攻防世界--open-source

1.打开源码

打开源码

#include <stdio.h>
#include <string.h>

int main(int argc, char *argv[]) {
    if (argc != 4) {
        printf("what?
");
        exit(1);
    }

    unsigned int first = atoi(argv[1]);
    if (first != 0xcafe) {
        printf("you are wrong, sorry.
");
        exit(2);
    }

    unsigned int second = atoi(argv[2]);
    if (second % 5 == 3 || second % 17 != 8) {
        printf("ha, you won't get it!
");
        exit(3);
    }

    if (strcmp("h4cky0u", argv[3])) {
        printf("so close, dude!
");
        exit(4);
    }

    printf("Brr wrrr grr
");

    unsigned int hash = first * 31337 + (second % 17) * 11 + strlen(argv[3]) - 1615810207;

    printf("Get your key: ");
    printf("%x
", hash);
    
    return 0;
}

2. 分析

很明显，第29行计算flag，第32行代码输出十六进制形式。第29行代码就是利用argv[1]~argv[3]的数据进行计算。

2.1 argv[1]

    if (first != 0xcafe) {
        printf("you are wrong, sorry.
");
        exit(2);
    }

不等于0xcafe就退出，那first=0xcafe

2.2 argv[2]

    if (second % 5 == 3 || second % 17 != 8) {
        printf("ha, you won't get it!
");
        exit(3);
    }

满足if条件就退出，我想到第一个不满足的数就是25，second = 25

2.3 argv[3]

    if (strcmp("h4cky0u", argv[3])) {
        printf("so close, dude!
");
        exit(4);
    }

相等strcmp返回0，退出if条件，那argv[3]=“h4cky0u”

3.get flag!

综上，写出解flag代码

#include <stdio.h>
#include <string.h>

int main(int argc, char* argv[]) {

    int first = 0xcafe;
    int second = 25;
    argv[3] = "h4cky0u";

    printf("Brr wrrr grr
");

    unsigned int hash = first * 31337 + (second % 17) * 11 + strlen(argv[3]) - 1615810207;

    printf("Get your key: ");
    printf("%x
", hash);

    system("PAUSE");
    return 0;
}