[LitCTF 2023]debase64-入土为安的第十八天

点进去sub_401520(v15, (int)v4)

  if ( !*a1 )
    return 0;
  v2 = a1 + 4;
  v3 = a1;
  v4 = 0;
  v5 = 0;
  v13 = 0;
  while ( 1 )
  {
    v14 = -1;
    for ( i = 0; i != 64; ++i )
    {
      while ( byte_404000[i] != *v3 )
      {
        if ( ++i == 64 )
          goto LABEL_7;
      }
      LOBYTE(v14) = i;
    }
LABEL_7:
    LOBYTE(i) = 0;
    do
    {
      while ( byte_404000[i] != a1[v4 + 1] )
      {
        if ( ++i == 64 )
          goto LABEL_11;
      }
      BYTE1(v14) = i++;
    }
    while ( i != 64 );
LABEL_11:
    v7 = &a1[v4 + 2];
    for ( j = 0; j != 64; ++j )
    {
      while ( byte_404000[j] != *v7 )
      {
        if ( ++j == 64 )
          goto LABEL_15;
      }
      BYTE2(v14) = j;
    }
LABEL_15:
    v9 = &a1[v4 + 3];
    for ( k = 0; k != 64; ++k )
    {
      while ( byte_404000[k] != *v9 )
      {
        if ( ++k == 64 )
          goto LABEL_19;
      }
      HIBYTE(v14) = k;
    }
LABEL_19:
    v12 = v5 + 1;
    *(_BYTE *)(a2 + v5) = (4 * HIBYTE(v14)) | (BYTE2(v14) >> 4) & 3;
    if ( *v7 == '=' )
      return v12;
    v12 = v5 + 2;
    *(_BYTE *)(a2 + v5 + 1) = (16 * BYTE2(v14)) | (BYTE1(v14) >> 2) & 0xF;
    if ( *v9 == '=' )
      return v12;
    v5 += 3;
    v3 = v2;
    v2 += 4;
    v13 += 4;
    v4 = v13;
    *(_BYTE *)(a2 + v5 - 1) = (BYTE1(v14) << 6) | v14 & 0x3F;
    if ( !*(v2 - 4) )
      return v5;
  }
}

• 取 chunk 的第三个字节的低 6 位，映射到 Base64 字符。

• 取 chunk 的第二个字节的低 4 位，左移 2 位，加入 chunk 的第三个字节的高 2 位，映射到 Base64 字符。

• 取 chunk 的第一个字节的低 2 位，左移 4 位，加入 chunk 的第二个字节的高 4 位，映射到 Base64 字符。
• 取 chunk 的第一个字节的高 6 位，映射到 Base64 字符。

def custom_base64_encode(input_bytes):
    basetable = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
    # 以每三个字节为一组进行处理
    output = []

    # 确保输入长度为16字节
    input_bytes = input_bytes.ljust(16, b'\0')

    for i in range(0, len(input_bytes), 3):
        chunk = input_bytes[i:i + 3]
        number = 0

        if len(chunk) > 2:
            number += chunk[2] & 0x3F
            output.append(basetable[number])
        else:
            output.append(basetable[0])

        number = 0
        if len(chunk) > 1:
            number += chunk[1] & 0x0F
            number <<= 2
            number += chunk[2] >> 6
            output.append(basetable[number])
        else:
            output.append(basetable[0])

        number = 0
        if len(chunk) > 0:
            number += chunk[0] & 0x03
            number <<= 4
            if len(chunk) > 1:
                number += chunk[1] >> 4
            output.append(basetable[number])
        else:
            output.append(basetable[0])

        number = 0
        if len(chunk) > 0:
            number += chunk[0] >> 2
            output.append(basetable[number])
        else:
            output.append(basetable[0])

    return ''.join(output)


# 定义输入字节数据
input_bytes = bytes([
    0x46, 0xED, 0x18, 0x96, 0x56, 0x9E, 0xD2, 0x72, 0xB2, 0xB3, 0x80, 0x70, 0xFF
])

encoded_string = custom_base64_encode(input_bytes)
print("编码结果:", encoded_string)

Y0uReallyKn0wB4sAAw/AAAA 

import hashlib

key = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
for i in key:
    str1 = "Y0uReallyKn0wB4s" + i + "==="
    if hashlib.md5(str1.encode('utf-8')).hexdigest() == "5a3ebb487ad0046e52db00570339aace":
        print(str1)
        break

Y0uReallyKn0wB4s3===