BUUCTF--[BJDCTF2020]BJD hamburger competition

测试文件：https://www.lanzous.com/ib3e6ih

代码分析

这出题人真是个人才，打开一次笑一次，奥利给。

这道题找对文件分析就行，dnSpy打开Assembly-CSharp.dll文件

using System;
using System.Security.Cryptography;
using System.Text;
using UnityEngine;

// Token: 0x02000004 RID: 4
public class ButtonSpawnFruit : MonoBehaviour
{
    // Token: 0x0600000A RID: 10 RVA: 0x00002110 File Offset: 0x00000310
    public static string Md5(string str)
    {
        byte[] bytes = Encoding.UTF8.GetBytes(str);
        byte[] array = MD5.Create().ComputeHash(bytes);
        StringBuilder stringBuilder = new StringBuilder();
        foreach (byte b in array)
        {
            stringBuilder.Append(b.ToString("X2"));
        }
        return stringBuilder.ToString().Substring(0, 20);
    }

    // Token: 0x0600000B RID: 11 RVA: 0x00002170 File Offset: 0x00000370
    public static string Sha1(string str)
    {
        byte[] bytes = Encoding.UTF8.GetBytes(str);
        byte[] array = SHA1.Create().ComputeHash(bytes);
        StringBuilder stringBuilder = new StringBuilder();
        foreach (byte b in array)
        {
            stringBuilder.Append(b.ToString("X2"));
        }
        return stringBuilder.ToString();
    }

    // Token: 0x0600000C RID: 12 RVA: 0x000021C8 File Offset: 0x000003C8
    public void Spawn()
    {
        FruitSpawner component = GameObject.FindWithTag("GameController").GetComponent<FruitSpawner>();
        if (component)
        {
            if (this.audioSources.Length != 0)
            {
                this.audioSources[Random.Range(0, this.audioSources.Length)].Play();
            }
            component.Spawn(this.toSpawn);
            string name = this.toSpawn.name;
            if (name == "汉堡底" && Init.spawnCount == 0)
            {
                Init.secret += 997;
            }
            else if (name == "鸭屁股")
            {
                Init.secret -= 127;
            }
            else if (name == "胡罗贝")
            {
                Init.secret *= 3;
            }
            else if (name == "臭豆腐")
            {
                Init.secret ^= 18;
            }
            else if (name == "俘虏")
            {
                Init.secret += 29;
            }
            else if (name == "白拆")
            {
                Init.secret -= 47;
            }
            else if (name == "美汁汁")
            {
                Init.secret *= 5;
            }
            else if (name == "柠檬")
            {
                Init.secret ^= 87;
            }
            else if (name == "汉堡顶" && Init.spawnCount == 5)
            {
                Init.secret ^= 127;
                string str = Init.secret.ToString();
                if (ButtonSpawnFruit.Sha1(str) == "DD01903921EA24941C26A48F2CEC24E0BB0E8CC7")
                {
                    this.result = "BJDCTF{" + ButtonSpawnFruit.Md5(str) + "}";
                    Debug.Log(this.result);
                }
            }
            Init.spawnCount++;
            Debug.Log(Init.secret);
            Debug.Log(Init.spawnCount);
        }
    }

    // Token: 0x04000005 RID: 5
    public GameObject toSpawn;

    // Token: 0x04000006 RID: 6
    public int spawnCount = 1;

    // Token: 0x04000007 RID: 7
    public AudioSource[] audioSources;

    // Token: 0x04000008 RID: 8
    public string result = "";
}

看到代码82~87行，怎么输入我们不需要关系，只需要得到str进行MD5加密就行，我们知道了str经过SHA1加密为DD01903921EA24941C26A48F2CEC24E0BB0E8CC7，可以解出str

SHA1解密得到：1001

MD5加密：b8c37e33defde51cf91e1e03e51657da

仔细看第19行代码，是对md5加密后的结果，取前20位

get flag！

flag{b8c37e33defde51cf91e}