攻防世界 Misc高手进阶区 5分题 test.pyc

前言

继续ctf的旅程
攻防世界Misc高手进阶区的5分题
本篇是test.pyc的writeup

发现攻防世界的题目分数是动态的
就仅以做题时的分数为准了

解题过程

得到一个pyc

反编译
提示有部分不能反编译

#!/usr/bin/env python
# visit http://tool.lu/pyc/ for more information
str = 'jYygTOy' + 'cmNycWNyYmM1Ujf'
import base64

def flag1():
    code = str[::-3]
    result = ''
    for i in code:
        ss = ord(i) - 1
        result += chr(ss)
    
    print result[::-1]


def flag2():
    code = str[::-2]
    result = ''
    for i in code:
        ss = ord(i) - 1
        result += chr(ss)
    
    print result[::-2]


def flag3():
    pass
# WARNING: Decompyle incomplete

flag1()

发现flag3不能反编译

可能是文件有问题

扔进winhex看看

如图位置似乎多了些无意义字节
改为73 6F 00 00 00

再次反编译

#!/usr/bin/env python
# visit http://tool.lu/pyc/ for more information
str = '=cWbihGfyMzNllzZ'
str = str+'0cjZzMW'+'N5cTM4Y'+'jYygTOy' + 'cmNycWNyYmM1Ujf'
import base64

def flag1():
    code = str[::-3]
    result = ''
    for i in code:
        ss = ord(i) - 1
        result += chr(ss)
    
    print result[::-1]


def flag2():
    code = str[::-2]
    result = ''
    for i in code:
        ss = ord(i) - 1
        result += chr(ss)
    
    print result[::-2]


def flag3():
    code = str[::-1]
    code = base64.b64decode(code)
    result = ''
    for i in code:
        ss = ord(i) - 1
        result += chr(ss)
    
    print result[::-1]

flag1()

看了看就是base64然后字符串逆向

fjU1MmYyNWcyNmcyOTgyYjY4MTc5NWMzZjc0ZzllNzMyfGhibWc=

base64解码
得到~552f25g26g2982b681795c3f74g9e732|hbmg
逆向

gmbh|237e9g47f3c597186b2892g62g52f255~

看了看gmbh跟flag就差1

s='gmbh|237e9g47f3c597186b2892g62g52f255~'
flag=''
for i in range(len(s)):
	flag += chr(ord(s[i])-1)
print(flag)

得到flag

查了查wp
有个工具uncompyle

结语

认识一个新工具uncompyle