findit
下载附件,发现是apk,就直接在JBE中打开,然后发现这么一段十六进制数,上脚本跑一下就出来了:
脚本:
a=[ 0x70,0x76,0x6B,0x71,0x7B,0x6D,0x31,
0x36,0x34,0x36,0x37,0x35,0x32,0x36,
0x32,0x30,0x33,0x33,0x6C,0x34,0x6D,
0x34,0x39,0x6C,0x6E,0x70,0x37,0x70,
0x39,0x6D,0x6E,0x6B,0x32,0x38,0x6B,
0x37,0x35,0x7D]
s=''
for i in a:
s+=chr(i)
print(s)
跑出来是:pvkq{m164675262033l4m49lnp7p9mnk28k75}
你会发现和flag很像,但是终究不是,但是很像凯撒解密,我们可以尝试一下(强烈推荐bugku的在线工具,尤其是凯撒解密,可以枚举出来,很方便):
得到最终的答案:
flag{c164675262033b4c49bdf7f9cda28a75}
rsa
解压出来后,在文件夹中有个pub.key,里面是公钥,可以再公钥解析来解密,得到n,e
这个是时候,我们还缺少p,q;然后我们可以用这个网站http://www.factordb.com前面是p,后面是千q
得到
p=285960468890451637935629440372639283459
q= 285960468890451637935629440372639283459
然后,写脚本:
import gmpy2
import rsa
e = 65537
n = 86934482296048119190666062003494800588905656017203025617216654058378322103517
p = 285960468890451637935629440372639283459
q = 304008741604601924494328155975272418463
phin = (p - 1) * (q - 1)
d = gmpy2.invert(e, phin)
key = rsa.PrivateKey(n, e, int(d), p, q)
with open("flag.enc", "rb") as f:
f = f.read()
print(rsa.decrypt(f, key))
得到:
flag{decrypt_256}
easyRE
下载附件,直拖入IDA中:
跟进,到交叉引用列表:
在F5查看伪代码:
发现第一个关键:
然后得到:
num=[73,111,100,108,62,81,110,98,40,111,99,121,127,121,46,105,127,100,96,51,119,125,119,101,107,57,123,105,121,61,126,121,76,64,69,67]
text=''
for i in range(0,36):
text=text+chr(num[i]^i)
print(text)
然后在找到第二个关键部分:
跟进,跳转到:
这里是那个数组的加密方式,脚本解密一下
根据if里的判断条件和之前脚本解出的那个字符串提示,先是"flag"与数组前四个进行异或,再把数组于得到的字符串依次异或,最终得到flag。
脚本:
s = [0x40,0x35,0x20,0x56,0x5D,0x18,0x22,0x45,0x17,0x2F,0x24,0x6E,0x62,0x3C,0x27,0x54,0x48,0x6C,0x24,0x6E,0x72,0x3C,0x32,0x45,0x5B]
s1 = 'flag'
key = ''
flag = ''
for i in range(len(s1)):
key += chr(s[i] ^ ord(s1[i]))
for i in range(len(s)):
flag += chr(s[i] ^ ord(key[i % 4]))
print(flag)
flag{Act1ve_Defen5e_Test}
[FlareOn4]login
附件解压后,会得到一个网页,查看网页源码:
在这段js代码中最重要的:
我自己上网查了一下,看了大佬的思路,才知道这是一个ROT13加密,直接写脚本就可以了:
s = 'PyvragFvqrYbtvafNerRnfl@syner-ba.pbz'
flag = ''
for i in s:
if (i >= 'A' and i <= 'Z'):
x = ord(i) - 13
if x < 65:
x += 26
flag += chr(x)
elif (i >= 'a' and i <= 'z'):
x = ord(i) - 13
if x < 97:
x += 26
flag += chr(x)
else:
flag += i
print(flag)
运行得到:
最终根据要求的flag格式提交,即:
flag{ClientSideLoginsAreEasy@flare-on.com}
[SUCTF2019]SignIn
查壳:
64位,无壳,拖入IDA中:
跟进,跳转到交叉引用列表:
然后再F5查看伪代码:
程序调用了 __gmpz_init_set_str 函数,这是一个 GNU 高精度算法库,在RSA加密中见过几次,加上65537这个比较铭感的数据,直接就确定了这是道RSA加密。
C=ad939ff59f6e70bcbfad406f2494993757eee98b91bc244184a377520d06fc35
N=103461035900816914121390101299049044413950405173712170434161686539878160984549
E=65537
这个得到p,q和上面的一道题一样,都是到网站中:
p=282164587459512124844245113950593348271
q=366669102002966856876605669837014229419
然后,脚本:
import gmpy2
import binascii
p = 282164587459512124844245113950593348271
q = 366669102002966856876605669837014229419
e = 65537
c = 0xad939ff59f6e70bcbfad406f2494993757eee98b91bc244184a377520d06fc35
n = p * q
d = gmpy2.invert(e, (p-1) * (q-1))
m = gmpy2.powmod(c, d, n)
print(binascii.unhexlify(hex(m)[2:]).decode(encoding="utf-8"))
得到:
suctf{Pwn_@_hundred_years}