# Traverse universe

| Info       | Details          |
| ---------- | ---------------- |
| Category   | Web Exploitation |
| Difficulty | Easy             |

## Challenge Overview

> We've got a website that seems to work **unproperly**. Clicking on every planet reveals nothing but the photo of the planet itself. However, this doesn’t help us reaching the flag.

Also, it's important to observe here that when we click on a planet, we're redirected to the **`planet`** parameter, like so:\
\&#xNAN;**`planet=mercury/mercury.php`** (for example).

So we're gonna analyze the **page source** again.\
(*When you don't know what to do, always check for the cookies, page source, and fuzzing.*)

We see a weird code in one line. If we try to understand this, we get:

```html
<!--
<script>
var _0x5c09 = ['dot-php', 'earth\x20', 'log', 'slash\x20', 'dot-dot-slash\x20', 'flag\x20', 'NASA\x20'];

(function(_0xe916b7, _0x5c0933) {
  var _0x34f1b0 = function(_0x4a989c) {
    while (--_0x4a989c) {
      _0xe916b7['push'](_0xe916b7['shift']());
    }
  };
  _0x34f1b0(++_0x5c0933);
}(_0x5c09, 0xa1));

var _0x34f1 = function(_0xe916b7, _0x5c0933) {
  _0xe916b7 = _0xe916b7 - 0x0;
  var _0x34f1b0 = _0x5c09[_0xe916b7];
  return _0x34f1b0;
};

var algf = _0x34f1('0x4') + _0x34f1('0x1') + _0x34f1('0x3') + 'moon\x20' + 'slash\x20' + _0x34f1('0x6') + _0x34f1('0x3') + _0x34f1('0x5') + _0x34f1('0x0');

console[_0x34f1('0x2')](algf);
</script>
-->
```

This basically means that **`_0x5c09`** is a **string array** with words, and **`algf`** is the **entire path** which should lead to the flag.

So we're now looking only at these 2 lines:

```js
var _0x5c09 = ['dot-php', 'earth\x20', 'log', 'slash\x20', 'dot-dot-slash\x20', 'flag\x20', 'NASA\x20'];
var algf = _0x34f1('0x4') + _0x34f1('0x1') + _0x34f1('0x3') + 'moon\x20' + 'slash\x20' + _0x34f1('0x6') + _0x34f1('0x3') + _0x34f1('0x5') + _0x34f1('0x0');
```

* **`_0x34f1('0x4')`** returns the index 4 element from `_0x5c09`.\
  → `'dot-dot-slash '` → `../`
* Also, **`\x20`** means **space** in hex code.

Putting the pieces together, we obtain the full path:\
\&#xNAN;**`../earth/moon/NASA/flag.php`**

So navigating to:\
\&#xNAN;**`planet=../earth/moon/NASA/flag.php`**, we get

<figure><img src="https://3350216265-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8aLNxke1qPtepwlrf6VI%2Fuploads%2FyiDYtByNkE5q9LLp93iS%2FScreenshot_2.png?alt=media&#x26;token=2bd7e317-20d3-443c-b7b7-0850ceed41df" alt=""><figcaption><p>flag in photo</p></figcaption></figure>

## Final Flag

`SSS{t0_the_m00n_nd_back}`

*made by k0d*
