We are given a Chrome extension, use 7zip to extract it and we see the contents.
There is malicious code inside [background.js](https://github.com/CTF-STeam/ctf-writeups/blob/master/2020/SPbCTF/nightmode/background.js). The code basically works as follow:- Retrieves IP address from [https://dns.google.com/resolve?name=doyouwannaseestudentmagic.space](https://dns.google.com/resolve?name=doyouwannaseestudentmagic.space), which resolves to `64.227.77.243`- Gets AES encryption key from [http://64.227.77.243:5000/get_aes_key](http://64.227.77.243:5000/get_aes_key): `2F423F4528482B4D6251655468566D59`- Steals the cookie from the browser (not yet implemented in the scope of the challenge)- Obfuscates the cookie using a custom (reversible) algorithm- Encrypts the obfuscated cookie using AES with the key retrieved above- Sends the cookie to [http://64.227.77.243:5000/put_cookie](http://64.227.77.243:5000/put_cookie)
To solve this challenge, first we need to get back the encrypted cookie. With some educated guess, the cookie can be retrieved at: [http://64.227.77.243:5000/get_cookie](http://64.227.77.243:5000/get_cookie)
```JQb6BcUCAScl8x1FxQQ2WJwQNsIDAjYnJQyA+YYHFfCGT4C9JYUV3pye+pCcBO4OJQb6BcUCHSclSzbtxQQiWJxPNsacAjYnJQwd+YYHFc4lQQG9xfwV3pwP+pCcBO4OJQb6BeQCHYSGDCLtwQQ2WNYGNhPpAiInJQwdFiWaFeIlEB29JQIV3pw7+pCcBB0O```
Then all we have to do is decrypt and deobfuscate it to retrieve the flag. Decryption is straightforward with the given `AES_Decrypt` function. I won't go into details the deobfuscation algorithm, instead I have put debugging code inside the solver for you to understand how obfuscation and deobfuscation work: [background_sol.js](https://github.com/CTF-STeam/ctf-writeups/blob/master/2020/SPbCTF/nightmode/background_sol.js)
```javascriptfunction decrypt(encrypted_cookie) {	console.log("===== Decrypting =====");	encrypted_cookie = atob(encrypted_cookie).split('').map(x=>x.charCodeAt(0));	console.log("[+] Encrypted cookie array: " + encrypted_cookie);	AES_Init();	var decrypted_cookie = "";	AES_ExpandKey(key);	for (var i = 0; i < encrypted_cookie.length; i+=16) {		var block = new Array(16);		block = encrypted_cookie.slice(i, i + 16); 		AES_Decrypt(block, key);		decrypted_cookie+= String.fromCharCode.apply(null, block);	}	console.log("[+] AES Decrypted: " + decrypted_cookie);	deobfuscate(decrypted_cookie);}```
Flag: `spbctf{JS_1s_7ra5h_0r_mag1c?}`