CUMTCTF wp

CUMTCTF

double try

记事本打开

查阅资料得知
base64.b64encode()为base64编码，zlib.compress()为压缩
下面的长字符串应该为处理后的结果
编写脚本

import zlib, base64
c = 'eJydUjlywzAM/JJkpnVBU5pMCkBDyipcu9DQeYBMvT64aEuOm6TALLE4uACJ52mGP' \
    'pr1M3T+xb5nvMU5TtOM04UQdvF0hjc1f7XrzseXOK4w44s21iQ49Ru/N783/8t8wh' \
    'vN2YFhNPTz0IHkV8Su9iWkHlo/WX7tczG8HnD0CwQvSHYf1P+AQjgaXxQf/u+8Bvb' \
    '+ikX8NjKfvQOusXsqEl/zF6g6AmHxLWh94XuIc9TnTlwh3Fqb8r857Uka2VBnaGIx' \
    'zHJuMaslzuFc6kUxl/TcYDj1UbU3aVS9w6gc8jzZH6jPQXZXLJfOkDdn40mDo51Ib' \
    'pJ83pPlFe2DEnvWDps4G+3WPXqTn7L2rDrljqDcoPc4ip3sPZlfaD4+V3vDnT55d4' \
    'l3VvzK+5VdcW/V6OTNi/Ab3aqHd0LIsQaD5XMex4JpDhIXrYPsyJc0Vl9noVlX7p2' \
    '0hv+O43vsvjU9/9VzFvpXcc8t8uey4fjAOygWjkE8Hn8AFflf5g=='
m = base64.b64decode(c)
n = zlib.decompress(m)
z = base64.b64decode(n)
print(z)

得到结果
b’55 0D 0D 0A 00 00 00 00 09 64 AE 5F AC 00 00 00 E3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 00 00 00 40 00 00 00 73 4A 00 00 00 64 00 5A 00 64 01 5A 01 64 02 5A 02 65 03 65 04 65 00 83 01 83 01 44 00 5D 24 5A 05 65 02 65 06 65 0765 00 65 05 19 00 83 01 65 07 65 01 65 05 19 00 83 01 41 00 83 01 37 00 5A 02 71 18 65 08 65 02 83 01 01 00 64 03 53 00 29 04 7A 13 2A 2A 2A 2A 5F 2A 2A 2A 2A 5F 2A 2A 2A 2A 5F 2A 2A 2A 2A 7A 10 50 55 41 4C 41 4B 4C 56 56 5D 54 51 5B 7D 51 44 DA 00 4E 29 09 DA 04 66 6C 61 67 DA 01 62 DA 01 63 DA 05 72 61 6E 67 65 DA 03 6C 65 6E DA 01 69 DA 03 63 68 72 DA 03 6F 72 64 DA 05 70 72 69 6E 74 A9 00 72 0B 00 00 00 72 0B 00 00 00 FA 1E 43 3A 5C 55 73 65 72 73 5C 6C 65 6E 6F 76 6F 5C 44 65 73 6B 74 6F 70 5C 70 79 63 2E 70 79 DA 08 3C 6D 6F 64 75 6C 65 3E 01 00 00 00 73 0A 00 00 00 04 02 04 01 04 01 10 01 22 01’
用C32打开并粘贴进去，形成一个16进制文件111。
发现右边对应字符为
猜测为.pyc文件，后缀名改为.pyc
用uncompyle6反编译

uncompyle6 -o 000.py 111.pyc

得到python代码

flag = '****_****_****_****'
b = 'PUALAKLVV]TQ[}QD'
c = ''
for i in range(len(flag)):
    c += chr(ord(flag[i]) ^ ord(b[i]))
else:
    print(c)

猜测c为“cd2512d512d5123e”分析写脚本

flag = ''
c = 'cd2512d512d5123e'
b = 'PUALAKLVV]TQ[}QD'
for i in range(16):
    flag += chr(ord(c[i]) ^ ord(b[i]))
print(flag)

得到31sypy(cgo0djOb!
按照格式修改一下flag=‘31sy_py(c_go0d_jOb!’