“网鼎杯”网络安全大赛 2020 青龙组 WP
2020-05-15 本文已影响0人
Du1in9
比赛地址：https://race.ichunqiu.com/login?k=VzZXYVtkVGRUIwJnUzQANQJ6BnEAN1IxVDIDbgZuUWcEZgExWGICNgc%2F
CRYPTO
0x01 boom
ida看代码，printf("flag{%s_%d%d%d_%lld}", &Str, v27, v26, v25, v24);
查询md5得到Str：en5oy
用z3计算，得到v27=74，v26=68，v25=31
用求根公式算出v24=89127561
flag{en5oy_746831_89127561}
0x02 you raise me up
image
利用sagemath求指数，然后long_to_bytes，flag{5f95ca93-1594-762d-ed0b-a9139692cb4a}
RE
0x01 signal
模拟程序，得到运算后的数组
#include<stdio.h>
int main()
{
unsigned char a1[] = {0x0A,0x00,0x00,0x00,0x04,0x00,0x00,0x00,0x10,0x00,0x00,0x00,0x08,0x00,0x00,0x00,0x03,0x00,0x00,0x00,0x05,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x04,0x00,0x00,0x00,0x20,0x00,0x00,0x00,0x08,0x00,0x00,0x00,0x05,0x00,0x00,0x00,0x03,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x03,0x00,0x00,0x00,0x02,0x00,0x00,0x00,0x08,0x00,0x00,0x00,0x0B,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x0C,0x00,0x00,0x00,0x08,0x00,0x00,0x00,0x04,0x00,0x00,0x00,0x04,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x05,0x00,0x00,0x00,0x03,0x00,0x00,0x00,0x08,0x00,0x00,0x00,0x03,0x00,0x00,0x00,0x21,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x0B,0x00,0x00,0x00,0x08,0x00,0x00,0x00,0x0B,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x04,0x00,0x00,0x00,0x09,0x00,0x00,0x00,0x08,0x00,0x00,0x00,0x03,0x00,0x00,0x00,0x20,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x02,0x00,0x00,0x00,0x51,0x00,0x00,0x00,0x08,0x00,0x00,0x00,0x04,0x00,0x00,0x00,0x24,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x0C,0x00,0x00,0x00,0x08,0x00,0x00,0x00,0x0B,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x05,0x00,0x00,0x00,0x02,0x00,0x00,0x00,0x08,0x00,0x00,0x00,0x02,0x00,0x00,0x00,0x25,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x02,0x00,0x00,0x00,0x36,0x00,0x00,0x00,0x08,0x00,0x00,0x00,0x04,0x00,0x00,0x00,0x41,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x02,0x00,0x00,0x00,0x20,0x00,0x00,0x00,0x08,0x00,0x00,0x00,0x05,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x05,0x00,0x00,0x00,0x03,0x00,0x00,0x00,0x08,0x00,0x00,0x00,0x02,0x00,0x00,0x00,0x25,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x04,0x00,0x00,0x00,0x09,0x00,0x00,0x00,0x08,0x00,0x00,0x00,0x03,0x00,0x00,0x00,0x20,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x02,0x00,0x00,0x00,0x41,0x00,0x00,0x00,0x08,0x00,0x00,0x00,0x0C,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x07,0x00,0x00,0x00,0x22,0x00,0x00,0x00,0x07,0x00,0x00,0x00,0x3F,0x00,0x00,0x00,0x07,0x00,0x00,0x00,0x34,0x00,0x00,0x00,0x07,0x00,0x00,0x00,0x32,0x00,0x00,0x00,0x07,0x00,0x00,0x00,0x72,0x00,0x00,0x00,0x07,0x00,0x00,0x00,0x33,0x00,0x00,0x00,0x07,0x00,0x00,0x00,0x18,0x00,0x00,0x00,0x07,0x00,0x00,0x00,0xA7,0xFF,0xFF,0xFF,0x07,0x00,0x00,0x00,0x31,0x00,0x00,0x00,0x07,0x00,0x00,0x00,0xF1,0xFF,0xFF,0xFF,0x07,0x00,0x00,0x00,0x28,0x00,0x00,0x00,0x07,0x00,0x00,0x00,0x84,0xFF,0xFF,0xFF,0x07,0x00,0x00,0x00,0xC1,0xFF,0xFF,0xFF,0x07,0x00,0x00,0x00,0x1E,0x00,0x00,0x00,0x07,0x00,0x00,0x00,0x7A,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
int v10 = 0;
int v9 = 0;
int v8 = 0;
int v7 = 0;
int v6 = 0;
int result;
while(1)
{
result = v10;
if(v10>=4*114)
return result;
switch(a1[v10])
{
case 1:
printf("有情下一位\n");
v10=v10+4;
++v7;
++v9;
break;
case 2:
printf("+%d\n",a1[v10+4]);
v10 +=8;
break;
case 3:
printf("-%d\n",a1[v10+4]);
v10 +=8;
break;
case 4:
printf("^%d\n",a1[v10+4]);
v10 +=8;
break;
case 5:
printf("*%d\n",a1[v10+4]);
v10+=8;
break;
case 6:
printf("v10++\n");
v10+=4;
break;
case 7:
printf("compare：%d\n",a1[v10+4]);
v10+=8;
break;
case 8:
printf("\n");
v10+=4;
break;
case 10:
v10+=4;
break;
case 11:
printf("-1\n");
v10+=4;
break;
case 12 :
printf("+1\n");
v10+=4;
break;
default:
continue;
}
}
}
将数组算回去即可，flag{757515121f3d478}
code = [34,63,52,50,114,51,24,0xa7,49,0xf1,40,0x84,0xc1,30,122]
flag = [0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
flag[0] = (code[0]+5) ^ 16
flag[1] = (code[1]//3) ^ 32
flag[2] = code[2] +1+2
flag[3] = (code[3]^ 4) -1
flag[4] = (code[4]+33) //3
flag[5] = code[5]+1+1
flag[6] = (code[6]+32) ^ 9
flag[7] = (code[7] ^36) - 81
flag[8] = code[8]+1 -1
flag[9] = (code[9]-37) // 2
flag[10] = (code[10] ^ 65) -54
flag[11] = code[11] -32
flag[12] = (code[12] -37) //3
flag[13] = (code[13] +32) ^ 9
flag[14] = code[14] - 1 -65
for i in flag:
print(chr(i))
0x02 bang
http://www.mz6.net/news/2016-08-09/6591.html
http://www.5577.com/s/302204.html
一键脱壳，jd-gui打开搜索就有flag
