[FlareOn3]Challenge1

查看文件和脱壳

使用exeinfo查看另一个文件。无壳，32位文件。

进入程序

放入IDA64中查看，shift+F12查看字符串。

进入函数中查看

关键在于sub_401260和sub_402C30函数
进入sub_402C30函数查看

简单来说就是比较V2和V3的内容，内容都一样的时候，就是correct

进入sub_401260函数

查看byte_413000数组，这其实就是base64字符表

觉得不太明显，就转换字符进行输出

byte_413000= [
0x5A,0x59,0x58,0x41,0x42,0x43,0x44,0x45,0x46,0x47,0x48,
0x49,0x4A,0x4B,0x4C,0x4D,0x4E,0x4F,0x50,0x51,0x52,0x53,
0x54,0x55,0x56,0x57,0x7A,0x79,0x78,0x61,0x62,0x63,0x64,
0x65,0x66,0x67,0x68,0x69,0x6A,0x6B,0x6C,0x6D,0x6E,0x6F,
0x70,0x71,0x72,0x73,0x74,0x75,0x76,0x77,0x30,0x31,0x32,
0x33,0x34,0x35,0x36,0x37,0x38,0x39,0x2B,0x2F]
s = ""

for i in byte_413000:
    s+=chr(i)
    print(chr(i),end='')

得到字符串，很明显就base64的变表加密
ZYXABCDEFGHIJKLMNOPQRSTUVWzyxabcdefghijklmnopqrstuvw0123456789+/
那么就很简单了

脚本

base64 ="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
base64 = list(base64)
t = "x2dtJEOmyjacxDemx2eczT5cVS9fVUGvWTuZWjuexjRqy24rV29q"
byte_413000= [
0x5A,0x59,0x58,0x41,0x42,0x43,0x44,0x45,0x46,0x47,0x48,
0x49,0x4A,0x4B,0x4C,0x4D,0x4E,0x4F,0x50,0x51,0x52,0x53,
0x54,0x55,0x56,0x57,0x7A,0x79,0x78,0x61,0x62,0x63,0x64,
0x65,0x66,0x67,0x68,0x69,0x6A,0x6B,0x6C,0x6D,0x6E,0x6F,
0x70,0x71,0x72,0x73,0x74,0x75,0x76,0x77,0x30,0x31,0x32,
0x33,0x34,0x35,0x36,0x37,0x38,0x39,0x2B,0x2F]
s = ""
for i in byte_413000:
    s+=chr(i)
for i in range(len(t)):
  print(base64[s.find(t[i])],end='')

得到字符串c2gwMHRpbmdfcGhpc2hfaW5fYV9iYXJyZWxAZmxhcmUtb24uY29t，
进行base64解码，得到flag{sh00ting_phish_in_a_barrel@flare-on.com}
成功