BUUCTF Re部分wp（二）

[2019红帽杯]easyRE

这题有点坑。。。

两次输入，第一次

a=[0x49,0x6f,0x64,0x6c,0x3e,0x51,0x6e,0x62,0x28,0x6f,0x63,0x79,0x7f,0x79,0x2e,0x69,0x7f,0x64,0x60,0x33,0x77,0x7d,0x77,0x65,0x6b,0x39,0x7b,0x69,0x79,0x3d,0x7e,0x79,0x4c,0x40,0x45,0x43]

for i in range(len(a)):
    print(chr(a[i]^i),end="")

得到Info:The first four chars are `flag`

第二次是一个经过多次base64的密文，解密得https://bbs.pediy.com/thread-254172.htm

这文章看看，字里行间写满了坑人二字，也知道自己被带到沟里了，但如何找到正确的函数有点困难，在进行了两次输出后，fini里用了个sub_400D35

 有f和g，结合第一次输入的提示，大概可猜到是这个函数

byte_6CC0A0=[0x40,0x35,0x20,0x56,0x5D,0x18,0x22,0x45,0x17,0x2F,0x24,0x6E,0x62,0x3C,0x27,0x54,0x48,0x6C,0x24,0x6E,0x72,0x3C,0x32,0x45,0x5B]
f="flag"
v5=[0,0,0,0]
b=[0x40,0x35,0x20,0x56]
flag=[]
for i in range(4):
    v5[i]=b[i]^ord(f[i])

for i in range(len(byte_6CC0A0)):
    flag.append(v5[i%4]^byte_6CC0A0[i])
for i in flag:
    print(chr(i),end="")

得到flag

[SUCTF2019]SignIn

 看到65537就大概可以猜到是rsa了，比较v6，v7，前面是一些字符串的赋值，给了n和e的值，v7是密文，v6为输入的明文

import gmpy2
import rsa

e=65537
n=103461035900816914121390101299049044413950405173712170434161686539878160984549
p=282164587459512124844245113950593348271
q=366669102002966856876605669837014229419

phin = (p-1) * (q-1)
d=gmpy2.invert(e, phin)

key=rsa.PrivateKey(n,e,int(d),p,q)

c=0xad939ff59f6e70bcbfad406f2494993757eee98b91bc244184a377520d06fc35

m=gmpy2.powmod(c,d,n)

print hex(m)[2:].decode('hex')

[GUET-CTF2019]re

elf,upx壳，脱壳后发现关键部分

 体力活

flag = []
flag.append(166163712/1629056)
flag.append(731332800/6771600)
flag.append(357245568/3682944)
flag.append(1074393000/10431000)
flag.append(489211344/3977328)
flag.append(518971936/5138336)
flag.append(406741500/7532250)
flag.append(294236496/5551632)
flag.append(177305856/3409728)
flag.append(650683500/13013670)
flag.append(298351053/6088797)
flag.append(386348487/7884663)
flag.append(438258597/8944053)
flag.append(249527520/5198490)
flag.append(445362764/4544518)
flag.append(981182160/10115280)
flag.append(174988800/3645600)
flag.append(493042704/9667504)
flag.append(257493600/5364450)
flag.append(767478780/13464540)
flag.append(312840624/5488432)
flag.append(1404511500/14479500)
flag.append(316139670/6451830)
flag.append(619005024/6252576)
flag.append(372641472/7763364)
flag.append(373693320/7327320)
flag.append(498266640/8741520)
flag.append(452465676/8871876)
flag.append(208422720/4086720)
flag.append(515592000/9374400)
flag.append(719890500/5759124)

for i in range(len(flag)):
    print(chr(int(flag[i])),end="")

print(len(flag))

注：这里少给了一位a[6]=1

[FlareOn4]login

emm,给了个网页，可看见关键代码为

 document.getElementById("prompt").onclick = function () {
                var flag = document.getElementById("flag").value;
                var rotFlag = flag.replace(/[a-zA-Z]/g, function(c){return String.fromCharCode((c <= "Z" ? 90 : 122) >= (c = c.charCodeAt(0) + 13) ? c : c - 26);});
                if ("PyvragFvqrYbtvafNerRnfl@syner-ba.pbz" == rotFlag) {
                    alert("Correct flag!");
                } else {
                    alert("Incorrect flag, rot again");
                }
            }
        

就是一个移13位的加密，按凯撒密码解就行，得到ClientSideLoginsAreEasy@flare-on.com

[GWCTF 2019]xxor

 输入6个数，在加密后在sub_400770进行验证

from z3 import*

f=Solver()
x=[Int('x%d'%i) for i in range(6)]

f.add(x[1] == 0x20CAACF4)
f.add(x[5] == 0x84F30420)
f.add(x[0] == 0xDF48EF7E)
f.add(x[2] - x[3] == 0x84A236FF)
f.add(x[3] + x[4] == 0xFA6CB703)
f.add(x[2] - x[4] == 0x42D731A8)


if f.check() == sat:
    for i in range(6):
        print(hex(f.model()[x[i]].as_long()))

得到加密后的数据

再看加密部分

 可以看出这应该是个魔改过的TEA

#include <stdint.h>
void decipher(unsigned int num_rounds, uint32_t v[2], uint32_t const key[4]) {
    unsigned int i;
    uint32_t v0=v[0], v1=v[1], delta=0x458BCD42, sum=delta*num_rounds;
    for (i=0; i < num_rounds; i++) {
        v1 -= (v0+sum+20)^((v0<<6)+key[2])^((v0>>9)+key[3])^0x10;
        v0 -= (v1+sum+11)^((v1<<6)+key[0])^((v1 >> 9)+key[1])^0x20;
        sum -= delta;
    }
    v[0]=v0; v[1]=v1;
}

int main()  {
    uint32_t v[3][2]={0xdf48ef7e,0x20caacf4,0xe0f30fd5,0x5c50d8d6,0x9e1bde2d,0x84f30420};
    uint32_t const k[4]={2,2,3,4};
    unsigned int r=64;
    for(int i=0;i<3;i++){
        decipher(r, v[i], k);
        printf("%u 解密后的数据：%x %x
",r,v[i][0],v[i][1]);
    }
    return 0;
}

再转为字符串

def hex_str(x):
    temp=''
    for i in range(len(x)//2):
        temp+=chr(int(x[2*i:2*i+2],16))
    return temp
a = ["666c61","677b72","655f69","735f67","726561","74217d"]
for i in range(6):
    print(hex_str(a[i]),end="")

得到flag

[ACTF新生赛2020]usualCrypt

改了表的base64

a="A B C D E F G H I J K L M N O P Q R S T U V W X Y Z a b c d e f g h i j k l m n o p q r s t u v w x y z 0 1 2 3 4 5 6 7 8 9 + /"
a=a.split()
for i in range(6,15):
    temp = a[i+10]
    a[i+10] = a[i]
    a[i] = temp

for i in range(len(a)):
    print(a[i],end="")

得到改后的表

此处又进行了大小写转换，将密文转换后求base64得到flag

[HDCTF2019]Maze

简单的迷宫题

*******+********* ******    ****   ******* **F******    **************
1111111211
1111111311
1111333311
1133311111
1131141111
1133331111
1111111111
//因为字体问题，改成了数字，由2开始到4结束，3为路1为墙

程序加了花，不能f5，不过也不需要，直接动调得到输入为wasd，走一遍得到flag

[BJDCTF2020]JustRE

搜索字符串

sprintf("bjd{%d%d2069a45792d233ac}",19999,0)

得到flag

[V&N2020 公开赛]strangeCpp

看字符串找到主函数，找到一段数据

插了一段数组，找到调用

 

不知道dword_7FF7B86F1190的值，在sub_7FF7B86E1384中

可根据result爆破得到dword_7FF7B86F1190

# -*- coding:utf-8 -*-
a=[0x26,0x2C,0x21,0x27,0x3B,0x0D,0x04,0x75,0x68,0x34,0x28,0x25,0x0E,0x35,0x2D,0x69,0x3D]

result=607052314
n=0
for i in range(14549743):
    v=(((i<<8)^(i>>12))*291)&0xffffffff
    n=i
    if(v==result):
        print(str(i))   
        break
for i in range(17):
    print(chr((a[i]^n)&0xff),end="")

得到

[ACTF新生赛2020]easyre

upx，脱壳后托入ida

逻辑十分简单，输入{}里作为索引替换表

# -*- coding:utf-8 -*-
table="~}|{zyxwvutsrqponmlkjihgfedcba`_^][ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;:9876543210/.-,+*)('&%$# !""
cmp="*F'"N,"(I?+@"
flag=""
print(len(cmp))
for i in range(len(cmp)):
    for j in range(len(table)):
        if(cmp[i]==table[j]):
            print(chr(j+1),end="")
            continue
#ACTF{U9X_1S_W6@T?}

 emmm所以他给的另一个文件是啥

[ACTF新生赛2020]rome

没啥可说的

a="Qsw3sj_lz4_Ujw@l"
for j in range(len(a)):  
    for i in range(48,123):
        if(i<90 and i>64):
            t=(i-51)%26+65
            if(ord(a[j])==t):
                print(chr(i),end="")
                break
        elif(i>96):
            t=(i-79)%26+97
            if(ord(a[j])==t):
                print(chr(i),end="")
                break
        else:
            if(i==ord(a[j])):
                print(chr(i),end="")
                break

[MRCTF2020]Transform

还是没啥可说的题，先换顺序再异或

a="67 79 7B 7F 75 2B 3C 52 53 79 57 5E 5D 42 7B 2D 2A 66 42 7E 4C 57 79 41 6B 7E 65 3C 5C 45 6F 62 4D"
b="09 0A 0F 17 07 18 0C 06 01 10 03 11 20 1D 0B 1E 1B 16 04 0D 13 14 15 02 19 05 1F 08 12 1A 1C 0E 00"
flag=[]
a=a.split()
b=b.split()
for i in range(len(a)):
    t="0x"+a[i]
    a[i]=eval(t)
    t="0x"+b[i]
    b[i]=eval(t)

for i in range(len(a)):
    a[i]=(a[i]^b[i])
for i in range(len(a)):
    flag.append(0)
for i in range(len(a)):
    flag[b[i]]=a[i]
for i in range(len(a)):
    print(chr(flag[i]),end="")

[MRCTF2020]Xor

依然没啥可说的，直接异或

a="MSAWB~FXZ:J:`tQJ"N@ bpdd}8g"

for i in range(len(a)):
    print(chr(ord(a[i])^i),end="")

[WUSTCTF2020]Cr0ssfun

没啥可说的，拼字符串

[WUSTCTF2020]level3

在init_array里base64换表，不过给了O_OLookAtYou就没什么意思了

[ACTF新生赛2020]Universe_final_answer

直接z3

from z3 import *

v1,v2,v3,v4,v5,v6,v7,v8,v9,v11=BitVecs('v1 v2 v3 v4 v5 v6 v7 v8 v9 v11',16)

f=Solver()
f.add(-85 * v9 + 58 * v8 + 97 * v6 + v7 + -45 * v5 + 84 * v4 + 95 * v2 - 20 * v1 + 12 * v3 == 12613)
f.add(30 * v11 + -70 * v9 + -122 * v6 + -81 * v7 + -66 * v5 + -115 * v4 + -41 * v3 + -86 * v1 - 15 * v2 - 30 * v8 == -54400)
f.add(-103 * v11 + 120 * v8 + 108 * v7 + 48 * v4 + -89 * v3 + 78 * v1 - 41 * v2 + 31 * v5 - (v6 << 6) - 120 * v9 == -10283)
f.add(71 * v6 + (v7 << 7) + 99 * v5 + -111 * v3 + 85 * v1 + 79 * v2 - 30 * v4 - 119 * v8 + 48 * v9 - 16 * v11 == 22855)
f.add(5 * v11 + 23 * v9 + 122 * v8 + -19 * v6 + 99 * v7 + -117 * v5 + -69 * v3 + 22 * v1 - 98 * v2 + 10 * v4 == -2944)
f.add(-54 * v11 + -23 * v8 + -82 * v3 + -85 * v2 + 124 * v1 - 11 * v4 - 8 * v5 - 60 * v7 + 95 * v6 + 100 * v9 == -2222)
f.add(-83 * v11 + -111 * v7 + -57 * v2 + 41 * v1 + 73 * v3 - 18 * v4 + 26 * v5 + 16 * v6 + 77 * v8 - 63 * v9 == -13258)
f.add(81 * v11 + -48 * v9 + 66 * v8 + -104 * v6 + -121 * v7 + 95 * v5 + 85 * v4 + 60 * v3 + -85 * v2 + 80 * v1 == -1559)
f.add(101 * v11 + -85 * v9 + 7 * v6 + 117 * v7 + -83 * v5 + -101 * v4 + 90 * v3 + -28 * v1 + 18 * v2 - v8 == 6308)
f.add(99 * v11 + -28 * v9 + 5 * v8 + 93 * v6 + -18 * v7 + -127 * v5 + 6 * v4 + -9 * v3 + -93 * v1 + 58 * v2 == -1697)

if f.check() == sat:
        print(f.model())