前言
继续ctf的旅程
攻防世界Misc高手进阶区的5分题
本篇是test.pyc的writeup
发现攻防世界的题目分数是动态的
就仅以做题时的分数为准了
解题过程
得到一个pyc
反编译
提示有部分不能反编译
#!/usr/bin/env python
# visit http://tool.lu/pyc/ for more information
str = 'jYygTOy' + 'cmNycWNyYmM1Ujf'
import base64
def flag1():
code = str[::-3]
result = ''
for i in code:
ss = ord(i) - 1
result += chr(ss)
print result[::-1]
def flag2():
code = str[::-2]
result = ''
for i in code:
ss = ord(i) - 1
result += chr(ss)
print result[::-2]
def flag3():
pass
# WARNING: Decompyle incomplete
flag1()
发现flag3不能反编译
可能是文件有问题
扔进winhex看看
如图位置似乎多了些无意义字节
改为73 6F 00 00 00
再次反编译
#!/usr/bin/env python
# visit http://tool.lu/pyc/ for more information
str = '=cWbihGfyMzNllzZ'
str = str+'0cjZzMW'+'N5cTM4Y'+'jYygTOy' + 'cmNycWNyYmM1Ujf'
import base64
def flag1():
code = str[::-3]
result = ''
for i in code:
ss = ord(i) - 1
result += chr(ss)
print result[::-1]
def flag2():
code = str[::-2]
result = ''
for i in code:
ss = ord(i) - 1
result += chr(ss)
print result[::-2]
def flag3():
code = str[::-1]
code = base64.b64decode(code)
result = ''
for i in code:
ss = ord(i) - 1
result += chr(ss)
print result[::-1]
flag1()
看了看就是base64然后字符串逆向
fjU1MmYyNWcyNmcyOTgyYjY4MTc5NWMzZjc0ZzllNzMyfGhibWc=
base64解码
得到~552f25g26g2982b681795c3f74g9e732|hbmg
逆向
gmbh|237e9g47f3c597186b2892g62g52f255~
看了看gmbh跟flag就差1
s='gmbh|237e9g47f3c597186b2892g62g52f255~'
flag=''
for i in range(len(s)):
flag += chr(ord(s[i])-1)
print(flag)
得到flag
查了查wp
有个工具uncompyle
结语
认识一个新工具uncompyle