Wust2022RE题解

雨后初霁&

于 2023-01-08 15:05:22 发布

阅读量414

点赞数

分类专栏： CTF逆向 c语言文章标签： CTF

本文链接：https://blog.csdn.net/a257131460266666/article/details/128601463

版权

c语言同时被 2 个专栏收录

53 篇文章 5 订阅

订阅专栏

CTF逆向

19 篇文章 2 订阅

订阅专栏

Wust2022RE题解

比赛是真的凉，不多bb。已经不抱希望了。

love or not

有一天，你不小心把你对象惹生气了，你对象说，解开这个文件的正确密码就原谅你，为了挽救你的爱情，请努力攻克本题。

enc=[0x4F, 0x45, 0x48, 0x4E, 0x52, 0x4F, 0x48, 0x4C, 0x19, 0x4B, 0x1B, 0x1E, 0x4A, 0x1D, 0x1C, 0x18, 0x4A, 0x1E, 0x1B, 0x11, 0x11, 0x1F, 0x1E, 0x48, 0x1C, 0x1F, 0x1E, 0x4C, 0x11, 0x4A, 0x18, 0x4B, 0x4B, 0x1D, 0x4C, 0x1C, 0x1A, 0x54]
for j in range(100):
  s=''
  for i in range(len(enc)):
      s+=chr(enc[i]^j)
  if 'flag'in s:
        print(s)

nCount=1
nCount = 214013 * nCount + 2531011
nCount=(nCount >> 16)& 0x7FFF
enc=[0x4F, 0x45, 0x48, 0x4E, 0x52, 0x4F, 0x48, 0x4C, 0x19, 0x4B, 0x1B, 0x1E, 0x4A, 0x1D, 0x1C, 0x18, 0x4A, 0x1E, 0x1B, 0x11, 0x11, 0x1F, 0x1E, 0x48, 0x1C, 0x1F, 0x1E, 0x4C, 0x11, 0x4A, 0x18, 0x4B, 0x4B, 0x1D, 0x4C, 0x1C, 0x1A, 0x54]
for i in range(len(enc)):
    print(chr(enc[i]^nCount),end='')
    #flag{fae0b27c451c728867a567e8c1bb4e53}

弱口令

20年前某软件喜欢用的一种密码，现在你还能帮我找出来吗？

注意提交用户名+密码的md5值

MD5在线加密 (hwcha.com)

定位到关键判断

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-5abHXnrm-1673161232172)(/upload/2023/01/image.png)][外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-P7kxLIyz-1673161232173)(C:\Users\Administrator\AppData\Roaming\Typora\typora-user-images\image-20221124202521552.png)]

先求解约束方程

from z3 import *
s=Solver()
szname=[BitVec(f'{i}',8) for i in range(5)]
for i in szname:
  s.add(i>0)
s.add(szname[0]+szname[1]*3+szname[2]*3+szname[3]*4+szname[4]*2==1364)
s.add(szname[0]*2+szname[1]*4+szname[2]*4+szname[3]*5+szname[4]*2==1775)
s.add(szname[0]*5+szname[1]*3+szname[2]*3+szname[3]*1+szname[4]*2==1437)
s.add(szname[0]*7+szname[1]*2+szname[2]*6+szname[3]*4+szname[4]*10==3053)
s.add(szname[0]*9+szname[1]*5+szname[2]*3+szname[3]*6+szname[4]*2==2550)
print(s.check())
if s.check()==sat:
   m=s.model()
   szname=[BitVec(f'{i}',8) for i in range(5)] 
   for i in szname:
     print(m[i].as_long(),end=' ')
s=[97 ,100, 109 ,105 ,110 ]
print(bytes(s))
#admin

再求

v3=[0]*6
v3[0] = 561
v3[1] = 560
v3[2] = 567
v3[3] = 566
v3[4] = 565
v3[5] = 564
password=[0]*6
for i in range(6):
    (password[i])=(v3[i]^11)-521
print(bytes(password))
#123456

flag=md5{admin123456}={a66abb5684c45962d887564f08346e8d}

Ezpy

反编译源码

a = input('请输入flag：')
enc = [35, 26, 20, 16, 12, 19, 50, 20, 23, 29, 27, 15, 59, 1, 56, 13, 28, 56, 51, 10, 19, 59, 78, 70, 117, 18]
key1 = 'Togdog'
if len(a) != 26:
    print('错误的长度')
else:
    key = [ord(i) for i in key1]
    input1 = [ord(i) for i in a]
    for i in range(len(input1)):
        if input1[i] ^ key[(i % 6)] != enc[i]:
            print('错误')
            exit(1)

    print('flag is you input')

enc = [35, 26, 20, 16, 12, 19, 50, 20, 23, 29, 27, 15, 59, 1, 56, 13, 28, 56, 51, 10, 19, 59, 78, 70, 117, 18]
key1='Togdog'
key = [ord(i) for i in key1]
flag=''
for i in range(len(enc)):
  flag+=chr(enc[i]^ key[(i % 6)])
print(flag)
#wustctf{python_is_get_!!!}

好茶

好茶，真是好茶

TLS回调函数

key=[0x2160BC01, 0xB5077292, 0xE7529F0A, 0x4CC17426]
del1=0x61DABFC0
key[0] ^= 0x123456;
key[2] ^= 0x654321;
del1 ^= 0x123987;
print(key)
print(hex(del1))

#include<stdio.h>
#include<string.h>
#include <stdlib.h>
#include"IDA_use.h"
unsigned int del = 0x61c88647;
_DWORD a2[] = { 561154135, 3037164178, 3879197739, 1287746598 };
void __cdecl sub_411B90(unsigned int* a1, _DWORD* a2, int a3)
{
    int sum; // [esp+D0h] [ebp-68h]
    int j; // [esp+DCh] [ebp-5Ch]
    unsigned int v5; // [esp+118h] [ebp-20h]
    unsigned int v6; // [esp+124h] [ebp-14h]
    int i; // [esp+130h] [ebp-8h]

  
    for (i = 0; i < a3; i += 2)
    {
        v6 = a1[i];
        v5 = a1[i + 1];
        sum = del*32;
        for (j = 0; j < 32; ++j)
        {  
            v5 -= (a2[3] + (v6 >> 5)) ^ (sum + v6) ^ (a2[2] + 16 * v6);
            v6 -= (a2[1] + (v5 >> 5)) ^ (sum + v5) ^ (*a2 + 16 * v5);
            sum -=del;
            
            
        }
        a1[i] = v6;
        a1[i + 1] = v5;
    }
}

int main()
{
    char enc[33]={0};
    enc[0] = 0x29;
    enc[1] = 0x16;
    enc[2] = 0;
    enc[3] = 0x55;
    enc[4] = 0x3B;
    enc[5] = 0xF4;
    enc[6] = 0x76;
    enc[7] = 0x5C;
    enc[8] = 2;
    enc[9] = 0xB9;
    enc[10] = 0x89;
    enc[11] = 0xB7;
    enc[12] = 48;
    enc[13] = 45;
    enc[14] = 0x99;
    enc[15] = 0x9D;
    enc[16] = 30;
    enc[17] = 0xB6;
    enc[18] = 2;
    enc[19] = 0xFA;
    enc[20] = 29;
    enc[21] = 0xA1;
    enc[22] = 0xF3;
    enc[23] = 14;
    enc[24] = 57;
    enc[25] = 0xA1;
    enc[26] = 0x92;
    enc[27] = 0xF8;
    enc[28] = 0xE8;
    enc[29] = 0x83;
    enc[30] = 95;
    enc[31] = 0xF7;

    sub_411B90((unsigned int*)enc, a2, 32 >> 2);
    printf("%s", enc);
    return 0;
}

Snake

upx手脱壳

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-qh9UN1uD-1673161232174)(/upload/2023/01/image-1672756852850.png)][外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-R44iyiUp-1673161232175)(C:\Users\Administrator\AppData\Roaming\Typora\typora-user-images\image-20221126162953465.png)]

od跳转就是oep

直接dump下来脱壳

找到flag存放的地方

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-em9Il0xC-1673161232176)(/upload/2023/01/image-1672756869487.png)][外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-O6lBqbYg-1673161232176)(C:\Users\Administrator\AppData\Roaming\Typora\typora-user-images\image-20221126163055422.png)]

可以自己copy下来弄，也可以修改判断逻辑

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-fSLzrf3u-1673161232177)(/upload/2023/01/image-1672756880952.png)][外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-tgc8vYJL-1673161232178)(C:\Users\Administrator\AppData\Roaming\Typora\typora-user-images\image-20221126163131982.png)]

v2=[0]*38
v2[0] = 102;
v2[1] = 109;
v2[2] = 99;
v2[3] = 100;
v2[4] = 127;
v2[5] = 102;
v2[6] = 99;
v2[7] = 100;
v2[8] = 61;
v2[9] = 62;
v2[10] = 61;
v2[11] = 104;
v2[12] = 61;
v2[13] = 58;
v2[14] = 61;
v2[15] = 106;
v2[16] = 36;
v2[17] = 116;
v2[18] = 113;
v2[19] = 118;
v2[20] = 114;
v2[21] = 112;
v2[22] = 117;
v2[23] = 115;
v2[24] = 45;
v2[25] = 120;
v2[26] = 121;
v2[27] = 45;
v2[28] = 40;
v2[29] = 120;
v2[30] = 120;
v2[31] = 47;
v2[32] = 70;
v2[33] = 17;
v2[34] = 17;
v2[35] = 69;
v2[36] = 69;
v2[37] = 88;
for i in range(len(v2)):
    v2[i]^=i
print(bytes(v2))#flag{cec577c173e4ecefecd5ac64ef0f03fa}

EZVM

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-seeYm9Wv-1673161232178)(C:\Users\Administrator\AppData\Roaming\Typora\typora-user-images\image-20221127183955867.png)]

主要是发现

a1中存了数组，又存了地址，推断a1应该是个结构体

发现存进去的值只是被异或了

不难看出

a前4个为一组存Input数组

4~104为一组数组

105为一组记录长度

106为一组，单个指针

恢复成结构体后，直接做，下断点直接记录
减1异或断点值就行