JCTF 2014 小菜一碟

测试文件：https://static2.ichunqiu.com/icq/resources/fileupload//CTF/JCTF2014/re100

1.准备

获得信息

• ZIP文件
• Java文件

用解压文件打开

获得信息

• APK文件

2.Smali2JavaUI打开

/**
  * Generated by smali2java 1.0.0.558
  * Copyright (C) 2013 Hensence.com
  */

package com.example.encoding;

import android.app.Activity;
import android.widget.Button;
import android.widget.EditText;
import java.security.NoSuchAlgorithmException;
import java.security.MessageDigest;
import android.util.Base64;
import android.os.Bundle;
import android.view.View;
import android.view.Menu;
import android.view.MenuInflater;

public class MainActivity extends Activity {
    private Button button;
    private MyDialog dialog1;
    private MyDialog dialog2;
    private MyDialog dialog3;
    private EditText edittext;
    private StringBuffer str;
    
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(0x7f030000);
        dialog1 = new MyDialog(this, "try again");
        dialog2 = new MyDialog(this, "congratulations, you success!!!");
        dialog3 = new MyDialog(this, "sorry,please try again");
        edittext = (EditText)findViewById(0x7f080000);
        button = (Button)findViewById(0x7f080001);
        button.setOnClickListener(new View.OnClickListener(this) {
            
            1(MainActivity p1) {
            }
            
            public void onClick(View v) {
                MyDialog dialog3 = this$0new StringBuffer(edittext.getText().toString());
                str = localString1;
                if(str.length() < 0x5) {
                    edittext.setText("");
                    dialog1.showDialog();
                    return;
                }
                str.reverse();
                Log.i("ClownQiang", localString1.append(new String(str)).toString());
                String md5_string = encode(new String(str));
                Log.i("ClownQiang", str);
                String base64 = getBASE64(md5_string).trim();
                Log.i("ClownQiang", md5_string);
                if(base64.equalsIgnoreCase("NzU2ZDJmYzg0ZDA3YTM1NmM4ZjY4ZjcxZmU3NmUxODk=")) {
                    dialog2.showDialog();
                    return;
                }
                edittext.setText("");
                dialog3.showDialog();
            }
        });
    }
    
    public static String getBASE64(String s) {
        if(s == null) {
            return null;
        }
        return Base64.encodeToString(getBytes(), 0x0);
    }
    
    public static final String encode(String s) {
        // :( Parsing error. Please contact me.
    }
    
    public boolean onCreateOptionsMenu(Menu menu) {
        getMenuInflater().inflate(0x7f070000, menu);
        return true;
    }
}

3.代码分析

提取出主要的代码

str.reverse();//字符串反向
Log.i("ClownQiang", localString1.append(new String(str)).toString());
String md5_string = encode(new String(str));//md5加密
Log.i("ClownQiang", str);
String base64 = getBASE64(md5_string).trim();//base64加密
Log.i("ClownQiang", md5_string);
if(base64.equalsIgnoreCase("NzU2ZDJmYzg0ZDA3YTM1NmM4ZjY4ZjcxZmU3NmUxODk=")) {
    dialog2.showDialog();
    return;
}    

根据代码，我们只需要将经过md5和base64加密后的字符串"NzU2ZDJmYzg0ZDA3YTM1NmM4ZjY4ZjcxZmU3NmUxODk="解密后反向即可。

base64解密：756d2fc84d07a356c8f68f71fe76e189

md5解密：}321nimda{galflj

反向输出：jlflag{admin123}

 

4.get flag！

flag{admin123}