ORDER fixes the processing order as easy, medium, then hard.
• The board dimensions and twelve hole coordinates are constants.
• LEVEL_REWARD_LENGTHS gives the number of characters produced for each level.
• LEVEL_REWARD_DATA stores the encoded reward bytes.
• levelReward(level) implements the complete decoder.

For a selected level, levelReward() starts with a 32-bit state derived from fixed constants, the level index, and the board dimensions. It then mixes every hole's linear cell index into that state with Math.imul() and an 11-bit rotation.

For each output character, the function advances a xorshift32 generator using shifts of 13, 17, and 5 bits. It selects the level's lane from the interleaved reward array and XORs that byte with the low byte of the updated state. JavaScript's unsigned >>> 0 behavior must be retained so that every operation remains within 32 bits.

...