首页 > 其他 > 详细

XCTF 3rd-NJCTF-2017 first

时间：2020-03-16 13:44:08      阅读：165      评论：0      收藏：0      [点我收藏+]

1.ida打开得到main()：

  1 __int64 __fastcall main(__int64 a1, char **a2, char **a3)
  2 {
  3   __useconds_t *v3; // rbp
  4   unsigned int v4; // eax
  5   int *v5; // rcx
  6   int v6; // edx
  7   unsigned int v7; // eax
  8   bool v8; // zf
  9   signed __int64 v9; // rcx
 10   __int64 v10; // rax
 11   char v11; // bl
 12   char v12; // dl
 13   void (**v13)(void *); // rbp
 14   char *v14; // r12
 15   pthread_t *v15; // r13
 16   void (*v16)(void *); // rdi
 17   unsigned __int64 i; // rcx
 18   char v18; // al
 19   int *v19; // rdx
 20   int v20; // esi
 21   unsigned int v21; // eax
 22   unsigned __int64 v22; // rdx
 23   char *v23; // rax
 24   signed __int64 v24; // rdx
 25   char v25; // di
 26 
 27   v3 = useconds;
 28   v4 = time(0LL);
 29   srand(v4);
 30   do
 31   {
 32     ++v3;
 33     *(v3 - 1) = 100 * (rand() % 1000);
 34   }
 35   while ( v3 != &unk_602208 );
 36   __isoc99_scanf("%63s", dword_602180);
 37   v5 = dword_602180;
 38   do
 39   {
 40     v6 = *v5;
 41     ++v5;
 42     v7 = ~v6 & (v6 - 16843009) & 0x80808080;
 43   }
 44   while ( !v7 );
 45   v8 = (v7 & 0x8080) == 0;
 46   if ( !(v7 & 0x8080) )
 47     LOBYTE(v7) = BYTE2(v7);
 48   if ( v8 )
 49     v5 = (v5 + 2);
 50   v9 = v5 - (dword_602180 + __CFADD__(v7, v7) + 3);
 51   v10 = 0LL;
 52   v11 = 0;
 53   while ( v9 != v10 )
 54   {
 55     v12 = *(dword_602180 + v10) + v10;
 56     ++v10;
 57     v11 ^= v12;
 58   }
 59   v13 = &newthread;
 60   v14 = 0LL;
 61   v15 = &newthread;
 62   do
 63   {
 64     if ( pthread_create(v15, 0LL, start_routine, v14) )
 65     {
 66       perror("pthread_create");
 67       exit(-1);
 68     }
 69     ++v14;
 70     ++v15;
 71   }
 72   while ( v14 != 6 );
 73   do
 74   {
 75     v16 = *v13;
 76     ++v13;
 77     pthread_join(v16, 0LL);
 78   }
 79   while ( &free != v13 );
 80   for ( i = 0LL; ; byte_60221F[i] = v11 ^ byte_6020DF[i] ^ v18 )
 81   {
 82     v19 = dword_602180;
 83     do
 84     {
 85       v20 = *v19;
 86       ++v19;
 87       v21 = ~v20 & (v20 - 16843009) & 0x80808080;
 88     }
 89     while ( !v21 );
 90     if ( !(~v20 & (v20 - 257) & 0x8080) )
 91       LOBYTE(v21) = (~v20 & (v20 - 16843009) & 0x80808080) >> 16;
 92     if ( !(~v20 & (v20 - 257) & 0x8080) )
 93       v19 = (v19 + 2);
 94     v22 = v19 - (dword_602180 + __CFADD__(v21, v21) + 3);
 95     if ( v22 <= i )
 96       break;
 97     v18 = *(dword_602220 + i++);
 98   }
 99   if ( v22 )
100   {
101     if ( (LOBYTE(dword_602220[0]) - 48) > 74u )
102     {
103 LABEL_32:
104       puts("Badluck! There is no flag");
105       return 0LL;
106     }
107     v23 = dword_602220 + 1;
108     v24 = v22 + 6300192;
109     while ( v23 != v24 )
110     {
111       v25 = *v23++;
112       if ( (v25 - 48) > 0x4Au )
113         goto LABEL_32;
114     }
115   }
116   __printf_chk(1LL, "Here is the flag:%s\n", dword_602220);
117   return 0LL;
118 }

 

可以从代码得到：

 1   do
 2   {
 3     if ( pthread_create(v15, 0LL, start_routine, v14) )
 4     {
 5       perror("pthread_create");
 6       exit(-1);
 7     }
 8     ++v14;
 9     ++v15;
10   }
11   while ( v14 != 6 );

在此处创建了6个新的线程。

2.通过gdb的动态调试可以得知，程序把输入的字符串每4个分为一组。加上创建了6个线程，猜测输入字符串长度为24。

线程代码：

 1 unsigned __int64 __fastcall start_routine(void *a1)
 2 {
 3   __int64 v1; // rbp
 4   int v2; // ebx
 5   __useconds_t v3; // edi
 6   __int64 v4; // rbx
 7   int v5; // eax
 8   __int64 v6; // rdx
 9   __int64 v8; // [rsp+0h] [rbp-38h]
10   unsigned __int64 v9; // [rsp+18h] [rbp-20h]
11 
12   v1 = a1;
13   v2 = a1;
14   v3 = useconds[a1];
15   v9 = __readfsqword(0x28u);
16   v4 = v2;
17   usleep(v3);
18   pthread_mutex_lock(&mutex);
19   sub_400E10(&dword_602180[v4], 4uLL, &v8);
20   v5 = dword_6021E8;
21 
22   v6 = dword_6021E8;
23   if ( v8 == qword_602120[v1] )
24     dword_602220[v6] = dword_602180[v4];
25   else
26     dword_602220[v6] = 0;
27   dword_6021E8 = v5 + 1;
28   pthread_mutex_unlock(&mutex);
29   return __readfsqword(0x28u) ^ v9;
30 }

通过gdb调试知道，函数sub_400E10()为md5加密函数，传入参数为被分组的字符串的一组。所以线程的功能是把字符串md5加密后再与qword_602120[]数组进行对比。如果正确就把字符串赋值给一个全局数组变量，此变量在后面的flag的计算中需要使用。另外qword_602120[]数组为小端序储存，而且第一个线程的对比是qword_602120[0],如此类推。通过py脚本爆破出字符串。

  1 import hashlib
  2 import multiprocessing
  3 answer=[‘4746bbbd02bb590f‘, ‘beac2821ece8fc5c‘, ‘ad749265ca7503ef‘, ‘4386b38fc12c4227‘, ‘b03ecc45a7ec2da7‘, ‘bE3c5ffe121734e8‘]
  4 
  5 def cal_1():
  6     for i in range(32, 50):
  7         flag = [‘0‘, ‘0‘, ‘0‘, ‘0‘]
  8         flag[0] = chr(i)
  9         for j in range(32, 50):
 10             flag[1] = chr(j)
 11             for k in range(32, 127):
 12                 flag[2] = chr(k)
 13                 for l in range(32, 127):
 14                     flag[3] = chr(l)
 15                     result = ‘‘.join(flag)
 16                     flag_md5 = hashlib.md5()
 17                     flag_md5.update(result.encode(encoding=‘utf-8‘))
 18                     if flag_md5.hexdigest()[0:16] == answer[0]:
 19                         print(result)
 20 
 21 def cal_2():
 22     for i in range(50, 75):
 23         flag = [‘0‘, ‘0‘, ‘0‘, ‘0‘]
 24         flag[0] = chr(i)
 25         for j in range(32, 50):
 26             flag[1] = chr(j)
 27             for k in range(32, 127):
 28                 flag[2] = chr(k)
 29                 for l in range(32, 127):
 30                     flag[3] = chr(l)
 31                     result = ‘‘.join(flag)
 32                     flag_md5 = hashlib.md5()
 33                     flag_md5.update(result.encode(encoding=‘utf-8‘))
 34                     if flag_md5.hexdigest()[0:16] == answer[0]:
 35                         print(result)
 36 
 37 def cal_3():
 38     for i in range(75, 100):
 39         flag = [‘0‘,‘0‘,‘0‘,‘0‘]
 40         flag[0] = chr(i)
 41         for j in range(32, 50):
 42             flag[1] = chr(j)
 43             for k in range(32, 127):
 44                 flag[2] = chr(k)
 45                 for l in range(32, 127):
 46                     flag[3] = chr(l)
 47                     result=‘‘.join(flag)
 48                     flag_md5 = hashlib.md5()
 49                     flag_md5.update(result.encode(encoding=‘utf-8‘))
 50                     if flag_md5.hexdigest()[0:16] == answer[0]:
 51                         print(result)
 52 
 53 def cal_4():
 54     for i in range(100, 127):
 55         flag = [‘0‘,‘0‘,‘0‘,‘0‘]
 56         flag[0] = chr(i)
 57         for j in range(32, 50):
 58             flag[1] = chr(j)
 59             for k in range(32, 127):
 60                 flag[2] = chr(k)
 61                 for l in range(32, 127):
 62                     flag[3] = chr(l)
 63                     result=‘‘.join(flag)
 64                     flag_md5 = hashlib.md5()
 65                     flag_md5.update(result.encode(encoding=‘utf-8‘))
 66                     if flag_md5.hexdigest()[0:16] == answer[0]:
 67                         print(result)
 68 
 69 def cal_5():
 70     for i in range(32, 50):
 71         flag = [‘0‘,‘0‘,‘0‘,‘0‘]
 72         flag[0] = chr(i)
 73         for j in range(50, 75):
 74             flag[1] = chr(j)
 75             for k in range(32, 127):
 76                 flag[2] = chr(k)
 77                 for l in range(32, 127):
 78                     flag[3] = chr(l)
 79                     result=‘‘.join(flag)
 80                     flag_md5 = hashlib.md5()
 81                     flag_md5.update(result.encode(encoding=‘utf-8‘))
 82                     if flag_md5.hexdigest()[0:16] == answer[0]:
 83                         print(result)
 84 
 85 def cal_6():
 86     for i in range(50, 75):
 87         flag = [‘0‘,‘0‘,‘0‘,‘0‘]
 88         flag[0] = chr(i)
 89         for j in range(50, 75):
 90             flag[1] = chr(j)
 91             for k in range(32, 127):
 92                 flag[2] = chr(k)
 93                 for l in range(32, 127):
 94                     flag[3] = chr(l)
 95                     result=‘‘.join(flag)
 96                     flag_md5 = hashlib.md5()
 97                     flag_md5.update(result.encode(encoding=‘utf-8‘))
 98                     if flag_md5.hexdigest()[0:16] == answer[0]:
 99                         print(result)
100 
101 
102 def cal_7():
103     for i in range(75, 100):
104         flag = [‘0‘, ‘0‘, ‘0‘, ‘0‘]
105         flag[0] = chr(i)
106         for j in range(50, 75):
107             flag[1] = chr(j)
108             for k in range(32, 127):
109                 flag[2] = chr(k)
110                 for l in range(32, 127):
111                     flag[3] = chr(l)
112                     result = ‘‘.join(flag)
113                     flag_md5 = hashlib.md5()
114                     flag_md5.update(result.encode(encoding=‘utf-8‘))
115                     if flag_md5.hexdigest()[0:16] == answer[0]:
116                         print(result)
117 
118 
119 def cal_8():
120     for i in range(100, 127):
121         flag = [‘0‘, ‘0‘, ‘0‘, ‘0‘]
122         flag[0] = chr(i)
123         for j in range(50, 75):
124             flag[1] = chr(j)
125             for k in range(32, 127):
126                 flag[2] = chr(k)
127                 for l in range(32, 127):
128                     flag[3] = chr(l)
129                     result = ‘‘.join(flag)
130                     flag_md5 = hashlib.md5()
131                     flag_md5.update(result.encode(encoding=‘utf-8‘))
132                     if flag_md5.hexdigest()[0:16] == answer[0]:
133                         print(result)
134 
135 
136 def cal_9():
137     for i in range(32, 50):
138         flag = [‘0‘, ‘0‘, ‘0‘, ‘0‘]
139         flag[0] = chr(i)
140         for j in range(75, 100):
141             flag[1] = chr(j)
142             for k in range(32, 127):
143                 flag[2] = chr(k)
144                 for l in range(32, 127):
145                     flag[3] = chr(l)
146                     result = ‘‘.join(flag)
147                     flag_md5 = hashlib.md5()
148                     flag_md5.update(result.encode(encoding=‘utf-8‘))
149                     if flag_md5.hexdigest()[0:16] == answer[0]:
150                         print(result)
151 
152 
153 def cal_10():
154     for i in range(50, 75):
155         flag = [‘0‘, ‘0‘, ‘0‘, ‘0‘]
156         flag[0] = chr(i)
157         for j in range(75, 100):
158             flag[1] = chr(j)
159             for k in range(32, 127):
160                 flag[2] = chr(k)
161                 for l in range(32, 127):
162                     flag[3] = chr(l)
163                     result = ‘‘.join(flag)
164                     flag_md5 = hashlib.md5()
165                     flag_md5.update(result.encode(encoding=‘utf-8‘))
166                     if flag_md5.hexdigest()[0:16] == answer[0]:
167                         print(result)
168 
169 
170 def cal_11():
171     for i in range(75, 100):
172         flag = [‘0‘, ‘0‘, ‘0‘, ‘0‘]
173         flag[0] = chr(i)
174         for j in range(75, 100):
175             flag[1] = chr(j)
176             for k in range(32, 127):
177                 flag[2] = chr(k)
178                 for l in range(32, 127):
179                     flag[3] = chr(l)
180                     result = ‘‘.join(flag)
181                     flag_md5 = hashlib.md5()
182                     flag_md5.update(result.encode(encoding=‘utf-8‘))
183                     if flag_md5.hexdigest()[0:16] == answer[0]:
184                         print(result)
185 
186 
187 def cal_12():
188     for i in range(100, 127):
189         flag = [‘0‘, ‘0‘, ‘0‘, ‘0‘]
190         flag[0] = chr(i)
191         for j in range(75, 100):
192             flag[1] = chr(j)
193             for k in range(32, 127):
194                 flag[2] = chr(k)
195                 for l in range(32, 127):
196                     flag[3] = chr(l)
197                     result = ‘‘.join(flag)
198                     flag_md5 = hashlib.md5()
199                     flag_md5.update(result.encode(encoding=‘utf-8‘))
200                     if flag_md5.hexdigest()[0:16] == answer[0]:
201                         print(result)
202 
203 
204 def cal_13():
205     for i in range(32, 50):
206         flag = [‘0‘, ‘0‘, ‘0‘, ‘0‘]
207         flag[0] = chr(i)
208         for j in range(100, 127):
209             flag[1] = chr(j)
210             for k in range(32, 127):
211                 flag[2] = chr(k)
212                 for l in range(32, 127):
213                     flag[3] = chr(l)
214                     result = ‘‘.join(flag)
215                     flag_md5 = hashlib.md5()
216                     flag_md5.update(result.encode(encoding=‘utf-8‘))
217                     if flag_md5.hexdigest()[0:16] == answer[0]:
218                         print(result)
219 
220 
221 def cal_14():
222     for i in range(50, 75):
223         flag = [‘0‘, ‘0‘, ‘0‘, ‘0‘]
224         flag[0] = chr(i)
225         for j in range(100, 127):
226             flag[1] = chr(j)
227             for k in range(32, 127):
228                 flag[2] = chr(k)
229                 for l in range(32, 127):
230                     flag[3] = chr(l)
231                     result = ‘‘.join(flag)
232                     flag_md5 = hashlib.md5()
233                     flag_md5.update(result.encode(encoding=‘utf-8‘))
234                     if flag_md5.hexdigest()[0:16] == answer[0]:
235                         print(result)
236 
237 
238 def cal_15():
239     for i in range(75, 100):
240         flag = [‘0‘, ‘0‘, ‘0‘, ‘0‘]
241         flag[0] = chr(i)
242         for j in range(100, 127):
243             flag[1] = chr(j)
244             for k in range(32, 127):
245                 flag[2] = chr(k)
246                 for l in range(32, 127):
247                     flag[3] = chr(l)
248                     result = ‘‘.join(flag)
249                     flag_md5 = hashlib.md5()
250                     flag_md5.update(result.encode(encoding=‘utf-8‘))
251                     if flag_md5.hexdigest()[0:16] == answer[0]:
252                         print(result)
253 
254 
255 def cal_16():
256     for i in range(100, 127):
257         flag = [‘0‘, ‘0‘, ‘0‘, ‘0‘]
258         flag[0] = chr(i)
259         for j in range(100, 127):
260             flag[1] = chr(j)
261             for k in range(32, 127):
262                 flag[2] = chr(k)
263                 for l in range(32, 127):
264                     flag[3] = chr(l)
265                     result = ‘‘.join(flag)
266                     flag_md5 = hashlib.md5()
267                     flag_md5.update(result.encode(encoding=‘utf-8‘))
268                     if flag_md5.hexdigest()[0:16] == answer[0]:
269                         print(result)
270 
271 
272 if __name__ =="__main__":
273     p1=multiprocessing.Process(target=cal_1(),args=(2,))
274     p2=multiprocessing.Process(target=cal_2(),args=(3,))
275     p3=multiprocessing.Process(target=cal_3(),args=(4,))
276     p4=multiprocessing.Process(target=cal_4(),args=(5,))
277     p5=multiprocessing.Process(target=cal_5(),args=(6,))
278     p6=multiprocessing.Process(target=cal_6(),args=(7,))
279     p7=multiprocessing.Process(target=cal_7(),args=(8,))
280     p8=multiprocessing.Process(target=cal_8(),args=(9,))
281     p9=multiprocessing.Process(target=cal_9(),args=(10,))
282     p10= multiprocessing.Process(target=cal_10(), args=(11,))
283     p11= multiprocessing.Process(target=cal_11(), args=(12,))
284     p12= multiprocessing.Process(target=cal_12(), args=(13,))
285     p13= multiprocessing.Process(target=cal_13(), args=(14,))
286     p14= multiprocessing.Process(target=cal_14(), args=(15,))
287     p15= multiprocessing.Process(target=cal_15(), args=(16,))
288     p16= multiprocessing.Process(target=cal_16(), args=(17,))
289     p1.start()
290     p2.start()
291     p3.start()
292     p4.start()
293     p5.start()
294     p6.start()
295     p7.start()
296     p8.start()
297     p9.start()
298     p10.start()
299     p11.start()
300     p12.start()
301     p13.start()
302     p14.start()
303     p15.start()
304     p16.start()

这个脚本只能一个组爆破，需要在爆破完一个后手动修改answer[i]数组的i来爆破出6个组。最后得到输入字符串"juhuhfenlapsiuerhjifdunu"

3.因为此题有多解，需要在linux上用shell。

技术分享图片

运行后得到一堆解，最后根据语义得到flag:goodjobyougetthisflag233

XCTF 3rd-NJCTF-2017 first

原文：https://www.cnblogs.com/mio-yy/p/12503124.html
踩
(0)
赞
(0)
   
举报
评论 一句话评论（0）
分享档案
更多>
2021年09月23日 (328)
2021年09月24日 (313)
2021年09月17日 (191)
2021年09月15日 (369)
2021年09月16日 (411)
2021年09月13日 (439)
2021年09月11日 (398)
2021年09月12日 (393)
2021年09月10日 (160)
2021年09月08日 (222)
最新文章
更多>
教程昨日排行
更多>
友情链接
汇智网   PHP教程   插件网  
关于我们 - 联系我们 - 留言反馈 - 联系我们:wmxa8@hotmail.com
© 2014 bubuko.com 版权所有
打开技术之扣，分享程序人生！