攻防世界tt3441810做法(清晰且简单)

上进的懒羊羊

已于 2024-03-27 21:14:17 修改

阅读量293

点赞数 14

分类专栏： ctf 文章标签： c#

于 2024-03-27 09:50:54 首次发布

本文链接：https://blog.csdn.net/2303_80796023/article/details/137065811

版权

ctf 专栏收录该内容

30 篇文章 0 订阅

订阅专栏

文章讲述了如何通过C语言的编程技巧，对未知代码进行查壳操作，不依赖于32位或64位判断，通过对数据转换和字符筛选找出隐藏的flag的过程。

摘要由CSDN通过智能技术生成

简单的就不说了，就一个查壳操作，结果发现既不是32bit也不是64bit，那就随便拖一个进去拖进去之后是这样的里面有一大堆数据，我们选中按A转换为字符串形式，仔细看看，里面有点flag的影子在,那就shift+e提取数据出来，然后放到vs中进行筛选，


#include<stdio.h>
int main() {
    int str[]= {
  104, 102, 108,   0,   0,  72, 191,   1,   0,   0,
    0,   0,   0,   0,   0,  72, 141,  52,  36,  72,
  186,   2,   0,   0,   0,   0,   0,   0,   0,  72,
  184,   1,   0,   0,   0,   0,   0,   0,   0,  15,
    5, 104,  97, 103,   0,   0,  72, 191,   1,   0,
    0,   0,   0,   0,   0,   0,  72, 141,  52,  36,
   72, 186,   2,   0,   0,   0,   0,   0,   0,   0,
   72, 184,   1,   0,   0,   0,   0,   0,   0,   0,
   15,   5, 104, 123, 112,   0,   0,  72, 191,   1,
    0,   0,   0,   0,   0,   0,   0,  72, 141,  52,
   36,  72, 186,   2,   0,   0,   0,   0,   0,   0,
    0,  72, 184,   1,   0,   0,   0,   0,   0,   0,
    0,  15,   5, 104, 111, 112,   0,   0,  72, 191,
    1,   0,   0,   0,   0,   0,   0,   0,  72, 141,
   52,  36,  72, 186,   2,   0,   0,   0,   0,   0,
    0,   0,  72, 184,   1,   0,   0,   0,   0,   0,
    0,   0,  15,   5, 104, 112, 111,   0,   0,  72,
  191,   1,   0,   0,   0,   0,   0,   0,   0,  72,
  141,  52,  36,  72, 186,   2,   0,   0,   0,   0,
    0,   0,   0,  72, 184,   1,   0,   0,   0,   0,
    0,   0,   0,  15,   5, 104, 112, 114,   0,   0,
   72, 191,   1,   0,   0,   0,   0,   0,   0,   0,
   72, 141,  52,  36,  72, 186,   2,   0,   0,   0,
    0,   0,   0,   0,  72, 184,   1,   0,   0,   0,
    0,   0,   0,   0,  15,   5, 104, 101, 116,   0,
    0,  72, 191,   1,   0,   0,   0,   0,   0,   0,
    0,  72, 141,  52,  36,  72, 186,   2,   0,   0,
    0,   0,   0,   0,   0,  72, 184,   1,   0,   0,
    0,   0,   0,   0,   0,  15,   5, 104, 125,  10,
    0,   0,  72, 191,   1,   0,   0,   0,   0,   0,
    0,   0,  72, 141,  52,  36,  72, 186,   2,   0,
    0,   0,   0,   0,   0,   0,  72, 184,   1,   0,
    0,   0,   0,   0,   0,   0,  15,   5,  72,  49,
  255,  72, 184,  60,   0,   0,   0,   0,   0,   0,
    0,  15,   5
    };
    for (int i = 0; i < sizeof(str) / sizeof(int);i++) {
        if (str[i] > 32 && str[i] < 128) {
            printf("%c", str[i]);
        }
    }
    return 0;
}

就这样先简单筛选一下看看出来什么东西，注意这边>32&&<128是为了输出字符形式的数据，作为第一次筛选，结果运行出来hflHH4$HHhagHH4$HHh{pHH4$HHhopHH4$HHhpoHH4$HHhprHH4$HHhetHH4$HHh}HH4$HHH1H<

发现有很多的h，H，$，那就筛选掉这些再看看，


#include<stdio.h>
int main() {
    int str[]= {
  104, 102, 108,   0,   0,  72, 191,   1,   0,   0,
    0,   0,   0,   0,   0,  72, 141,  52,  36,  72,
  186,   2,   0,   0,   0,   0,   0,   0,   0,  72,
  184,   1,   0,   0,   0,   0,   0,   0,   0,  15,
    5, 104,  97, 103,   0,   0,  72, 191,   1,   0,
    0,   0,   0,   0,   0,   0,  72, 141,  52,  36,
   72, 186,   2,   0,   0,   0,   0,   0,   0,   0,
   72, 184,   1,   0,   0,   0,   0,   0,   0,   0,
   15,   5, 104, 123, 112,   0,   0,  72, 191,   1,
    0,   0,   0,   0,   0,   0,   0,  72, 141,  52,
   36,  72, 186,   2,   0,   0,   0,   0,   0,   0,
    0,  72, 184,   1,   0,   0,   0,   0,   0,   0,
    0,  15,   5, 104, 111, 112,   0,   0,  72, 191,
    1,   0,   0,   0,   0,   0,   0,   0,  72, 141,
   52,  36,  72, 186,   2,   0,   0,   0,   0,   0,
    0,   0,  72, 184,   1,   0,   0,   0,   0,   0,
    0,   0,  15,   5, 104, 112, 111,   0,   0,  72,
  191,   1,   0,   0,   0,   0,   0,   0,   0,  72,
  141,  52,  36,  72, 186,   2,   0,   0,   0,   0,
    0,   0,   0,  72, 184,   1,   0,   0,   0,   0,
    0,   0,   0,  15,   5, 104, 112, 114,   0,   0,
   72, 191,   1,   0,   0,   0,   0,   0,   0,   0,
   72, 141,  52,  36,  72, 186,   2,   0,   0,   0,
    0,   0,   0,   0,  72, 184,   1,   0,   0,   0,
    0,   0,   0,   0,  15,   5, 104, 101, 116,   0,
    0,  72, 191,   1,   0,   0,   0,   0,   0,   0,
    0,  72, 141,  52,  36,  72, 186,   2,   0,   0,
    0,   0,   0,   0,   0,  72, 184,   1,   0,   0,
    0,   0,   0,   0,   0,  15,   5, 104, 125,  10,
    0,   0,  72, 191,   1,   0,   0,   0,   0,   0,
    0,   0,  72, 141,  52,  36,  72, 186,   2,   0,
    0,   0,   0,   0,   0,   0,  72, 184,   1,   0,
    0,   0,   0,   0,   0,   0,  15,   5,  72,  49,
  255,  72, 184,  60,   0,   0,   0,   0,   0,   0,
    0,  15,   5
    };
    for (int i = 0; i < sizeof(str) / sizeof(int);i++) {
        if (str[i] > 60 && str[i] < 128 && str[i] != 'h' && str[i] != 'H') {     //这边直接取60-128的，去掉特殊字符，只选大小写字母，并去除h，H
            printf("%c", str[i]);
        }
    }
    return 0;
}

然后运行一下flag就直接出来了

总结一下，这道题首先查不出是32，或者是64bit的，这边要敢于操作，直接随便拖一个进去，然后转字符串形式，发现有flag的影子，然后提取数据出去，再运用小算法进行筛选。问题不大，简简单单。