[ctf.show.reverse] 红包六

石氏是时试

已于 2022-04-18 11:11:48 修改

阅读量976

点赞数 1

分类专栏： CTF reverse 文章标签： reverse

于 2022-04-15 19:00:00 首次发布

本文链接：https://blog.csdn.net/weixin_52640415/article/details/124191991

版权

CTF reverse 专栏收录该内容

134 篇文章 19 订阅

订阅专栏

下来是个压缩包，解开后一个原码，解码后是notflag，发现压缩包有5k大而解出的java文件只有1k，显然包里还有内容未解出

用010打开包发现有两个EzJar.class文件，手工切出解压

import zlib
inflator = zlib.decompressobj(-zlib.MAX_WBITS)
f=open('EzJar.jar','rb')
f.seek(659)
a=f.read(3248)
f.close()
x = inflator.decompress(a)
f=open('EzJar.class','wb')
f.write(x)
f.close()

用jd反编译得到主程序，其中l放的是数字I放的是一堆串，后边直接把输入的flag与其中一人比较。

package defpackage;

import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.util.Arrays;
import java.util.Base64;
import java.util.Scanner;
import javax.crypto.Cipher;
import javax.crypto.spec.SecretKeySpec;
import javax.swing.JOptionPane;

/* renamed from: EzJar */
public class EzJar {
    private static final /* synthetic */ String AC = I[l[16]];
    private static final /* synthetic */ String[] I = null;
    private static final /* synthetic */ String WA = I[l[15]];
    private static final /* synthetic */ String banner = I[l[11]];
    private static final /* synthetic */ String enc = I[l[14]];
    private static final /* synthetic */ String flag = I[l[12]];
    private static final /* synthetic */ String key = I[l[13]];
    private static final /* synthetic */ int[] l = null;

    static {
        EzJar.lII();
        EzJar.ll();
    }
    /* 把a2的md5作为key,对a1 base64解码后des加密 */
    private static String I(String a1, String a2) {
        try {
            SecretKeySpec v1 = new SecretKeySpec(Arrays.copyOf(MessageDigest.getInstance("MD5").digest(a2.getBytes(StandardCharsets.UTF_8)), l[8]), "DES");
            Cipher instance = Cipher.getInstance("DES");
            instance.init(l[3], v1);
            return new String(instance.doFinal(Base64.getDecoder().decode(a1.getBytes(StandardCharsets.UTF_8))), StandardCharsets.UTF_8);
        } catch (Exception e) {
            e.printStackTrace();
            return null;
        }
    }
    /* a1,a2异或, a1先循环补齐 */
    private static String l(String a1, String a2) {
        String v1 = new String(Base64.getDecoder().decode(a1.getBytes(StandardCharsets.UTF_8)), StandardCharsets.UTF_8);
        StringBuilder stringBuilder = new StringBuilder();
        char[] toCharArray = a2.toCharArray();
        int v2= l[0];
        char[] toCharArray2 = v1.toCharArray();
        int length = toCharArray2.length;
        int i = l[0];
        while (EzJar.llI(i, length)) {
            stringBuilder.append((char) (toCharArray[v2 % toCharArray.length] ^ toCharArray2[i]));
            "".length();
            v2++;
            i++;
            "".length();
            if ((-" ".length()) > "   ".length()) {
                return null;
            }
        }
        return String.valueOf(stringBuilder);
    }
    /* 以a2的md5值为密钥, 对base64解码后的a1 Blowfish加密 */
    private static String lI(String a1, String a2) {
        try {
            SecretKeySpec v1 = new SecretKeySpec(MessageDigest.getInstance("MD5").digest(a2.getBytes(StandardCharsets.UTF_8)), "Blowfish");
            Cipher instance = Cipher.getInstance("Blowfish");
            instance.init(l[3], v1);
            return new String(instance.doFinal(Base64.getDecoder().decode(a1.getBytes(StandardCharsets.UTF_8))), StandardCharsets.UTF_8);
        } catch (Exception v2) {
            v2.printStackTrace();
            return null;
        }
    }

    private static void lII() {
        l = new int[18];
        l[0] = 0;
        l[1] = 1;
        l[2] = 3;
        l[3] = 2;
        l[4] = 4;
        l[5] = 5;
        l[6] = 6;
        l[7] = 7;
        l[8] = 8;
        l[9] = 9;
        l[10] = 10;
        l[11] = 11;
        l[12] = 12;
        l[13] = 13;
        l[14] = 14;
        l[15] = 15;
        l[16] = 16;
        l[17] = 17;
    }

    private static boolean lIl(int i) {
        return i != 0;
    }

    private static void ll() {
        I = new String[l[17]];
        I[l[0]] = EzJar.I("AQiA0bYffm9HvMlm7RnEMX/tEQAUj4Xb", "FrlAZ");
        I[l[1]] = EzJar.I("hXzZyx8IUHw=", "Esxsh");
        I[l[3]] = EzJar.l("ID8PFlEKM1kKHhIkWRUdBjFD", "gVysq");
        I[l[2]] = EzJar.I("50fO6ARqllg=", "VZbFF");
        I[l[4]] = EzJar.lI("mvXqH+/XIESPZaSG3ZbZlA==", "TuZSw");
        I[l[5]] = EzJar.l("JQ0R", "aHBFu");
        I[l[6]] = EzJar.I("dMKiRQ19iTevvzL7NtVg5+ye5BywL2QaxtVANFLuC5B2/KuC+/5L6BwtCB7zpWK1XBTQr0VWC3Vt/uYEl2xmjskE0dDrCk2C", "dPxYA");
        I[l[7]] = EzJar.lI("B/MVYKSzgq8=", "phiUP");
        I[l[8]] = EzJar.I("ZtBOhuHeK3Y=", "MfnkQ");
        I[l[9]] = EzJar.lI("aPhz+GjGynRlU3Alo00QeQ==", "wWtUj");
        I[l[10]] = EzJar.l("BRQFNiRyBwQrNDcUSw==", "RfjXC");
        I[l[11]] = EzJar.I("pT10j0lChvyrNwYRFdqBzxqFp1ruTgo9", "hGcuT");
        I[l[12]] = EzJar.lI("UhBbCDk5yqaWl1uHJyS/OGmtcfVyvOOsk78/1f0MU8U3UfAf1Xf0FWNbpcKes/0HRz9SU/icRJHswW2xWjHrcFzhpsvwzqUl", "eeMoV");
        I[l[13]] = EzJar.I("s11BihYBzRBpcX9EF43utw==", "RjiXK");
        I[l[14]] = EzJar.I("wk5jH1cyKoA=", "frsxP");
        I[l[15]] = EzJar.I("Nfa0rxB8IRArMq2F4iLlLg==", "ulQWJ");
        I[l[16]] = EzJar.lI("wLcWNd0Xsbw=", "JgPGn");
    }

    private static boolean llI(int i, int i2) {
        return i < i2;
    }

    public static void main(String[] strArr) throws Exception {
        JOptionPane.showMessageDialog(null, I[l[0]], I[l[1]], l[2]);
        System.out.print(I[l[3]]);
        System.out.print(I[l[2]]);
        String next = new Scanner(System.in).next();
        Cipher instance = Cipher.getInstance(I[l[2]]);
        instance.init(l[1], new SecretKeySpec(I[l[4]].getBytes(), I[l[5]]));
        if (EzJar.lIl(I[l[6]].equals(new String(Base64.getEncoder().encode(instance.doFinal(next.getBytes())))))) {
            JOptionPane.showMessageDialog(null, I[l[7]]);
            System.out.print(I[l[8]]);
            "".length();
            if (null != null) {
            }
            return;
        }
        JOptionPane.showMessageDialog(null, I[l[9]]);
        System.out.print(I[l[10]]);
    }
}

对main部分稍作修改，改为解密程序

    public static void main(String[] strArr) throws Exception {
		//for(int i=0;i<17;i++) System.out.println(I[l[i]]);
        Cipher instance = Cipher.getInstance(I[l[2]]);  // DES
        instance.init(Cipher.DECRYPT_MODE, new SecretKeySpec(I[l[4]].getBytes(), I[l[5]])); //Ctf3r_me DES 
		System.out.println(new String( instance.doFinal(Base64.getDecoder().decode(I[l[6]]))) );
		/*
		密文  Dg/TZuRXF4+UwSZ8Dpwgw8+VOoHVl1YlPL1QRVhroCy4ptnKEcdC05iXcpLyDnuR
		算法  DES
		密钥  Ctf3r_me
		*/
    }

运行得到flag

C:\ctf.show.reverse\红包六\a>javac EzJar.java

C:\ctf.show.reverse\红包六\a>java EzJar
ctfshow{eb5e2541-58e6-4f8f-ae6f-5c7a6f920d73}

附，修改后的完整程序

//package defpackage;

import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.util.Arrays;
import java.util.Base64;
import java.util.Scanner;
import javax.crypto.Cipher;
import javax.crypto.spec.SecretKeySpec;
import javax.swing.JOptionPane;

/* renamed from: EzJar */
public class EzJar {
    //private static final /* synthetic */ String AC = I[l[16]];
    private static  /* synthetic */ String[] I = null;
    //private static final /* synthetic */ String WA = I[l[15]];
    //private static final /* synthetic */ String banner = I[l[11]];
    //private static final /* synthetic */ String enc = I[l[14]];
    //private static final /* synthetic */ String flag = I[l[12]];
    //private static final /* synthetic */ String key = I[l[13]];
    private static  /* synthetic */ int[] l = new int[18];

    static {
        EzJar.fun_lII();
        EzJar.fun_ll();
    }
    
    private static String fun_I(String a1, String a2) {
        try {
            SecretKeySpec v1 = new SecretKeySpec(Arrays.copyOf(MessageDigest.getInstance("MD5").digest(a2.getBytes(StandardCharsets.UTF_8)), l[8]), "DES");
            Cipher instance = Cipher.getInstance("DES");
            instance.init(l[3], v1);
            return new String(instance.doFinal(Base64.getDecoder().decode(a1.getBytes(StandardCharsets.UTF_8))), StandardCharsets.UTF_8);
        } catch (Exception e) {
            e.printStackTrace();
            return null;
        }
    }
    
    private static String fun_l(String a1, String a2) {
        String v1 = new String(Base64.getDecoder().decode(a1.getBytes(StandardCharsets.UTF_8)), StandardCharsets.UTF_8);
        StringBuilder stringBuilder = new StringBuilder();
        char[] toCharArray = a2.toCharArray();
        int v2= l[0];
        char[] toCharArray2 = v1.toCharArray();
        int length = toCharArray2.length;
        int i = l[0];
        while (EzJar.fun_llI(i, length)) {
            stringBuilder.append((char) (toCharArray[v2 % toCharArray.length] ^ toCharArray2[i]));
            "".length();
            v2++;
            i++;
            "".length();
            if ((-" ".length()) > "   ".length()) {
                return null;
            }
        }
        return String.valueOf(stringBuilder);
    }
    
    private static String fun_lI(String a1, String a2) {
        try {
            SecretKeySpec v1 = new SecretKeySpec(MessageDigest.getInstance("MD5").digest(a2.getBytes(StandardCharsets.UTF_8)), "Blowfish");
            Cipher instance = Cipher.getInstance("Blowfish");
            instance.init(l[3], v1);
            return new String(instance.doFinal(Base64.getDecoder().decode(a1.getBytes(StandardCharsets.UTF_8))), StandardCharsets.UTF_8);
        } catch (Exception v2) {
            v2.printStackTrace();
            return null;
        }
    }

    private static void fun_lII() {
        //l = new int[18];
        l[0] = 0;
        l[1] = 1;
        l[2] = 3;
        l[3] = 2;
        l[4] = 4;
        l[5] = 5;
        l[6] = 6;
        l[7] = 7;
        l[8] = 8;
        l[9] = 9;
        l[10] = 10;
        l[11] = 11;
        l[12] = 12;
        l[13] = 13;
        l[14] = 14;
        l[15] = 15;
        l[16] = 16;
        l[17] = 17;
    }

    private static boolean fun_lIl(int i) {
        return i != 0;
    }

    private static void fun_ll() {
        I = new String[l[17]];
        I[l[0]] = EzJar.fun_I("AQiA0bYffm9HvMlm7RnEMX/tEQAUj4Xb", "FrlAZ");
        I[l[1]] = EzJar.fun_I("hXzZyx8IUHw=", "Esxsh");
        I[l[3]] = EzJar.fun_l("ID8PFlEKM1kKHhIkWRUdBjFD", "gVysq");
        I[l[2]] = EzJar.fun_I("50fO6ARqllg=", "VZbFF");
        I[l[4]] = EzJar.fun_lI("mvXqH+/XIESPZaSG3ZbZlA==", "TuZSw");
        I[l[5]] = EzJar.fun_l("JQ0R", "aHBFu");
        I[l[6]] = EzJar.fun_I("dMKiRQ19iTevvzL7NtVg5+ye5BywL2QaxtVANFLuC5B2/KuC+/5L6BwtCB7zpWK1XBTQr0VWC3Vt/uYEl2xmjskE0dDrCk2C", "dPxYA");
        I[l[7]] = EzJar.fun_lI("B/MVYKSzgq8=", "phiUP");
        I[l[8]] = EzJar.fun_I("ZtBOhuHeK3Y=", "MfnkQ");
        I[l[9]] = EzJar.fun_lI("aPhz+GjGynRlU3Alo00QeQ==", "wWtUj");
        I[l[10]] = EzJar.fun_l("BRQFNiRyBwQrNDcUSw==", "RfjXC");
        I[l[11]] = EzJar.fun_I("pT10j0lChvyrNwYRFdqBzxqFp1ruTgo9", "hGcuT");
        I[l[12]] = EzJar.fun_lI("UhBbCDk5yqaWl1uHJyS/OGmtcfVyvOOsk78/1f0MU8U3UfAf1Xf0FWNbpcKes/0HRz9SU/icRJHswW2xWjHrcFzhpsvwzqUl", "eeMoV");
        I[l[13]] = EzJar.fun_I("s11BihYBzRBpcX9EF43utw==", "RjiXK");
        I[l[14]] = EzJar.fun_I("wk5jH1cyKoA=", "frsxP");
        I[l[15]] = EzJar.fun_I("Nfa0rxB8IRArMq2F4iLlLg==", "ulQWJ");
        I[l[16]] = EzJar.fun_lI("wLcWNd0Xsbw=", "JgPGn");
    }

    private static boolean fun_llI(int i, int i2) {
        return i < i2;
    }

    public static void main(String[] strArr) throws Exception {
		//for(int i=0;i<17;i++) System.out.println(I[l[i]]);
        Cipher instance = Cipher.getInstance(I[l[2]]);  // DES
        instance.init(Cipher.DECRYPT_MODE, new SecretKeySpec(I[l[4]].getBytes(), I[l[5]])); //Ctf3r_me DES 
		System.out.println(new String( instance.doFinal(Base64.getDecoder().decode(I[l[6]]))) );
		/*
		密文  Dg/TZuRXF4+UwSZ8Dpwgw8+VOoHVl1YlPL1QRVhroCy4ptnKEcdC05iXcpLyDnuR
		算法  DES
		密钥  Ctf3r_me
		*/
    }
}

石氏是时试

关注

1
点赞
踩
1

收藏

觉得还不错? 一键收藏
2
评论
[ctf.show.reverse] 红包六

下来是个压缩包，解开后一个原码，解码后是notflag，发现压缩包有5k大而解出的java文件只有1k，显然包里还有内容未解出用010打开包发现有两个EzJar.class文件，手工切出解压import zlibinflator = zlib.decompressobj(-zlib.MAX_WBITS)f=open('EzJar.jar','rb')f.seek(659)a=f.read(3248)f.close()x = inflator.decompress(a)f=open('
复制链接

扫一扫