CTF刷题记录
目錄
日期：2023.5.11
題目：[ACTF新生賽2020]usualCrypt
日期：2023.5.13
題目：[MRCTF2020]Xor
日期：2023.5.14
題目：Youngter-drive
日期：2023.5.15
題目：[MRCTF2020]hello_world_go
日期：2023.5.17
題目：[FlareOn4]IgniteMe
日期：2023.5.18
題目：[GWCTF 2019]xxor
題目：[WUSTCTF2020]Cr0ssfun
日期：2023.5.19
題目：[FlareOn6]Overlong
日期：2023.5.20
題目：[UTCTF2020]basic-re
題目：[FlareOn3]Challenge1
日期：2023.5.11
題目：[ACTF新生賽2020]usualCrypt
刷題平臺：BUUCTF
方向：REVERSE
Write UP：
獲取題目附件，將文件放入IDA中進行分析，找到main函數。查看main函數：
int __cdecl main(int argc, const char **argv, const char **envp) {int v3; // esiint v5[3]; // [esp+8h] [ebp-74h] BYREF__int16 v6; // [esp+14h] [ebp-68h]char v7; // [esp+16h] [ebp-66h]char v8[100]; // [esp+18h] [ebp-64h] BYREFsub_403CF8(&unk_40E140);scanf("%s", v8);memset(v5, 0, sizeof(v5));v6 = 0;v7 = 0;sub_401080(v8, strlen(v8), v5);v3 = 0;while ( *(v5 + v3) == byte_40E0E4[v3] ){if ( ++v3 > strlen(v5) )goto LABEL_6;}sub_403CF8(aError); LABEL_6:if ( v3 - 1 == strlen(byte_40E0E4) )return sub_403CF8(aAreYouHappyYes);elsereturn sub_403CF8(aAreYouHappyNo); }可以猜測sub_403CF8是輸出函數，密文存放在byte_40E0E4中，查看sub_401080函數：
int __cdecl sub_401080(int a1, int a2, int a3) {int v3; // ediint v4; // esiint v5; // edxint v6; // eaxint v7; // ecxint v8; // esiint v9; // esiint v10; // esiint v11; // esi_BYTE *v12; // ecxint v13; // esiint v15; // [esp+18h] [ebp+8h]v3 = 0;v4 = 0;sub_401000();v5 = a2 % 3;v6 = a1;v7 = a2 - a2 % 3;v15 = a2 % 3;if ( v7 > 0 ){do{LOBYTE(v5) = *(a1 + v3);v3 += 3;v8 = v4 + 1;*(v8 + a3 - 1) = aAbcdefghijklmn[(v5 >> 2) & 0x3F];*(++v8 + a3 - 1) = aAbcdefghijklmn[16 * (*(a1 + v3 - 3) & 3) + ((*(a1 + v3 - 2) >> 4) & 0xF)];*(++v8 + a3 - 1) = aAbcdefghijklmn[4 * (*(a1 + v3 - 2) & 0xF) + ((*(a1 + v3 - 1) >> 6) & 3)];v5 = *(a1 + v3 - 1) & 0x3F;v4 = v8 + 1;*(v4 + a3 - 1) = aAbcdefghijklmn[v5];}while ( v3 < v7 );v5 = v15;}if ( v5 == 1 ){LOBYTE(v7) = *(v3 + a1);v9 = v4 + 1;*(v9 + a3 - 1) = aAbcdefghijklmn[(v7 >> 2) & 0x3F];v10 = v9 + 1;*(v10 + a3 - 1) = aAbcdefghijklmn[16 * (*(v3 + a1) & 3)];*(v10 + a3) = 61; LABEL_8:v13 = v10 + 1;*(v13 + a3) = 61;v4 = v13 + 1;goto LABEL_9;}if ( v5 == 2 ){v11 = v4 + 1;*(v11 + a3 - 1) = aAbcdefghijklmn[(*(v3 + a1) >> 2) & 0x3F];v12 = (v3 + a1 + 1);LOBYTE(v6) = *v12;v10 = v11 + 1;*(v10 + a3 - 1) = aAbcdefghijklmn[16 * (*(v3 + a1) & 3) + ((v6 >> 4) & 0xF)];*(v10 + a3) = aAbcdefghijklmn[4 * (*v12 & 0xF)];goto LABEL_8;} LABEL_9:*(v4 + a3) = 0;return sub_401030(a3); }將密文進行base64解密后，發現不是flag，猜測可能進行了換表。查看函數，發現在進行base64加密前，sub_401000函數對base64表進行了修改。
int sub_401000() {int result; // eaxchar v1; // clfor ( result = 6; result < 15; ++result ){v1 = aAbcdefghijklmn[result + 10];aAbcdefghijklmn[result + 10] = aAbcdefghijklmn[result];aAbcdefghijklmn[result] = v1;}return result; }通過動態調試來獲取修改后的base64表，進行解密發現仍然是錯誤的，繼續查看問題，發現在加密的末尾還有個sub_401030函數，查看函數發現是將密文的字母大小寫進行了互換。
int __cdecl sub_401030(const char *a1) {__int64 v1; // raxchar v2; // alv1 = 0i64;if ( strlen(a1) ){do{v2 = a1[HIDWORD(v1)];if ( v2 < 97 || v2 > 122 ){if ( v2 < 65 || v2 > 90 )goto LABEL_9;LOBYTE(v1) = v2 + 32;}else{LOBYTE(v1) = v2 - 32;}a1[HIDWORD(v1)] = v1; LABEL_9:LODWORD(v1) = 0;++HIDWORD(v1);}while ( HIDWORD(v1) < strlen(a1) );}return v1; }思路理清后，完善解密腳本，腳本如下：
import base64 def main():str1 = "zMXHz3TIgnxLxJhFAdtZn2fFk3lYCrtPC2l9"str1 = str1.swapcase()string1 = "ABCDEFQRSTUVWXYPGHIJKLMNOZabcdefghijklmnopqrstuvwxyz0123456789+/"string2 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"print (base64.b64decode(str1.translate(str.maketrans(string1,string2)))) if __name__ == '__main__':main()# b'flag{bAse64_h2s_a_Surprise}'FLAG：flag{bAse64_h2s_a_Surprise}
日期：2023.5.13
題目：[MRCTF2020]Xor
刷題平臺：BUUCTF
方向：REVERSE
Write UP：
獲取題目附件，32位，放入IDA中進行分析，找到main函數，但是無法將程序轉成偽代碼，因為程序很短，所以直接閱讀匯編。
先將一段字符串壓入棧中，再跳轉進一個函數，猜測sub_2E1020是一個輸出函數，而后面的sub_2E1050函數有一個"%s"參數，猜測是輸入函數。
這一段指令對計算了一下輸入的字符串長度，并與0x1b進行比較，這里可以知道輸入長度為0x1b，也就是27。?
"xor ? ? eax, eax"這里將eax寄存器清零，后面用al寄存器與cl進行異或，cl中存放的是輸入內容，因為eax作為下標，可以判斷是將輸入值與其對應下標進行異或。最后再與byte_2FEA08中存放的密文進行比較。
由此理清思路后，即可寫出解密腳本，腳本如下：?
cipher = "MSAWB~FXZ:J:`tQJ\"N@ bpdd}8g" for i in range(len(cipher)):print(chr(ord(cipher[i]) ^ i),end="")# MRCTF{@_R3@1ly_E2_R3verse!}FLAG：flag{@_R3@1ly_E2_R3verse!}
日期：2023.5.14
題目：Youngter-drive
刷題平臺：BUUCTF
方向：REVERSE
Write UP：
獲取題目附件，通過查殼工具發現存在UPX殼。
?對其進行脫殼后，放入IDA中進行分析，找到main函數。
int __cdecl main_0(int argc, const char **argv, const char **envp) {HANDLE Thread; // [esp+D0h] [ebp-14h]HANDLE hObject; // [esp+DCh] [ebp-8h]sub_3610FF();::hObject = CreateMutexW(0, 0, 0);j_strcpy(Destination, Source);hObject = CreateThread(0, 0, StartAddress, 0, 0, 0);Thread = CreateThread(0, 0, sub_36119F, 0, 0, 0);CloseHandle(hObject);CloseHandle(Thread);while ( dword_368008 != -1 );sub_361190();CloseHandle(::hObject);return 0; }可以看出程序創建了兩個線程來執行兩個函數，查看StartAddress函數和sub_36119F函數下的sub_361B10函數。
void __stdcall __noreturn StartAddress_0(int a1) {while ( 1 ){WaitForSingleObject(hObject, 0xFFFFFFFF);if ( dword_368008 > -1 ){sub_36112C(Source, dword_368008);--dword_368008;Sleep(0x64u);}ReleaseMutex(hObject);} } void __stdcall __noreturn sub_361B10(int a1) {while ( 1 ){WaitForSingleObject(hObject, 0xFFFFFFFF);if ( dword_368008 > -1 ){Sleep(0x64u);--dword_368008;}ReleaseMutex(hObject);} }先執行第一個線程，執行一次對輸入的字符串第一個元素進行操作后休眠，再執行第二個線程對下一個元素進行操作后休眠，實際就是將輸入的字符串下標為奇或偶時進行不同操作，于是可以寫出下面的解密腳本：
cipher = "TOiZiZtOrYaToUwPnToBsOaOapsyS" dist = "QWERTYUIOPASDFGHJKLZXCVBNMqwertyuiopasdfghjklzxcvbnm" flag = "" flag1 = [] for i in range(29):if i % 2 == 1:if ord(cipher[i]) >= ord('A') and ord(cipher[i]) <= ord('Z'):flag += chr(dist.index(cipher[i])+96)else:flag += chr(dist.index(cipher[i])+38)else:flag += cipher[i] print(flag)# ThisisthreadofwindowshahaIsES但是提交發現是錯誤的，而后看到其他師傅寫的wp才知道，實際加密的是30個字符，檢查時只檢查了29個字符。那最后一個字符需要去猜一下。
FLAG：flag{ThisisthreadofwindowshahaIsESE}
日期：2023.5.15
題目：[MRCTF2020]hello_world_go
刷題平臺：BUUCTF
方向：REVERSE
Write UP：
獲取題目附件，在IDA中打開，找到一個main_main函數，flag就在這里。
// main.main void __cdecl main_main() {__int64 v0; // rcx__int64 v1; // rax__int64 v2; // rax__int64 v3; // [rsp+20h] [rbp-90h]__int64 v4; // [rsp+58h] [rbp-58h]__int64 *v5; // [rsp+60h] [rbp-50h]__int64 v6[2]; // [rsp+68h] [rbp-48h] BYREF__int64 v7[2]; // [rsp+78h] [rbp-38h] BYREF__int64 v8[2]; // [rsp+88h] [rbp-28h] BYREF__int64 v9[2]; // [rsp+98h] [rbp-18h] BYREFv5 = runtime_newobject(&RTYPE_string);v9[0] = &RTYPE_string;v9[1] = &off_4EA530;fmt_Fprint(&go_itab__ptr_os_File_comma_io_Writer, os_Stdout, v9, 1LL, 1LL);v8[0] = &RTYPE__ptr_string;v8[1] = v5;fmt_Fscanf(&go_itab__ptr_os_File_comma_io_Reader, os_Stdin, "%s", 2LL, v8, 1LL, 1LL);v0 = v5[1];v1 = *v5;if ( v0 != 24 )goto LABEL_2;v4 = *v5;if ( !runtime_memequal("flag{hello_world_gogogo}", v1, 24LL) ){v1 = v4;v0 = 24LL; LABEL_2:runtime_cmpstring("flag{hello_world_gogogo}", 24LL, v1, v0, v3);if ( v3 >= 0 )v2 = 1LL;elsev2 = -1LL;goto LABEL_4;}v2 = 0LL; LABEL_4:if ( v2 ){v6[0] = &RTYPE_string;v6[1] = &off_4EA550;fmt_Fprintln(&go_itab__ptr_os_File_comma_io_Writer, os_Stdout, v6, 1LL, 1LL);}else{v7[0] = &RTYPE_string;v7[1] = &off_4EA540;fmt_Fprintln(&go_itab__ptr_os_File_comma_io_Writer, os_Stdout, v7, 1LL, 1LL);} }FLAG：flag{hello_world_gogogo}
日期：2023.5.17
題目：[FlareOn4]IgniteMe
刷題平臺：BUUCTF
方向：REVERSE
Write UP：
獲取題目附件，32位，無殼。
根據Description.txt可以知道flag的格式：
?
?在IDA中找到一個sub_401050函數，這里對輸入值進行了加密，并于密文進行了比較。
int sub_401050() {int v1; // [esp+0h] [ebp-Ch]int i; // [esp+4h] [ebp-8h]unsigned int j; // [esp+4h] [ebp-8h]char v4; // [esp+Bh] [ebp-1h]v1 = sub_401020(byte_403078);v4 = sub_401000();for ( i = v1 - 1; i >= 0; --i ){byte_403180[i] = v4 ^ byte_403078[i];v4 = byte_403078[i];}for ( j = 0; j < 39; ++j ){if ( byte_403180[j] != byte_403000[j] )return 0;}return 1; }在第一個for語句處下一個斷點，可以知道v4的值為4，接著就可以寫解密腳本：
cipher = [ 0x0D, 0x26, 0x49, 0x45, 0x2A, 0x17, 0x78, 0x44, 0x2B, 0x6C, 0x5D, 0x5E, 0x45, 0x12, 0x2F, 0x17, 0x2B, 0x44, 0x6F, 0x6E, 0x56, 0x09, 0x5F, 0x45, 0x47, 0x73, 0x26, 0x0A, 0x0D, 0x13, 0x17, 0x48, 0x42, 0x01, 0x40, 0x4D, 0x0C, 0x02, 0x69] key = 4 flag = "" for i in range(len(cipher)-1,-1,-1):cipher[i] = cipher[i] ^ keykey = cipher[i]for j in range(len(cipher)):print(chr(cipher[j]),end="")# R_y0u_H0t_3n0ugH_t0_1gn1t3@flare-on.comFLAG：flag{R_y0u_H0t_3n0ugH_t0_1gn1t3@flare-on.com}
日期：2023.5.18
題目：[GWCTF 2019]xxor
刷題平臺：BUUCTF
方向：REVERSE
Write UP：
獲取題目附件，64位，無殼。?
?在IDA中進行分析，查看main函數。
__int64 __fastcall main(int a1, char **input, char **a3) {int i; // [rsp+8h] [rbp-68h]int j; // [rsp+Ch] [rbp-64h]__int64 v6[6]; // [rsp+10h] [rbp-60h] BYREF__int64 v7[6]; // [rsp+40h] [rbp-30h] BYREFv7[5] = __readfsqword(0x28u);puts("Let us play a game?");puts("you have six chances to input");puts("Come on!");memset(v6, 0, 40);for ( i = 0; i <= 5; ++i ){printf("%s", "input: ");input = (v6 + 4 * i);__isoc99_scanf("%d", input);}memset(v7, 0, 40);for ( j = 0; j <= 2; ++j ){dword_601078 = v6[j];dword_60107C = HIDWORD(v6[j]);input = &unk_601060;sub_400686(&dword_601078, &unk_601060);LODWORD(v7[j]) = dword_601078;HIDWORD(v7[j]) = dword_60107C;}if ( sub_400770(v7, input) != 1 ){puts("NO NO NO~ ");exit(0);}puts("Congratulation!\n");puts("You seccess half\n");puts("Do not forget to change input to hex and combine~\n");puts("ByeBye");return 0LL; }先看最后進行判斷的函數sub_400770：
__int64 __fastcall sub_400770(_DWORD *x) {if ( x[2] - x[3] == 2225223423LL&& x[3] + x[4] == 0xFA6CB703LL&& x[2] - x[4] == 0x42D731A8LL&& *x == 0xDF48EF7E&& x[5] == 0x84F30420&& x[1] == 0x20CAACF4 ){puts("good!");return 1LL;}else{puts("Wrong!");return 0LL;} }可以知道數組x中存放的是加密的密文，于是先獲取到密文：
from z3 import * def main():x = [BitVec("x%d"%i,64)for i in range(6)]s = Solver()s.add( x[2] - x[3] == 0x84A236FF)s.add( x[3] + x[4] == 0xFA6CB703)s.add( x[2] - x[4] == 0x42D731A8)s.add( x[0] == 0xDF48EF7E)s.add( x[5] == 0x84F30420)s.add( x[1] == 0x20CAACF4)if s.check() == sat:v = s.model()for i in range(6):print(v[x[i]],end=" ")if __name__ == '__main__':main()# 3746099070 550153460 3774025685 1548802262 2652626477 2230518816接著查看sub_400686函數，可以明顯看出，是進行了tea算法加密：
__int64 __fastcall sub_400686(unsigned int *v, _DWORD *k) {__int64 result; // raxunsigned int v3; // [rsp+1Ch] [rbp-24h]unsigned int v4; // [rsp+20h] [rbp-20h]int sum1; // [rsp+24h] [rbp-1Ch]unsigned int i; // [rsp+28h] [rbp-18h]v3 = *v;v4 = v[1];sum1 = 0;for ( i = 0; i <= 63; ++i ){sum1 += 0x458BCD42;v3 += (v4 + sum1 + 11) ^ ((v4 << 6) + *k) ^ ((v4 >> 9) + k[1]) ^ 0x20;v4 += (v3 + sum1 + 20) ^ ((v3 << 6) + k[2]) ^ ((v3 >> 9) + k[3]) ^ 0x10;}*v = v3;result = v4;v[1] = v4;return result; }sub_400686傳了兩個參數，第一個是輸入的值，第二個是key，通過查看unk_601060即可知道key值。接著寫解密腳本即可，嘗試了一下用python來寫解密tea腳本：
import ctypes def main():v = [3746099070,550153460,3774025685,1548802262,2652626477,2230518816]k = [2,2,3,4]flag = ""for i in range(0,6,2):DELTA = 0x458BCD42sum1 = 64*DELTAv0 = ctypes.c_uint32(v[i])v1 = ctypes.c_uint32(v[i+1])for j in range(64):v1.value -= (v0.value + sum1 + 20) ^ ((v0.value << 6) + k[2]) ^ ((v0.value >> 9) + k[3]) ^ 0x10v0.value -= (v1.value + sum1 + 11) ^ ((v1.value << 6) + k[0]) ^ ((v1.value >> 9) + k[1]) ^ 0x20sum1 -= DELTAflag += hex(v0.value)[2:].zfill(6)flag += hex(v1.value)[2:].zfill(6) # 幫忙補零和去掉前綴"0x"for i in range(0,len(flag),2):print(chr(int(flag[i]+flag[i+1],16)),end="") if __name__ == '__main__':main()# flag{re_is_great!}FLAG：flag{re_is_great!}
題目：[WUSTCTF2020]Cr0ssfun
刷題平臺：BUUCTF
方向：REVERSE
Write UP：
獲取題目附件，64位，無殼。
查看其中的main函數。
int __cdecl main(int argc, const char **argv, const char **envp) {char v4[48]; // [rsp+0h] [rbp-30h] BYREFputs(" _ _ _ _ _____ _____ _____ ");puts("| | | | | | / ___|_ _| / ___| ");puts("| | | | | | \\ `--. | | \\ `--. ___ ___ ");puts("| |/\\| | | | |`--. \\ | | `--. \\/ _ \\/ __|");puts("\\ /\\ / |_| /\\__/ / | | /\\__/ / __/ (__ ");puts(" \\/ \\/ \\___/\\____/ \\_/ \\____/ \\___|\\___|");while ( 1 ){puts("Input the flag");__isoc99_scanf("%s", v4);if ( check(v4) == 1 )break;puts("0ops, your flag seems fake.");puts("==============================");rewind(_bss_start);}puts("Your flag is correct, go and submit it!");return 0; }?可以看出關鍵在check函數。check函數中對輸入值進行了判斷，按順序進行拼接就可以拿到flag。
_BOOL8 __fastcall iven_is_handsome(_BYTE *a1) {return a1[10] == 'p' && a1[13] == '@' && a1[3] == 'f' && a1[26] == 'r' && a1[20] == 'e' && iven_is_c0ol(a1); }但是，感覺這個可以試一試用angr，就嘗試寫了一個腳本來獲取flag，腳本如下：
import angr import sys def main(argv):file_path = argv[1]p = angr.Project(file_path,auto_load_libs=False)start_state = p.factory.entry_state()sm = p.factory.simgr(start_state)def is_good(state):res = state.posix.dumps(1)if b'Your flag is correct, go and submit it!' in res:return Trueelse:return Falsedef is_bad(state):res = state.posix.dumps(1)if b'0ops, your flag seems fake.' in res:return Trueelse:return Falsesm.explore(find = is_good,avoid = is_bad)if sm.found:found = sm.found[0]solution = found.posix.dumps(0)print(solution)else:print("NONE")if __name__ == '__main__':main(sys.argv)# wctf2020{cpp_@nd_r3verse_@re_fun}FLAG：flag{cpp_@nd_r3verse_@re_fun}
日期：2023.5.19
題目：[FlareOn6]Overlong
刷題平臺：BUUCTF
方向：REVERSE
Write UP：
獲取題目附件，32位，無殼。
在IDA中可以看到，程序只有三個函數。
int __stdcall start(int a1, int a2, int a3, int a4) {CHAR Text[128]; // [esp+0h] [ebp-84h] BYREFint v6; // [esp+80h] [ebp-4h]v6 = sub_401160(Text, &unk_402008, 28);Text[v6] = 0;MessageBoxA(0, Text, Caption, 0);return 0; } int __stdcall start(int a1, int a2, int a3, int a4) {CHAR Text[128]; // [esp+0h] [ebp-84h] BYREFint v6; // [esp+80h] [ebp-4h]v6 = sub_401160(Text, &unk_402008, 28);Text[v6] = 0;MessageBoxA(0, Text, Caption, 0);return 0; } int __cdecl sub_401000(_BYTE *a1, char *a2) {int v3; // [esp+0h] [ebp-8h]char v4; // [esp+4h] [ebp-4h]if ( (int)(unsigned __int8)*a2 >> 3 == 30 ){v4 = a2[3] & 0x3F | ((a2[2] & 0x3F) << 6);v3 = 4;}else if ( (int)(unsigned __int8)*a2 >> 4 == 14 ){v4 = a2[2] & 0x3F | ((a2[1] & 0x3F) << 6);v3 = 3;}else if ( (int)(unsigned __int8)*a2 >> 5 == 6 ){v4 = a2[1] & 0x3F | ((*a2 & 0x1F) << 6);v3 = 2;}else{v4 = *a2;v3 = 1;}*a1 = v4;return v3; }?通過分析程序可以知道，是將密文進行解密后，以彈窗的形式顯示出來。
但是根據程序可知，將28個字符以彈窗形式顯示，實際要解密出的內容并不止那么點。
?通過修改sub_401160傳的參數，也就是長度，從而可以得到flag。
?
下斷點，直接截取flag。
FLAG： flag{I_a_M_t_h_e_e_n_C_o_D_i_n_g@flare-on.com}
日期：2023.5.20
題目：[UTCTF2020]basic-re
刷題平臺：BUUCTF
方向：REVERSE
Write UP：
獲取題目附件，64位，無殼。?
用IDA進行分析，發現，flag就藏在main函數中。
?FLAG：flag{str1ngs_1s_y0ur_fr13nd}
題目：[FlareOn3]Challenge1
刷題平臺：BUUCTF
方向：REVERSE
Write UP：
獲取題目附件，32位，無殼。
?用IDA進行分析，可以在main函數中找到一串密文，并猜測sub_401260函數對輸入內容進行了加密。
int __cdecl main(int argc, const char **argv, const char **envp) {char Buffer[128]; // [esp+0h] [ebp-94h] BYREFchar *Str1; // [esp+80h] [ebp-14h]char *Str2; // [esp+84h] [ebp-10h]HANDLE StdHandle; // [esp+88h] [ebp-Ch]HANDLE hFile; // [esp+8Ch] [ebp-8h]DWORD NumberOfBytesWritten; // [esp+90h] [ebp-4h] BYREFhFile = GetStdHandle(0xFFFFFFF5);StdHandle = GetStdHandle(0xFFFFFFF6);Str2 = "x2dtJEOmyjacxDemx2eczT5cVS9fVUGvWTuZWjuexjRqy24rV29q";WriteFile(hFile, "Enter password:\r\n", 0x12u, &NumberOfBytesWritten, 0);ReadFile(StdHandle, Buffer, 0x80u, &NumberOfBytesWritten, 0);Str1 = sub_401260(Buffer, NumberOfBytesWritten - 2);if ( !strcmp(Str1, Str2) )WriteFile(hFile, "Correct!\r\n", 0xBu, &NumberOfBytesWritten, 0);elseWriteFile(hFile, "Wrong password\r\n", 0x11u, &NumberOfBytesWritten, 0);return 0; }查看sub_401260，可以看出sub_401260函數對輸入內容進行了base64加密。
_BYTE *__cdecl sub_401260(int a1, unsigned int a2) {int v3; // [esp+Ch] [ebp-24h]int v4; // [esp+10h] [ebp-20h]int v5; // [esp+14h] [ebp-1Ch]int i; // [esp+1Ch] [ebp-14h]unsigned int v7; // [esp+20h] [ebp-10h]_BYTE *v8; // [esp+24h] [ebp-Ch]int v9; // [esp+28h] [ebp-8h]int v10; // [esp+28h] [ebp-8h]unsigned int v11; // [esp+2Ch] [ebp-4h]v8 = malloc(4 * ((a2 + 2) / 3) + 1);if ( !v8 )return 0;v11 = 0;v9 = 0;while ( v11 < a2 ){v5 = *(v11 + a1);if ( ++v11 >= a2 ){v4 = 0;}else{v4 = *(v11 + a1);++v11;}if ( v11 >= a2 ){v3 = 0;}else{v3 = *(v11 + a1);++v11;}v7 = v3 + (v5 << 16) + (v4 << 8);v8[v9] = aZyxabcdefghijk[(v7 >> 18) & 0x3F];v10 = v9 + 1;v8[v10] = aZyxabcdefghijk[(v7 >> 12) & 0x3F];v8[++v10] = aZyxabcdefghijk[(v7 >> 6) & 0x3F];v8[++v10] = aZyxabcdefghijk[v3 & 0x3F];v9 = v10 + 1;}for ( i = 0; i < MEMORY[0x413040][a2 % 3]; ++i )v8[4 * ((a2 + 2) / 3) - i - 1] = 61;v8[4 * ((a2 + 2) / 3)] = 0;return v8; }查看base64表，可以看出是變表base64。
.data:00413000 5A 59 58 41 42 43 44 45 46 47+aZyxabcdefghijk db 'ZYXABCDEFGHIJKLMNOPQRSTUVWzyxabcdefghijklmnopqrstuvw0123456789+/',0由此可以寫解密腳本，腳本如下：
import base64 def main():str1 = "x2dtJEOmyjacxDemx2eczT5cVS9fVUGvWTuZWjuexjRqy24rV29q"string1 = "ZYXABCDEFGHIJKLMNOPQRSTUVWzyxabcdefghijklmnopqrstuvw0123456789+/"string2 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"print(base64.b64decode(str1.translate(str.maketrans(string1,string2)))) if __name__ == '__main__':main()# sh00ting_phish_in_a_barrel@flare-on.comFLAG：flag{sh00ting_phish_in_a_barrel@flare-on.com}
總結
- 上一篇： 零基础学彩铅——下午茶（含详细步骤）
- 下一篇： 【权威发布】360追日团队：Xshell