Reverse re4-unvm-me

1.反编译pyc文件

• 这里发现一个更好用的反编译pyc的工具
• Easy Python Decompiler
  点击下载
• 下载速度慢的话可以试试迅雷 或者科学上网
• 反编译:

# Embedded file name: unvm_me.py
import md5
md5s = [174282896860968005525213562254350376167L,
 137092044126081477479435678296496849608L,
 126300127609096051658061491018211963916L,
 314989972419727999226545215739316729360L,
 256525866025901597224592941642385934114L,
 115141138810151571209618282728408211053L,
 8705973470942652577929336993839061582L,
 256697681645515528548061291580728800189L,
 39818552652170274340851144295913091599L,
 65313561977812018046200997898904313350L,
 230909080238053318105407334248228870753L,
 196125799557195268866757688147870815374L,
 74874145132345503095307276614727915885L]
print 'Can you turn me back to python ? ...'
flag = raw_input('well as you wish.. what is the flag: ')
if len(flag) > 69:
    print 'nice try'
    exit()
if len(flag) % 5 != 0:
    print 'nice try'
    exit()
for i in range(0, len(flag), 5):
    s = flag[i:i + 5]
    if int('0x' + md5.new(s).hexdigest(), 16) != md5s[i / 5]:
        print 'nice try'
        exit()

print 'Congratz now you have the flag'

2.分析

• 程序比较简单，用户输入一个字符串flag，每次从flag中取5个字符赋值给s，并计算s的md5的摘要，然后在前面加个0x ，转成16进制的值，再与数组md5s中的每个值进行比较。如果都相等，则输出正确的消息。

• 写个python脚本，把每5个字符对应的md5摘要值计算出来：

md5s = [174282896860968005525213562254350376167, 137092044126081477479435678296496849608, 126300127609096051658061491018211963916, 314989972419727999226545215739316729360, 256525866025901597224592941642385934114, 115141138810151571209618282728408211053, 8705973470942652577929336993839061582, 256697681645515528548061291580728800189, 39818552652170274340851144295913091599, 65313561977812018046200997898904313350, 230909080238053318105407334248228870753, 196125799557195268866757688147870815374, 74874145132345503095307276614727915885]
raw_md5s = []
for each in md5s:
    hex_val = hex(each)
    raw_md5s.append(hex_val[2:])
    
print(raw_md5s)

[‘831daa3c843ba8b087c895f0ed305ce7’, ‘6722f7a07246c6af20662b855846c2c8’, ‘5f04850fec81a27ab5fc98befa4eb40c’, ‘ecf8dcac7503e63a6a3667c5fb94f610’, ‘c0fd15ae2c3931bc1e140523ae934722’, ‘569f606fd6da5d612f10cfb95c0bde6d’, ‘68cb5a1cf54c078bf0e7e89584c1a4e’, ‘c11e2cd82d1f9fbd7e4d6ee9581ff3bd’, ‘1df4c637d625313720f45706a48ff20f’, ‘3122ef3a001aaecdb8dd9d843c029e06’, ‘adb778a0f729293e7e0b19b96a4c5a61’, ‘938c747c6a051b3e163eb802a325148e’, ‘38543c5e820dd9403b57beff6020596d’]

• 将这些值放到网站上查询一下

md5                              	原始值
831daa3c843ba8b087c895f0ed305ce7	ALEXC
6722f7a07246c6af20662b855846c2c8	TF{dv
5f04850fec81a27ab5fc98befa4eb40c	5d4s2
ecf8dcac7503e63a6a3667c5fb94f610	vj8nk
c0fd15ae2c3931bc1e140523ae934722	43s8d
569f606fd6da5d612f10cfb95c0bde6d	8l6m1
068cb5a1cf54c078bf0e7e89584c1a4e	n5l67
c11e2cd82d1f9fbd7e4d6ee9581ff3bd	ds9v4
1df4c637d625313720f45706a48ff20f	1n52n
3122ef3a001aaecdb8dd9d843c029e06	v37j4
adb778a0f729293e7e0b19b96a4c5a61	81h3d
938c747c6a051b3e163eb802a325148e	28n4b
38543c5e820dd9403b57beff6020596d	6v3k}

3.拼接flag

ALEXCTF{dv5d4s2vj8nk43s8d8l6m1n5l67ds9v41n52nv37j481h3d28n4b6v3k}