NSSCTF [LitCTF 2023]ez_XOR

咱先进入主函数 然后f5反编译,可以看出是xor异或 追踪xor函数

可以看出这是一个xor对str1进行异或 参数是3

咱直接进行脚本解密

def xor_string(s, key):
    return ''.join(chr(ord(c) ^ (3 * key)) for c in s)

def main():
    str2 = "E`}J]OrQF[V8zV:hzpV}fVF[t"
    decrypted_flag = xor_string(str2, 3)
    print(f"Decrypted FLAG: {decrypted_flag}")

if __name__ == "__main__":
    main()

#!/usr/bin/env python # visit https://tool.lu/pyc/ for more information # Version: Python 3.8 import base64 import marshal import sympy as sp encoded_data = b'#VVVVVVVVVVVVVVVVVVVVVSVVVVFVVVV_YZVVVVMVU|VNFV@pU|V{xUMVYvVzBSMVDSVFRVMFDSV\\VQMV@%7fVAxPMFU{V@BPp]vU%B_MF]eVy]VMFY|UxZUVFUbTPBSMVrSVFRVMV%7fCVT|]N^VVVVVVVVVVVVVVVpVVVVPVVVVFVVV_GFVVVVsVU'V@FUpPSVO\'TMV].V$FUMVPSVBFVOC".U_SqV]/UU|VQU/V_RsV]/V^ZUQpVMVUtVMVR@V_'SqV]/Vo|VqV]/UU|VVpU/VyRGVU/VySGVUoPPFTUVU.U_'SsVXSV_'QqVQRVQ&pqFM/UPFSQU|VENVqFE/V$TqVFMVUtVMVR@V_'SqV]/Vo|VqV]/UU|VVpU/VyRGVU/VySGVU/VyTqVFMV_TqVZMVUtVMVR@VU|VqFs/UvVRqVM/U'RVxFRUV_QfqVACVT|RCb|VVFVV!FVVVVSgVFVVVT|Q%pEdvOY'%pAnN@"yMsxSuPAb%p{~rOE{NO]nNOyvUzQtPAbMT|^%pYeMO{vTOUdN@{bsPA#sYxUB.xUvcxUvAx\\N%{vPAnsPA#sYxRN%%7f%7ftcxUv!|Vtp/VVVS!UzM&u~"rsx[tzZ\'O%AbN$]"t_FUVVVVtoVVVVVVFUUV^ZVDVU_V^^VFNTTVRZVEVUPpRNVEVTt%7fRVVVUmTVVVPA#N@&uPAqv%A"tnxVVVSN{U!ez%M\'!&&VP ez!UZmA.\'X"g^\'/NUcvXd.TPRTTD!&UB\\dT.R}Q{!QQUdr~UguyU&sTU"u$An^PMdN@t!rpA&sPNcXQxSr@Am@p]bu'#gT_^EVVVVtp|VVVUvU@YxM@Ye%pAtz{bsYxQv@"sOCvUzAbN%.|MsxRMzo%7fM&x]M@"}ty{sPA|tp/VVVUnSVVV_^GVVVVt%7fVVVVSvTSocu%E&uPB<VFVVV_ZFVVVVTUFRVFFTTVRZVpxTTVR\Vp**' xor_key = int(input('Plz input key (0<key<100):')) x = sp.symbols('x') f = x ** 2 + x + 1 integral_value = sp.integrate(f, (x, 1, xor_key)) check_value = 13024 if integral_value * 3 == check_value: xor_decoded_data = bytes((lambda .0: [ byte ^ xor_key for byte in .0 ])(encoded_data)) decoded_data = base64.b64decode(xor_decoded_data) code_obj = marshal.loads(decoded_data) exec(code_obj) else: print('Wrong!!') 解出code_obj
05-25
该代码通过异或解密和base64解码得到一个Python代码对象,然后使用marshal模块的loads函数将其转换为可执行的代码对象。最后通过exec函数执行该代码对象。 根据给定的密钥,我们可以使用Sympy库计算出一个积分值,并将其与给定的检查值进行比较,如果相等,则可以进行解密操作。以下是解密代码: ``` import base64 import marshal encoded_data = b'#VVVVVVVVVVVVVVVVVVVVVSVVVVFVVVV_YZVVVVMVU|VNFV@pU|V{xUMVYvVzBSMVDSVFRVMFDSV\\VQMV@%7fVAxPMFU{V@BPp]vU%B_MF]eVy]VMFY|UxZUVFUbTPBSMVrSVFRVMV%7fCVT|]N^VVVVVVVVVVVVVVVpVVVVPVVVVFVVV_GFVVVVsVU'V@FUpPSVO\'TMV].V$FUMVPSVBFVOC".U_SqV]/UU|VQU/V_RsV]/V^ZUQpVMVUtVMVR@V_'SqV]/Vo|VqV]/UU|VVpU/VyRGVU/VySGVUoPPFTUVU.U_'SsVXSV_'QqVQRVQ&pqFM/UPFSQU|VENVqFE/V$TqVFMVUtVMVR@V_'SqV]/Vo|VqV]/UU|VVpU/VyRGVU/VySGVU/VyTqVFMV_TqVZMVUtVMVR@VU|VqFs/UvVRqVM/U'RVxFRUV_QfqVACVT|RCb|VVFVV!FVVVVSgVFVVVT|Q%pEdvOY'%pAnN@"yMsxSuPAb%p{~rOE{NO]nNOyvUzQtPAbMT|^%pYeMO{vTOUdN@{bsPA#sYxUB.xUvcxUvAx\\N%{vPAnsPA#sYxRN%%7f%7ftcxUv!|Vtp/VVVS!UzM&u~"rsx[tzZ\'O%AbN$]"t_FUVVVVtoVVVVVVFUUV^ZVDVU_V^^VFNTTVRZVEVUPpRNVEVTt%7fRVVVUmTVVVPA#N@&uPAqv%A"tnxVVVSN{U!ez%M\'!&&VP ez!UZmA.\'X"g^\'/NUcvXd.TPRTTD!&UB\\dT.R}Q{!QQUdr~UguyU&sTU"u$An^PMdN@t!rpA&sPNcXQxSr@Am@p]bu\'#gT_^EVVVVtp|VVVUvU@YxM@Ye%pAtz{bsYxQv@"sOCvUzAbN%.|MsxRMzo%7fM&x]M@"}ty{sPA|tp/VVVUnSVVV_^GVVVVt%7fVVVVSvTSocu%E&uPB<VFVVV_ZFVVVVTUFRVFFTTVRZVpxTTVR\Vp**' xor_key = int(input('Plz input key (0<key<100):')) # 计算积分值 integral_value = (xor_key ** 2) / 2 + xor_key + 2/3 check_value = 13024 if integral_value * 3 == check_value: # 异或解密 xor_decoded_data = bytes([byte ^ xor_key for byte in encoded_data]) # base64解码 decoded_data = base64.b64decode(xor_decoded_data) # 反序列化为可执行代码对象 code_obj = marshal.loads(decoded_data) # 执行代码 exec(code_obj) else: print('Wrong!!') ``` 输入密钥后,程序将计算出积分值,并与给定的检查值进行比较,如果相等,则进行解密操作,并最终执行解密后的代码对象。
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值