[ctf.show.reverse] 来一个派森，好好学习天天向上

最新推荐文章于 2025-03-24 22:04:41 发布

石氏是时试

最新推荐文章于 2025-03-24 22:04:41 发布

阅读量1.1k

点赞数

分类专栏： CTF reverse 文章标签： reverse

本文链接：https://blog.csdn.net/weixin_52640415/article/details/124198672

版权

CTF reverse 专栏收录该内容

134 篇文章

订阅专栏

来一个派森

根据名字来看是一个编译成exe的python程序，

用py \tools\pyinstxtractor.py checkme.exe 将其解包，
然后将struct文件头部E3前的部分插入到checkme文件头部（恢复pyc头）
再将pyc文件反编译

#!/usr/bin/env python
# visit https://tool.lu/pyc/ for more information

def b58encode(tmp = None):
    tmp = list(map(ord, tmp))
    temp = tmp[0]
    base58 = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz'
    for i in range(len(tmp) - 1):
        temp = temp * 256 + tmp[i + 1]
    
    tmp = []
    while None:
        temp = temp // 58
        if temp == 0:
            break
        temp = ''
        for i in tmp:
            temp += base58[i]
        
    tmp = []
    for i in range(len(temp)):
        tmp.append(chr(ord(temp[i]) ^ i))
    
    check = ['A','5','q','O','g','q','d','\x7f','[','\x7f','s','{','G','A','x','`','D','@','K','c','-','c',' ','G','+','+','|','x','}','J','h','\\','l']
    if tmp == check:
        return 1

flag = input('\xe8\xbe\x93\xe5\x85\xa5flag\xef\xbc\x9a')
if b58encode(flag):
    print('you win')
else:
    print('try again')

这个程序就是把flag进行base58编码再作个异或，然后与check比较，所以将check异或后再base58解码即可

check = ['A','5','q','O','g','q','d','\x7f','[','\x7f','s','{','G','A','x','`','D','@','K','c','-','c',' ','G','+','+','|','x','}','J','h','\\','l']
a = ''
for i in range(len(check)):
    a+=chr(ord(check[i])^i)

print(a)
#A4sLctbxSvypKLvoTQYp9v6P32fcaWvCL
#ctfshow{zhe_bu_shi_flag}

好好学习天天向上

这个没着了，从网上看的flag

程序不算复杂就是一个查表然后累加，最后检查累加值，但这个值是累加值没法逆回。只能爆破

  for ( i = 0; i < 31; v4 += *(_QWORD *)&aA[8 * (int)(sub_140001140((unsigned __int8)byte_140014060[++i]) + v2)] )
  {
    if ( (int)sub_140001140((unsigned __int8)byte_140014060[i]) < 0 )
      goto LABEL_11;
    v2 = 17 * (sub_140001140((unsigned __int8)byte_140014060[i]) + 16 * i);
  }
  if ( v4 == 0x1C836D8E5C11047Fi64 && byte_140014060[31] == 125 )
    result = 1;

爆破程序

from pwn import *
tab = 'abdefglostuyp{}_'
aa = open('cStuday.exe', 'rb').read()[0x2400: 0x13400]
def deeptry(i, v4, s):
    if v4<0:
        return False
    if i==0:
        #print(i,hex(v4),s)
        if v4 == 0:
            print('-->'+s)
        return False
    for j in range(16):
        v2 = 17*(j + 16*i)
        p = 8 * (tab.index(s[0]) + v2)
        #print(hex(p))
        tmp = v4 - u64(aa[p:p+8])
        deeptry(i-1, tmp, tab[j]+s)

s = '}'
deeptry(31,0x1C836D8E5C11047F,s)

当然不会有什么结果，16^31这个数太大了。

网上看到这个值是猜的，因为key＝ abdefglostuyp{}_ 这里可以看到stu 结合题目名字"好好学习天天向上"猜到 flag{good_good_study_day_day_up} 验证一下没问题

s = 'flag{good_good_study_day_day_up}'
v4 = 0
for i in range(32-1):
    v2 = 17*(tab.index(s[i]) + 16*i)
    p = 8 * (tab.index(s[i+1]) + v2)
    v4 += u64(aa[p : p+8])

print(hex(v4))
if v4  == 0x1C836D8E5C11047F:
    print("ok:"+s)