APK-逆向2 攻防世界

工具

.net+dnspy+python网络服务

思路展开

查壳发现是.net程序，直接上dnspy

// Rev_100.Program
// Token: 0x06000001 RID: 1 RVA: 0x00002050 File Offset: 0x00000250
private static void Main(string[] args)
{
	string hostname = "127.0.0.1";
	int port = 31337;
	TcpClient tcpClient = new TcpClient();
	try
	{
		Console.WriteLine("Connecting...");
		tcpClient.Connect(hostname, port);
	}
	catch (Exception)
	{
		Console.WriteLine("Cannot connect!\nFail!");
		return;
	}
	Socket client = tcpClient.Client;
	string text = "Super Secret Key";
	string text2 = Program.read();
	client.Send(Encoding.ASCII.GetBytes("CTF{"));
	foreach (char x in text)
	{
		client.Send(Encoding.ASCII.GetBytes(Program.search(x, text2)));
	}
	client.Send(Encoding.ASCII.GetBytes("}"));
	client.Close();
	tcpClient.Close();
	Console.WriteLine("Success!");
}

整个程序连接127.0.0.1的31337端口，读取自身一段文本，经过search函数处理再发回127.0.0.1的31337端口。类似不用输入动态调试出flag的那种情况。

电脑缺少127.0.0.1的31337端口，就开通服务，想到python的网络服务

import http.server
server_address = ('127.0.0.1', 31337)
handler_class = http.server.BaseHTTPRequestHandler
httpd = http.server.HTTPServer(server_address, handler_class)
httpd.serve_forever()

运行Python代码，再点击程序运行

CTF{7eb67b0bb4427e0b43b40b6042670b55}