攻防世界 reverse 进阶 1-4

1.dmd-50 suctf-2016

md5后比较，在线解md5得到：

md5(md5($pass)),所以将grape再进行MD5

b781cbb29054db12f88f08c6e161c199

2.Shuffle SECCON-CTF-2014

硬编码：

SECCON{Welcome to the SECCON 2014 CTF!}

3.re2-cpp-is-awesome alexctf-2017

 1 __int64 __fastcall main(int a1, char **a2, char **a3)

 2 {

 3   char *v3; // rbx

 4   __int64 v4; // rax

 5   __int64 v5; // rdx

 6   __int64 v6; // rax

 7   __int64 v7; // rdx

 8   __int64 v8; // rdx

 9   __int64 char_1; // rdx

10   __int64 s_char; // [rsp+10h] [rbp-60h]

11   char v12; // [rsp+20h] [rbp-50h]

12   char v13; // [rsp+4Fh] [rbp-21h]

13   __int64 v14; // [rsp+50h] [rbp-20h]

14   int k; // [rsp+5Ch] [rbp-14h]

15

16   if ( a1 != 2 )

17   {

18     v3 = *a2;

19     v4 = std::operator<<<std::char_traits<char>>(&std::cout, "Usage: ", a3);

20     v6 = std::operator<<<std::char_traits<char>>(v4, v3, v5);

21     std::operator<<<std::char_traits<char>>(v6, " flag\n", v7);

22     exit(0);

23   }

24   std::allocator<char>::allocator(&v13, a2, a3);

25   std::__cxx11::basic_string<char,std::char_traits<char>,std::allocator<char>>::basic_string(&v12, a2[1], &v13);

26   std::allocator<char>::~allocator(&v13);

27   k = 0;

28   for ( s_char = std::__cxx11::basic_string<char,std::char_traits<char>,std::allocator<char>>::begin(&v12);

29         ;

30         sub_400D7A(&s_char) )

31   {

32     v14 = std::__cxx11::basic_string<char,std::char_traits<char>,std::allocator<char>>::end(&v12);

33     if ( !cmp_400D3D((__int64)&s_char, (__int64)&v14) )

34       break;

35     char_1 = *(unsigned __int8 *)sub_400D9A((__int64)&s_char);

36     if ( (_BYTE)char_1 != str_6020A0[dword_6020C0[k]] )// 关键比较处

37       error_400B56((__int64)&s_char, (__int64)&v14, char_1);// 输出失败

38     ++k;

39   }

40   success_400B73((__int64)&s_char, (__int64)&v14, v8);// 成功

41   std::__cxx11::basic_string<char,std::char_traits<char>,std::allocator<char>>::~basic_string(&v12);

42   return 0LL;

43 }

关键处，在一个字符串中取特定顺序的字符进行与输入比较

 1 x='L3t_ME_T3ll_Y0u_S0m3th1ng_1mp0rtant_A_{FL4G}_W0nt_b3_3X4ctly_th4t_345y_t0_c4ptur3_H0wev3r_1T_w1ll_b3_C00l_1F_Y0u_g0t_1t'

 2 x=list(x)

 3 y=[ 36,

 4   0,

 5   5,

 6   54,

 7   101,

 8   7,

 9   39,

10   38,

11   45,

12   1,

13   3,

14   0,

15   13,

16   86,

17   1,

18   3,

19   101,

20   3,

21   45,

22   22,

23   2,

24   21,

25   3,

26   101,

27   0,

28   41,

29   68,

30   68,

31   1,

32   68,

33   43]

34 t=[]

35 for i in range(len(y)):

36     t.append(x[y[i]])

37

38 print(''.join(t))

ALEXCTF{W3_L0v3_C_W1th_CL45535}

4.crackme SHCTF-2017

查壳：

脱壳：

esp脱壳法：

单步执行pushfd后，转到esp

运行，断在一jmp处，单步来到一call，来到oep，在此处脱壳

脱壳成功，可以在ida中直接分析，这里我直接在od中跟一下程序，通过定位提示字符串，发现程序流程很简单，就是一个简单的异或

脚本：

 1 x=[18,

 2   4,

 3   8,

 4   20,

 5   36,

 6   92,

 7   74,

 8   61,

 9   86,

10   10,

11   16,

12   103,

13   0,

14   65,

15   0,

16   1,

17   70,

18   90,

19   68,

20   66,

21   110,

22   12,

23   68,

24   114,

25   12,

26   13,

27   64,

28   62,

29   75,

30   95,

31   2,

32   1,

33   76,

34   94,

35   91,

36   23,

37   110,

38   12,

39   22,

40   104,

41   91,

42   18]

43 s=list('this_is_not_flag')

44 t=[]

45 for i in range(42):

46     t.append(chr(ord(s[i%16])^x[i]))

47 print(''.join(t))

flag{59b8ed8f-af22-11e7-bb4a-3cf862d1ee75}

巴特西

攻防世界 reverse 进阶 1-4

最新文章

热门文章