wp | re | 2020“巅峰极客”网络安全技能挑战赛

这是我加入战队后的第一次比赛，和几个很强的师傅一起参加，被带飞。(10:00-18:00 八小时)

逆向部分一共3个题，我出了前两个，最后一个题像是套娃，比赛结束都是0解。

第一个题：virus

是一个win32的逆向，没有任何防护，主函数也非常清晰。

 

简单分析，发现是一个迷宫题，一共4个迷宫，然后flag格式是{迷宫顺序}-{迷宫1走法}-{迷宫2走法}-{迷宫3走法}-{迷宫4走法}

上面就是check_flag函数分析的过程，反正直接上od动态调试把迷宫提出来就行了，如下：

1
| | | | | | | | | | | | | | | 00 00 00 00 00
| | | | | | | | | | | | | | | 00 00 00 00 00
| | | | | | | | | | | | | | | 00 00 00 00 00
| | s . . . . . . . . . | | | 00 00 00 00 00
| | | | | | | | | | | . | | | 00 00 00 00 00
| | d | | | | | | | | . | | | 00 00 00 00 00
| | . | | | | | | | | . | | | 00 00 00 00 00
| | . | | | | | | | | . | | | 00 00 00 00 00
| | . . . . . . . . . . | | | 00 00 00 00 00
| | | | | | | | | | | | | | | 00 00 00 00 00
dddddddddsssssaaaaaaaaawww - 26

| | | | | | | | | | | | | | | | | | | 00
| | s | | | | | | | | | | | | | d | | 00
| | . . | | | | | | | | | | | . . | | 00
| | | . . | | | | | | | | | . . | | | 00
| | | | . . | | | | | | | . . | | | | 00
| | | | | . . | | | | | . . | | | | | 00
| | | | | | . . | | | . . | | | | | | 00
| | | | | | | . . | . . | | | | | | | 00
| | | | | | | | . . . | | | | | | | | 00
| | | | | | | | | | | | | | | | | | | 00
sdsdsdsdsdsdsddwdwdwdwdwdwdw - 28

| | | | | | | | | | | | | | | 00 00 00 00 00
| | . . . . . . . . . s | | | 00 00 00 00 00
| | . | | | | | | | | | | | | 00 00 00 00 00
| | . | | | | | | | | | | | | 00 00 00 00 00
| | . | | | | | | | | | | | | 00 00 00 00 00
| | . | | | | | | | | | | | | 00 00 00 00 00
| | . | | | | | | | | | | | | 00 00 00 00 00
| | . | | | | | | | | | | | | 00 00 00 00 00
| | . . . . . . . . . d | | | 00 00 00 00 00
| | | | | | | | | | | | | | | 00 00 00 00 00
aaaaaaaaasssssssddddddddd - 25


| | | | | | | | | | | | | | | 00 00 00 00 00
| | | | | | | | | | | | | | | 00 00 00 00 00
| | | | | | | | | | | | | | | 00 00 00 00 00
| | | . . . . . . . . . . | | 00 00 00 00 00
| | | . | | | | | | | | . | | 00 00 00 00 00
| | | . | | | | | | | | . | | 00 00 00 00 00
| | | . | | | | | | | | . | | 00 00 00 00 00
| | | . | | | | | | | | . | | 00 00 00 00 00
| | | s | | | | | | | | d | | 00 00 00 00 00
| | | | | | | | | | | | | | | 00 00 00 00 00

wwwwwdddddddddsssss - 19

按main函数的要求整理一下就可以了。

第二个题是pyc的逆向题：

直接上uncompyle反编译，这里环境需要稍微注意要用2.7去弄，得到如下py文件：

# uncompyle6 version 3.7.4
# Python bytecode 2.7 (62211)
# Decompiled from: Python 2.7.12 (default, Jul 21 2020, 15:19:50) 
# [GCC 5.4.0 20160609]
# Embedded file name: test233_ol.py
# Compiled at: 2020-03-20 13:22:50
(lambda __g, __print: [ [ (lambda __after: [ (lambda __after: (__print('Error len!'), (exit(), __after())[1])[1] if len(input) != 87 else __after())(lambda : [ [ [ [ (lambda __after: (__print('Error fmt!'), (exit(0), __after())[1])[1] if fmt1 != 'flag{' or fmt2 != '}' else __after())(lambda : (d.append(context[0:9]), (d.append(context[9:18]), (d.append(context[18:27]), (d.append(context[27:36]), (d.append(context[36:45]), (d.append(context[45:54]), (d.append(context[54:63]), (d.append(context[63:72]), (d.append(context[72:81]), [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ (lambda __after: (__print('Error!'), (exit(), __after())[1])[1] if d[0][2] != '5' or d[0][3] != '3' else __after())(lambda : (lambda __after: (__print('Error!'), (exit(), __after())[1])[1] if d[1][0] != '8' or d[1][7] != '2' else __after())(lambda : (lambda __after: (__print('Error!'), (exit(), __after())[1])[1] if d[2][1] != '7' or d[2][4] != '1' or d[2][6] != '5' else __after())(lambda : (lambda __after: (__print('Error!'), (exit(), __after())[1])[1] if d[3][0] != '4' or d[3][5] != '5' or d[3][6] != '3' else __after())(lambda : (lambda __after: (__print('Error!'), (exit(), __after())[1])[1] if d[4][1] != '1' or d[4][4] != '7' or d[4][8] != '6' else __after())(lambda : (lambda __after: (__print('Error!'), (exit(), __after())[1])[1] if d[5][2] != '3' or d[5][3] != '2' or d[5][7] != '8' else __after())(lambda : (lambda __after: (__print('Error!'), (exit(), __after())[1])[1] if d[6][1] != '6' or d[6][3] != '5' or d[6][8] != '9' else __after())(lambda : (lambda __after: (__print('Error!'), (exit(), __after())[1])[1] if d[7][2] != '4' or d[7][7] != '3' else __after())(lambda : (lambda __after: (__print('Error!'), (exit(), __after())[1])[1] if d[8][5] != '9' or d[8][6] != '7' else __after())(lambda : (lambda __after: (__print('Error!'), (exit(), __after())[1])[1] if check(h1) != 45 or check(h2) != 45 or check(h3) != 45 or check(h4) != 45 or check(h5) != 45 or check(h6) != 45 or check(h7) != 45 or check(h8) != 45 or check(h9) != 45 else __after())(lambda : (lambda __after: (__print('Error!'), (exit(), __after())[1])[1] if check(l1) != 45 or check(l2) != 45 or check(l3) != 45 or check(l4) != 45 or check(l5) != 45 or check(l6) != 45 or check(l7) != 45 or check(l8) != 45 or check(l9) != 45 else __after())(lambda : (lambda __after: (__print('Error!'), (exit(), __after())[1])[1] if check(k1) != 45 or check(k2) != 45 or check(k3) != 45 or check(k4) != 45 or check(k5) != 45 or check(k6) != 45 or check(k7) != 45 or check(k8) != 45 or check(k9) != 45 else __after())(lambda : (lambda __after: (__print('Error!'), (exit(), __after())[1])[1] if check1(h1) != 1 or check1(h2) != 1 or check1(h3) != 1 or check1(h4) != 1 or check1(h5) != 1 or check1(h6) != 1 or check1(h7) != 1 or check1(h8) != 1 or check1(h9) != 1 else __after())(lambda : (lambda __after: (__print('Error!'), (exit(), __after())[1])[1] if check1(l1) != 1 or check1(l2) != 1 or check1(l3) != 1 or check1(l4) != 1 or check1(l5) != 1 or check1(l6) != 1 or check1(l7) != 1 or check1(l8) != 1 or check1(l9) != 1 else __after())(lambda : (lambda __after: (__print('Error!'), (exit(), __after())[1])[1] if check1(k1) != 1 or check1(k2) != 1 or check1(k3) != 1 or check1(k4) != 1 or check1(k5) != 1 or check1(k6) != 1 or check1(k7) != 1 or check1(k8) != 1 or check1(k9) != 1 else __after())(lambda : (__print('Yes! You got it!'), __after())[1]))))))))))))))) for __g['k9'] in [context[60] + context[61] + context[62] + context[69] + context[70] + context[71] + context[78] + context[79] + context[80]] ][0] for __g['k8'] in [context[57] + context[58] + context[59] + context[66] + context[67] + context[68] + context[75] + context[76] + context[77]] ][0] for __g['k7'] in [context[54] + context[55] + context[56] + context[63] + context[64] + context[65] + context[72] + context[73] + context[74]] ][0] for __g['k6'] in [context[33] + context[34] + context[35] + context[42] + context[43] + context[44] + context[51] + context[52] + context[53]] ][0] for __g['k5'] in [context[30] + context[31] + context[32] + context[39] + context[40] + context[41] + context[48] + context[49] + context[50]] ][0] for __g['k4'] in [context[27] + context[28] + context[29] + context[36] + context[37] + context[38] + context[45] + context[46] + context[47]] ][0] for __g['k3'] in [context[6] + context[7] + context[8] + context[15] + context[16] + context[17] + context[24] + context[25] + context[26]] ][0] for __g['k2'] in [context[3] + context[4] + context[5] + context[12] + context[13] + context[14] + context[21] + context[22] + context[23]] ][0] for __g['k1'] in [context[0] + context[1] + context[2] + context[9] + context[10] + context[11] + context[18] + context[19] + context[20]] ][0] for __g['l9'] in [context[8] + context[17] + context[26] + context[35] + context[44] + context[53] + context[62] + context[71] + context[80]] ][0] for __g['l8'] in [context[7] + context[16] + context[25] + context[34] + context[43] + context[52] + context[61] + context[70] + context[79]] ][0] for __g['l7'] in [context[6] + context[15] + context[24] + context[33] + context[42] + context[51] + context[60] + context[69] + context[78]] ][0] for __g['l6'] in [context[5] + context[14] + context[23] + context[32] + context[41] + context[50] + context[59] + context[68] + context[77]] ][0] for __g['l5'] in [context[4] + context[13] + context[22] + context[31] + context[40] + context[49] + context[58] + context[67] + context[76]] ][0] for __g['l4'] in [context[3] + context[12] + context[21] + context[30] + context[39] + context[48] + context[57] + context[66] + context[75]] ][0] for __g['l3'] in [context[2] + context[11] + context[20] + context[29] + context[38] + context[47] + context[56] + context[65] + context[74]] ][0] for __g['l2'] in [context[1] + context[10] + context[19] + context[28] + context[37] + context[46] + context[55] + context[64] + context[73]] ][0] for __g['l1'] in [context[0] + context[9] + context[18] + context[27] + context[36] + context[45] + context[54] + context[63] + context[72]] ][0] for __g['h9'] in [context[72:81]] ][0] for __g['h8'] in [context[63:72]] ][0] for __g['h7'] in [context[54:63]] ][0] for __g['h6'] in [context[45:54]] ][0] for __g['h5'] in [context[36:45]] ][0] for __g['h4'] in [context[27:36]] ][0] for __g['h3'] in [context[18:27]] ][0] for __g['h2'] in [context[9:18]] ][0] for __g['h1'] in [context[0:9]] ][0])[1])[1])[1])[1])[1])[1])[1])[1])[1]) for __g['d'] in [[]] ][0] for __g['context'] in [input[5:-1]] ][0] for __g['fmt2'] in [input[(-1)]] ][0] for __g['fmt1'] in [input[0:5]] ][0])
 for __g['input'] in [raw_input('Input your flag:')] ][0] if __name__ == '__main__' else __after())(lambda : None)
 for __g['check1'], check1.__name__ in [(lambda arg: (lambda __l: [ (lambda __after: 0 if len(list(set(__l['arg']))) != 9 else 1)(lambda : None) for __l['arg'] in [arg] ][0])({}), 'check1')] ][0]
 for __g['check'], check.__name__ in [(lambda arg: (lambda __l: [ sum(map(int, __l['arg'])) for __l['arg'] in [arg] ][0])({}), 'check')] ][0])(globals(), __import__('__builtin__', level=0).__dict__['print'])

仔细一点不难看出是9*9的约束条件，根据我的经验和这个矩阵的样子，不难判断出是数独：

flag{
     **53*****
     8******2*
     *7**1*5**
     4****53**
     *1**7***6
     **32***8*
     *6*5****9
     **4****3*
     *****97**
    }

直接找在线工具梭就完事儿了。

第三题实在是分析不出来了，花里胡哨，看的浑身难受。

总的来说，这次比赛见识了挺多，感谢一起参加的师傅们~