Alikas-0x03
题目:实验吧recursive
拿到题先file一下,64位ELF文件
file recursive_python
recursive_python: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/l, for GNU/Linux 2.6.32, BuildID[sha1]=d33a21b0c7971d7dd951070fdd06cd393dc78cce, with debug_info, not stripped
运行一下,结果被调侃了0.0…
./recursive_python
You wish it was that easy!
拖进IDA中看一波
发现该文件在内部运行python解释器,It is created by Freeze,查资料发现,基本上这种情况都可以找到函数Py_FrozenMain,跟进
我们可以看到这个函数里有两个变量“PYTHONINSPECT”和“PYTHONUNBUFFERED”,之后都会调用函数getenv()
函数说明:getenv()用来取得参数envvar环境变量的内容。参数envvar为环境变量的名称,如果该变量存在则会返回指向该内容的指针。
那么说明如果这两个变量都存在,会产生一些新的东西,我们修改完再运行一下(随便赋值就好),如下:
export PYTHONINSPECT=6
export PYTHONUNBUFFERED=6
./recursive_python
You wish it was that easy!
>>>
其中Linux export命令用于设置或显示环境变量
运行完我们发现多了几个文件,猜测flag蕴藏其中
unstep_579c82e9 unstep_f67baaeb unstep_34a4d33b unstep_84fc2d39
运行一下,怎么还是没有=-=…
✘ ⚡ ⚙ root@DESKTOP-VU7HR7F /mnt/d/CTF/Games/题库/实验吧/RE/recursive_python ./unstep_34a4d33b You wish it was that easy! >>> ^Z [2] + 154 suspended ./unstep_34a4d33b ✘ ⚡ ⚙ root@DESKTOP-VU7HR7F /mnt/d/CTF/Games/题库/实验吧/RE/recursive_python ./unstep_84fc2d39 You wish it was that easy! ^Z [3] + 165 suspended ./unstep_84fc2d39 ✘ ⚡ ⚙ root@DESKTOP-VU7HR7F /mnt/d/CTF/Games/题库/实验吧/RE/recursive_python ./unstep_579c82e9 You wish it was that easy! ^Z [4] + 178 suspended ./unstep_579c82e9 ✘ ⚡ ⚙ root@DESKTOP-VU7HR7F /mnt/d/CTF/Games/题库/实验吧/RE/recursive_python ./unstep_f67baaeb You wish it was that easy! ^Z [5] + 187 suspended ./unstep_f67baaeb
拖进IDA后发现看不懂…
但猜测flag就在文件中,故直接用string搜索以及正则表达式匹配:
strings ./unstep_f67baaeb g| grep -o 'flag{.*}'
flag{python_taken_2_far}
*在正则表达式中表示匹配任意文本
最后在最后一个文件中找到flag
总结:
1.第一次遇到python逆向,查了不少资料,姿势学到了!
2.WSL真好用0.0!