生活随笔
收集整理的這篇文章主要介紹了
REVERSE-COMPETITION-NEPCTF
小編覺得挺不錯(cuò)的,現(xiàn)在分享給大家,幫大家做個(gè)參考.
REVERSE-COMPETITION-NEPCTF hardcsharp 二十六進(jìn)制 easy_mips password worrrrms 勇士打惡龍(unsolved) Qriver(unsolved) Spy-woman(unsolved)
hardcsharp
.Net程序,dnSpy打開,來(lái)到main函數(shù) 邏輯清晰,獲取輸入,驗(yàn)證輸入的長(zhǎng)度以及包絡(luò),對(duì)輸入進(jìn)行AES加密,和已知的密文比較 直接寫腳本即可得到flag
from Crypto
. Cipher
import AES
import base64
cipher
= "1Umgm5LG6lNPyRCd0LktJhJtyBN7ivpq+EKGmTAcXUM+0ikYZL4h4QTHGqH/3Wh0"
key
= [ 81 , 82 , 87 , 81 , 82 , 87 , 68 , 92 , 94 , 86 , 93 , 18 , 18 , 18 , 18 , 18 , 18 , 18 , 18 , 18 , 18 , 18 , 18 , 18 , 18 , 18 , 18 , 18 , 18 , 18 , 18 , 18 ]
for i
in range ( len ( key
) ) : key
[ i
] ^ = 51
key_str
= '' . join
( chr ( i
) for i
in key
)
aes
= AES
. new
( key_str
, AES
. MODE_ECB
)
print ( aes
. decrypt
( base64
. b64decode
( cipher
) ) )
二十六進(jìn)制
exe程序,無(wú)殼,ida打開 交叉引用字符串"plz input right num:"來(lái)到sub_4010A0函數(shù) 獲取輸入,輸入的數(shù)字字符轉(zhuǎn)成整形數(shù)字,進(jìn)入sub_401120函數(shù)對(duì)輸入進(jìn)行變換以及check sub_401120函數(shù),主要的邏輯寫在了注釋里,結(jié)合二十六進(jìn)制的題目名稱,能感覺到一點(diǎn)出題人什么思路,但是具體說(shuō)不清 實(shí)際上腳本比較簡(jiǎn)單,用二十六進(jìn)制的思路寫就能得到要輸入的數(shù)字
arr
= "2163qwe)(*&^%489$!057@#><A"
res
= "Fb72>&6"
flag
= [ ]
for i
in range ( len ( res
) ) : v4
= chr ( ord ( res
[ i
] ) ^ 7 ) index
= arr
. find
( v4
) flag
. append
( index
)
sum = 0
for i
in range ( len ( flag
) - 1 , 0 , - 1 ) : sum += flag
[ i
] sum *= 26
sum += flag
[ 0 ]
print ( sum )
調(diào)試驗(yàn)證一下,輸入的數(shù)字正確,md5一下即可提交成功
easy_mips
mips文件,無(wú)殼,ida7.5打開 main->tty_write 邏輯清晰,讀取輸入,進(jìn)入encry對(duì)輸入進(jìn)行變換,變換后的輸入與已知比較 進(jìn)入encry函數(shù),首先input的第0個(gè)、第5個(gè)和第6個(gè)值被隨即改變 然后input逐位進(jìn)行一個(gè)減運(yùn)算 寫腳本能得到不是完全正確的flag,結(jié)合flag格式和題目提示的solar,可以得到正確的flag并提交成功
s
= "3_isjA0UeQZcNa\\`\\Vf"
v3
= 5
flag
= ""
for c
in s
: flag
+= chr ( ord ( c
) + v3
) v3
+= 1
print ( flag
)
password
apk文件,jads-gui打開 com.nepnep.app.MainActivity 調(diào)用verify方法驗(yàn)證輸入的key 調(diào)用Encrypt.file方法驗(yàn)證輸入的password和key 先看verify方法,ida打開libnative-lib.so,看到verify其實(shí)就是一個(gè)變表base64 用工具解一下變表base64,即可得到key 再看Encrypt.file方法,實(shí)際上是個(gè)變種RC4,在初始化的地方變了一點(diǎn) 已知密文iArr2和密鑰key,解RC4即可得到解壓密碼
#include <stdio.h>
void rc4_init ( unsigned char * s
, unsigned char * key
, unsigned long Len_k
)
{ int i
= 0 , j
= 0 ; char k
[ 256 ] = { 0 } ; unsigned char tmp
= 0 ; for ( i
= 0 ; i
< 256 ; i
++ ) { s
[ i
] = 256 - i
; k
[ i
] = key
[ i
% Len_k
] ; } for ( i
= 0 ; i
< 256 ; i
++ ) { j
= ( j
+ s
[ i
] + k
[ i
] ) % 256 ; tmp
= s
[ i
] ; s
[ i
] = s
[ j
] ; s
[ j
] = tmp
; }
}
void rc4_crypt ( unsigned char * Data
, unsigned long Len_D
, unsigned char * key
, unsigned long Len_k
)
{ unsigned char s
[ 256 ] ; rc4_init ( s
, key
, Len_k
) ; int i
= 0 , j
= 0 , t
= 0 ; unsigned long k
= 0 ; unsigned char tmp
; for ( k
= 0 ; k
< Len_D
; k
++ ) { i
= ( i
+ 1 ) % 256 ; j
= ( j
+ s
[ i
] ) % 256 ; tmp
= s
[ i
] ; s
[ i
] = s
[ j
] ; s
[ j
] = tmp
; t
= ( s
[ i
] + s
[ j
] ) % 256 ; Data
[ k
] = Data
[ k
] ^ s
[ t
] ; }
}
void main ( )
{ unsigned char key
[ ] = "th1s_1s_k3y!!!!!" ; unsigned long key_len
= sizeof ( key
) - 1 ; unsigned char data
[ ] = { 139 , 210 , 217 , 93 , 149 , 255 , 126 , 95 , 41 , 86 , 18 , 185 , 239 , 236 , 139 , 208 , 69 } ; rc4_crypt ( data
, sizeof ( data
) , key
, key_len
) ; for ( int i
= 0 ; i
< sizeof ( data
) ; i
++ ) { printf ( "%c" , data
[ i
] ) ; }
}
用解壓密鑰解壓縮反編譯出來(lái)的\password\assets\flag.zip即可得到flag
worrrrms
exe程序,無(wú)殼,ida打開 main_main->main_FakeFakeMain 獲取輸入,進(jìn)入worrrrms_puzzle_ChkPlz進(jìn)行輸入的驗(yàn)證 worrrrms_puzzle_ChkPlz函數(shù),常規(guī)SM4,密鑰需要解一下base64
from pysm4
import decrypt
from Crypto
. Util
. number
import bytes_to_long
, long_to_bytes
import base64
key
= base64
. b64decode
( "aWNhbnRlbGx1YXNpbXBsZQ==" )
key_long
= bytes_to_long
( key
)
cipher
= 0x021789C8D9DAFBE50E478C894C1D7AB9
m
= decrypt
( cipher
, key_long
)
print ( long_to_bytes
( m
) )
勇士打惡龍(unsolved)
Qriver(unsolved)
Spy-woman(unsolved)
總結(jié)
以上是生活随笔 為你收集整理的REVERSE-COMPETITION-NEPCTF 的全部?jī)?nèi)容,希望文章能夠幫你解決所遇到的問(wèn)題。
如果覺得生活随笔 網(wǎng)站內(nèi)容還不錯(cuò),歡迎將生活随笔 推薦給好友。