实验吧 密码学 picked WriteUp

题目

We just found a dead robot. It seems there is some useful data left but somehow it got confused with other data and now we don’t know what’s useful and what’s junk. We just know there is only one way to go but there are many dead ends.
Announcements:
Think outside the box - being several types at once like an animal that can change its color. Excuse the inaccuracy, but that’s what you’re searching for.
解题链接： http://ctf5.shiyanbar.com/crypto/Packed/packed.rar

思路

下载packed.rar后，我们发现这是个二进制文件。用010 editor打开，看到以下内容，并分析：

#disabled-encoding:	_rot__..._13|....
#第一行太长，简单地说就是凸显了rot13这个关键词

"""%PDF-102.98
#此处为PDF文件内容
1 0 obj <</Type /Catalog /Pages 2 0 R>>
endobj
2 0 obj <</Type /Pages /Kids [3 0 R] /Count 1>>
endobj
3 0 obj<</Type /Page /Parent 2 0 R /Resources 4 0 R /MediaBox [0 0 500 800] /Contents 6 0 R>>
endobj
4 0 obj<</Font <</F1 5 0 R>>>>
endobj
5 0 obj<</Type /Font /Subtype /Type1 /BaseFont /Helvetica>>
endobj
6 0 obj
<</Length 44>>
stream
BT /F1 24 Tf 175 720 Td (no hint given)Tj ET
endstream
endobj
xref
0 7
0000000000 65535 f
0000000009 00000 n
0000000056 00000 n
0000000111 00000 n
0000000212 00000 n
0000000250 00000 n
0000000317 00000 n
trailer <</Size 7/Root 1 0 R>>
startxref
406
%%EOF
"""
#这一段内容十分特殊，通过分析可以发现：这一段其实是rot-13加密内容
pvcure="U51\\\'Hk2W&+(3M;Hkpk0Kkf\k13u\k014$I!E($E>\g/)E!\k01<.\k13,A-nC4Z4nEhT1-IhH0 ThU+n@0J=3E9\k01>(_0\k01,8P0Ek ThA6\"I|\k1rmXM3\k014$]}E!2\k1q4F?7\k1nh\k1skf\g_\k01kn\k13<Tk)E&Vc2W&\k0s93G#mw\k1p\k1nc\k13ex\k00t\k01r|\k13t\k19wh\k0on\k18wg\k02b+kn\k13h\k01kn\k13%F1/Th\k03\k1o.\\:A7.\\:A4b\k13\k0pA-3\k133Z9&\k13<Ek N2JwvM{QinK0Kwu\k136A6\"E!\k01\k07eP0c\k138n\k1qp22vrh\k161Sj+=-@0\k1oEn\k13h\k01(3M;HkpE\'S.f\k1p>Q!f\k13<Ek,M&E1/Gj+E"
a =0 ;vzcbeg unfuyvo ,flf ;
gel :xrl =flf .neti [1 ]	
rkprcg VaqrkReebe :flf .rkvg ("k\k9p\ks3A\knqG0G\kp8\kpq,.\kpr\kppXJ\kp8\kppFU,W/\k03\k00Z\k97\k07\\".qrpbqr ("zip"))
s =trgngge (unfuyvo ,"k\k9p\kpoZ1\k05\k00\k02T\k01\k07".qrpbqr ("zip"))
juvyr a <(5 *10 **6 ):xrl =(s (xrl ).qvtrfg ());a =a +1 
xrl =xrl [:5 ].hccre ()
juvyr yra (xrl )<yra (pvcure ):xrl =xrl *2 
cynva ="".wbva (znc (pue ,[beq (n )^beq (o )sbe n ,o va mvc (pvcure ,xrl )]))
gel :rkrp cynva 
rkprcg :cevag "k\k9p\k0o/\kpn\kpsXJ\ks0A\knqG\k04\k00\k14q\k03k".qrpbqr ("zip"), erce(cynva)
#下面这段内容发现与base64内容很类似，但是通过base64解码却发现解码失败。
'''UEsDBBQAAAgAAL1jikFexjIMJwAAACcAAAAIAAAAbWltZXR5cGVhcHBsaWNhdGlvbi92bmQub2Fz
aXMub3BlbmRvY3VtZW50LnRleHRQSwMEFAAACAAAvWOKQemoBXVmBAAAZgQAABgAAABUaHVtYm5h
aWxzL3RodW1ibmFpbC5wbmeJUE5HDQoaCgAAAA1JSERSAAAAxgAAAQAIAgAAAGc/nhcAAAQtSURB
VHic7dJNi5ZlGIDheZ0ZmhklGWt8JTAiMwiZwFVRaNRK+0JaGAS1bhXUIn9Ae6HfEC0CoS/btKno
D4TZIqaIsjJTzNHUGUfnbaIW0jLOmGqOY/U81/08cN1wToxGozHoTKz3AvzfSIqYpIhJipikiEmK
mKSISYqYpIhJipikiEmKmKSISYqYpIhJipikiEmKmKT+cO3nhbNLV8+e/Ojk4ui2x146ONx00+Hq
6eOvf7X/5Qcuf35mdn7n1O8fL87unpscG7uxvPjjlxfn7l8b8qcNn9T1H94/+t7McwfOv/XJypaZ
LVPTm8fG1xp697Vj30/fPhxOjlZn9z2/d+rqiTePnh1uunDu2OWVma0TK1ufOrLvmzc+OHF6esfm
i+eOT9517/RP3332ztsr+w4deOGVR7cN1vte62fDJzWYuXt+8OHX1/dMXT916Zelq4PBYLS8uml8
evtwcP7yje2bB6PR6NrS+NyO8QuLv15ZuWX7cOLipcHqyupgaeHTL259Ym55y4MPn/p48vGdCwv3
zA/vGFy4sjq2bXy977V+NnxS47N7Dr64Z+3hkd03j+989dmbX588cvivP9448+3eZ54eLe86dHjX
LWPza5OH7jv0z+7637Dhk/rbxof7Dx9Y7yX+jSRFTFLEJEVMUsQkRUxSxCRFTFLEJEVMUsQkRUxS
xCRFTFLEJEVMUsQkRUxSxCRFTFLEJEVMUsQkRUxSxCRFTFLEJEVMUsQkRUxSxCRFTFLEJEVMUsQk
RUxSxCRFTFLEJEVMUsQkRUxSxCRFTFLEJEVMUsQkRUxSxCRFTFLEJEVMUsQkRUxSxCRFTFLEJEVM
UsQkRUxSxCRFTFLEJEVMUsQkRUxSxCRFTFLEJEVMUsQkRUxSxCRFTFLEJEVMUsQkRUxSxCRFTFLE
JEVMUsQkRUxSxCRFTFLEJEVMUsQkRUxSxCRFTFLEJEVMUsQkRUxSxCRFTFLEJEVMUsQkRUxSxCRF
TFLEJEVMUsQkRUxSxCRFTFLEJEVMUsQkRUxSxCRFTFLEJEVMUsQkRUxSxCRFTFLEJEVMUsQkRUxS
xCRFTFLEJEVMUsQkRUxSxCRFTFLEJEVMUsQkRUxSxCRFTFLEJEVMUsQkRUxSxCRFTFLEJEVMUsQk
RUxSxCRFTFLEJEVMUsQkRUxSxCRFTFLEJEVMUsQkRUxSxCRFTFLEJEVMUsQkRUxSxCRFTFLEJEVM
UsQkRUxSxCRFTFLEJEVMUsQ