xctf攻防世界 REVERSE 高手进阶区 re4-unvm-me

0x01. 进入环境，下载附件

题目给出的是一个pyc文件，我们对其进行反编译

uncompyle6 c2eebf52980f444684130672c821d789.pyc > test1.py

在对应目录下找到反编译的python文件test1.py。我们将其打开，内容如下：

# uncompyle6 version 3.8.0
# Python bytecode 2.7 (62211)
# Decompiled from: Python 3.8.8 (default, Apr 13 2021, 15:08:03) [MSC v.1916 64 bit (AMD64)]
# Embedded file name: unvm_me.py
# Compiled at: 2016-12-21 05:44:01
import md5
md5s = [
		174282896860968005525213562254350376167, 137092044126081477479435678296496849608, 
		26300127609096051658061491018211963916,  314989972419727999226545215739316729360,
		256525866025901597224592941642385934114, 115141138810151571209618282728408211053, 
		8705973470942652577929336993839061582, 256697681645515528548061291580728800189,  
		39818552652170274340851144295913091599,  65313561977812018046200997898904313350, 
		230909080238053318105407334248228870753, 196125799557195268866757688147870815374, 
		74874145132345503095307276614727915885]
print 'Can you turn me back to python ? ...'
flag = raw_input('well as you wish.. what is the flag: ')
if len(flag) > 69:
    print 'nice try'
    exit()
if len(flag) % 5 != 0:
    print 'nice try'
    exit()
for i in range(0, len(flag), 5):
    s = flag[i:i + 5]
    if int('0x' + md5.new(s).hexdigest(), 16) != md5s[(i / 5)]:
        print 'nice try'
        exit()

print 'Congratz now you have the flag'
# okay decompiling c2eebf52980f444684130672c821d789.pyc

0x02. 问题分析

观察上述代码，需要输入flag，其中flag需要满足：

• flag长度需要小于69
• flag需要整除5
• for循环中，flag每次取五位，转换成16进制后的字符形式，再转换成int数据，需要和对应次数的md5s值对应，最终会输出Congratz now you have the flag

要满足上述条件，我们暴力破解将会比较麻烦，直接尝试将上述给出的md5s整形数据转换成16进制再进行md5解密即可找到flag。先将给出的整形数据转换成16进制：

在线整型数据转16进制网址：https://tool.lu/hexconvert/

831daa3c843ba8b087c895f0ed305ce7
6722f7a07246c6af20662b855846c2c8
5f04850fec81a27ab5fc98befa4eb40c
ecf8dcac7503e63a6a3667c5fb94f610
c0fd15ae2c3931bc1e140523ae934722
569f606fd6da5d612f10cfb95c0bde6d
68cb5a1cf54c078bf0e7e89584c1a4e		# 此条数据无法解密，少了一位，应该是出题人挖的坑，需要再首位补0，再进行解密
c11e2cd82d1f9fbd7e4d6ee9581ff3bd
1df4c637d625313720f45706a48ff20f
3122ef3a001aaecdb8dd9d843c029e06
adb778a0f729293e7e0b19b96a4c5a61
938c747c6a051b3e163eb802a325148e
38543c5e820dd9403b57beff6020596d

接着将其md5解密，在线md5解密网站：https://www.somd5.com/

ALEXC
TF{dv
5d4s2
vj8nk
43s8d
8l6m1
n5l67
ds9v4
1n52n
v37j4
81h3d
28n4b
6v3k}

将其整理后，最终的答案为：ALEXCTF{dv5d4s2vj8nk43s8d8l6m1n5l67ds9v41n52nv37j481h3d28n4b6v3k}