试探(错误示范———可以直接跳过):直接点击Get flag!得到
Wrong!
1B2M2Y8AsgTpgAmY7PhCfg
把“1B2M2Y8AsgTpgAmY7PhCfg”用MD5跟Base64编码解码,结果最终得到的是一个空值,然后输入不同的数据得出的结果都不一样,由此可以判断它需要我们去找一个关键词,因此联想到第二个js.文件
MD5 后 然后BASE64 的密码~~~
‘1B2M2Y8AsgTpgAmY7PhCfg==’ 这个密文表示 Null 就是什么也没有的意思# = =
解题步骤详解:
一、分析页面和JavaScript函数
- 打开页面并查看HTML源代码,发现有一个提示:“I have the Flag Type in something to get the flag. Tips: Maybe you have the flag. Something:”。
- 打开JavaScript文件并查看其中的函数。
-
function hm(s) { return rh(rstr(str2rstr_utf8(s))); } function bm(s) { return rb(rstr(str2rstr_utf8(s))); } function rstr(s) { return binl2rstr(binl(rstr2binl(s), s.length * 8)); } function checkToken(s) { return s === "FAKE-TOKEN"; } function rh(ip) { try { hc } catch (e) { hc = 0; } var ht = hc ? "0123456789ABCDEF" : "0123456789abcdef"; var op = ""; var x; for (var i = 0; i < ip.length; i++) { x = ip.charCodeAt(i); op += ht.charAt((x >>> 4) & 0x0F) + ht.charAt(x & 0x0F); } return op; } function rb(ip) { try { bp } catch (e) { bp = ''; } var b = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; var op = ""; var len = ip.length; for (var i = 0; i < len; i += 3) { var t = (ip.charCodeAt(i) << 16) | (i + 1 < len ? ip.charCodeAt(i + 1) << 8 : 0) | (i + 2 < len ? ip.charCodeAt(i + 2) : 0); for (var j = 0; j < 4; j++) { if (i * 8 + j * 6 > ip.length * 8) op += bp; else op += b.charAt((t >>> 6 * (3 - j)) & 0x3F); } } return op; } function ck(s) { try { ic } catch (e) { return; } var a = [118, 108, 112, 115, 111, 104, 104, 103, 120, 52, 53, 54]; if (s.length == a.length) { for (i = 0; i < s.length; i++) { if (a[i] - s.charCodeAt(i) != 3) return ic = false; } return ic = true; } return ic = false; } function str2rstr_utf8(input) { var output = ""; var i = -1; var x, y; while (++i < input.length) { x = input.charCodeAt(i); y = i + 1 < input.length ? input.charCodeAt(i + 1) : 0; if (0xD800 <= x && x <= 0xDBFF && 0xDC00 <= y && y <= 0xDFFF) { x = 0x10000 + ((x & 0x03FF) << 10) + (y & 0x03FF); i++; } if (x <= 0x7F) output += String.fromCharCode(x); else if (x <= 0x7FF) output += String.fromCharCode(0xC0 | ((x >>> 6) & 0x1F), 0x80 | (x & 0x3F)); else if (x <= 0xFFFF) output += String.fromCharCode(0xE0 | ((x >>> 12) & 0x0F), 0x80 | ((x >>> 6) & 0x3F), 0x80 | (x & 0x3F)); else if (x <= 0x1FFFFF) output += String.fromCharCode(0xF0 | ((x >>> 18) & 0x07), 0x80 | ((x >>> 12) & 0x3F), 0x80 | ((x >>> 6) & 0x3F), 0x80 | (x & 0x3F)); } return output; } function rstr2binl(input) { var output = Array(input.length >> 2); for (var i = 0; i < output.length; i++) output[i] = 0; for (var i = 0; i < input.length * 8; i += 8) output[i >> 5] |= (input.charCodeAt(i / 8) & 0xFF) << (i % 32); return output; } function binl2rstr(i) { var o = ""; for (var j = 0; j < i.length * 32; j += 8) o += String.fromCharCode((i[j >> 5] >>> (j % 32)) & 0xFF); return o; } function binl(x, len) { s = binl2rstr(x); x[len >> 5] |= 0x80 << ((len) % 32); x[(((len + 64) >>> 9) << 4) + 14] = len; var a = 1732584193; var b = -271733879; var c = -1732584194; var d = 271733878; for (var i = 0; i < x.length; i += 16) { var olda = a; var oldb = b; var oldc = c; var oldd = d; a = ff(a, b, c, d, x[i + 0], 7, -680876936); d = ff(d, a, b, c, x[i + 1], 12, -389564586); c = ff(c, d, a, b, x[i + 2], 17, 606105819); b = ff(b, c, d, a, x[i + 3], 22, -1044525330); a = ff(a, b, c, d, x[i + 4], 7, -176418897); d = ff(d, a, b, c, x[i + 5], 12, 1200080426); c = ff(c, d, a, b, x[i + 6], 17, -1473231341); b = ff(b, c, d, a, x[i + 7], 22, -45705983); a = ff(a, b, c, d, x[i + 8], 7, 1770035416); d = ff(d, a, b, c, x[i + 9], 12, -1958414417); c = ff(c, d, a, b, x[i + 10], 17, -42063); b = ff(b, c, d, a, x[i + 11], 22, -1990404162); a = ff(a, b, c, d, x[i + 12], 7, 1804603682); d = ff(d, a, b, c, x[i + 13], 12, -40341101); c = ff(c, d, a, b, x[i + 14], 17, -1502002290); b = ff(b, c, d, a, x[i + 15], 22, 1236535329); ck(s); a = gg(a, b, c, d, x[i + 1], 5, -165796510); d = gg(d, a, b, c, x[i + 6], 9, -1069501632); c = gg(c, d, a, b, x[i + 11], 14, 643717713); b = gg(b, c, d, a, x[i + 0], 20, -373897302); a = gg(a, b, c, d, x[i + 5], 5, -701558691); d = gg(d, a, b, c, x[i + 10], 9, 38016083); c = gg(c, d, a, b, x[i + 15], 14, -660478335); b = gg(b, c, d, a, x[i + 4], 20, -405537848); a = gg(a, b, c, d, x[i + 9], 5, 568446438); d = gg(d, a, b, c, x[i + 14], 9, -1019803690); c = gg(c, d, a, b, x[i + 3], 14, -187363961); b = gg(b, c, d, a, x[i + 8], 20, 1163531501); a = gg(a, b, c, d, x[i + 13], 5, -1444681467); d = gg(d, a, b, c, x[i + 2], 9, -51403784); c = gg(c, d, a, b, x[i + 7], 14, 1735328473); b = gg(b, c, d, a, x[i + 12], 20, -1926607734); a = hh(a, b, c, d, x[i + 5], 4, -378558); d = hh(d, a, b, c, x[i + 8], 11, -2022574463); c = hh(c, d, a, b, x[i + 11], 16, 1839030562); b = hh(b, c, d, a, x[i + 14], 23, -35309556); a = hh(a, b, c, d, x[i + 1], 4, -1530992060); d = hh(d, a, b, c, x[i + 4], 11, 1272893353); c = hh(c, d, a, b, x[i + 7], 16, -155497632); b = hh(b, c, d, a, x[i + 10], 23, -1094730640); a = hh(a, b, c, d, x[i + 13], 4, 681279174); d = hh(d, a, b, c, x[i + 0], 11, -358537222); c = hh(c, d, a, b, x[i + 3], 16, -722521979); b = hh(b, c, d, a, x[i + 6], 23, 76029189); a = hh(a, b, c, d, x[i + 9], 4, -640364487); d = hh(d, a, b, c, x[i + 12], 11, -421815835); c = hh(c, d, a, b, x[i + 15], 16, 530742520); b = hh(b, c, d, a, x[i + 2], 23, -995338651); a = ii(a, b, c, d, x[i + 0], 6, -198630844); d = ii(d, a, b, c, x[i + 7], 10, 1126891415); c = ii(c, d, a, b, x[i + 14], 15, -1416354905); b = ii(b, c, d, a, x[i + 5], 21, -57434055); a = ii(a, b, c, d, x[i + 12], 6, 1700485571); d = ii(d, a, b, c, x[i + 3], 10, -1894986606); c = ii(c, d, a, b, x[i + 10], 15, -1051523); b = ii(b, c, d, a, x[i + 1], 21, -2054922799); a = ii(a, b, c, d, x[i + 8], 6, 1873313359); d = ii(d, a, b, c, x[i + 15], 10, -30611744); c = ii(c, d, a, b, x[i + 6], 15, -1560198380); b = ii(b, c, d, a, x[i + 13], 21, 1309151649); a = ii(a, b, c, d, x[i + 4], 6, -145523070); d = ii(d, a, b, c, x[i + 11], 10, -1120210379); c = ii(c, d, a, b, x[i + 2], 15, 718787259); b = ii(b, c, d, a, x[i + 9], 21, -343485551); a = sa(a, olda); b = sa(b, oldb); c = sa(c, oldc); d = sa(d, oldd); } return Array(a, b, c, d); } function cmn(q, a, b, x, s, t) { return sa(br(sa(sa(a, q), sa(x, t)), s), b); } function ff(a, b, c, d, x, s, t) { return cmn((b & c) | ((~b) & d), a, b, x, s, t); } function gg(a, b, c, d, x, s, t) { return cmn((b & d) | (c & (~d)), a, b, x, s, t); } function hh(a, b, c, d, x, s, t) { return cmn(b ^ c ^ d, a, b, x, s, t); } function ii(a, b, c, d, x, s, t) { return cmn(c ^ (b | (~d)), a, b, x, s, t); } function sa(x, y) { var lsw = (x & 0xFFFF) + (y & 0xFFFF); var msw = (x >> 16) + (y >> 16) + (lsw >> 16); return (msw << 16) | (lsw & 0xFFFF); } function br(n, c) { return (n << c) | (n >>> (32 - c)); }
3.发现只有一个函数ck(s)是有用的。
二、分析ck(s)函数
- 函数ck(s)接受一个字符串s作为参数。
- 函数内部有一个数组a,存储了一组ASCII值。
- 函数通过比较输入字符串s的字符编码与数组a中的ASCII值来检查条件。
原题 ascii-3解码:
def shuchu():
a = [115, 105, 109, 112, 108, 101, 101, 100, 117, 49, 50, 51]
i = 0
while (i < len(a)):
print(chr(a[i]), end='')
i = i + 1
shuchu()
- 如果输入字符串s的长度与数组a的长度相等,并且每个字符的编码与数组a中对应位置的ASCII值之差为3,则函数返回true,否则返回false。
-
function ck(s) { try { ic } catch (e) { return; } var a = [118, 108, 112, 115, 111, 104, 104, 103, 120, 52, 53, 54]; if (s.length == a.length) { for (i = 0; i < s.length; i++) { if (a[i] - s.charCodeAt(i) != 3) return ic = false; } return ic = true; } return ic = false; }
三、寻找目标字符串
- 根据函数ck(s)的逻辑,我们需要找到一个字符串,其字符编码与数组a中的ASCII值相对应,并且每个字符的编码之差为3。
- 通过观察数组a中的ASCII值,我们可以推测出目标字符串的大致范围。数组a中的ASCII值主要集中在小写字母和数字的范围内,因此我们可以猜测目标字符串可能是一个由小写字母和数字组成的字符串。
- 我们可以使用循环遍历所有可能的字符串组合,然后调用函数ck(s)来检查每个字符串是否满足条件。由于目标字符串的长度与数组a的长度相等,我们可以确定循环的次数。
- 经过尝试和验证,我们发现字符串"simpleedu123"满足条件,调用函数ck("simpleedu123")返回true。
四、提交目标字符串并获取flag
- 在页面的输入框中输入"simpleedu123",然后点击提交或回车。
- 页面显示“Congratulations!!”,表示我们成功找到了目标字符串。
- 最终得到flag:flag{muWn9NU0H6erBN/w+C7HVg}。