[FSCTF 2023]ezcode
...
给了395行的python字节码
大致这个逻辑:
def func1(message,key):
s_box = func2(key)
crypt = str(func3(message,s_box))
return crypt
pass
def func2():
s_box = []
pass
def func3():
pass
def encode(c):
s = "vwxrstuopq34567ABCDEFGHIJyz012PQRSTKLMNOZabcdUVWXYefghijklmn89+/"
return base64encode(c,s)
pass
flag = input("please input your flag:")
outputs = encode(func1(flag,"XFFTnT"))
if outputs!="ADkopgjJFP+28RYgXUxU2Oej":
print("think again")
else:
print("Success!")
注意到 ROT_TWO是交换栈顶两个元素
分析下感觉func2和func3就是RC4的init和加密
只是RC4加密处有修改
14 4 LOAD_CONST 1 ('FSCTF')
6 STORE_FAST 3 (y)
...
...
...
120 BINARY_XOR
122 LOAD_GLOBAL 2 (ord)
124 LOAD_FAST 3 (y)
126 LOAD_FAST 4 (i)
128 LOAD_GLOBAL 3 (len)
130 LOAD_FAST 3 (y)
132 CALL_FUNCTION 1
encode是一个变表base64
逐个逆回去解就行了
base64解得:
enc = [0x3d,0x2e,0x07,0x23,0x4d,0xd8,0x51,0xef,0x9d,0xf2,0x0c,0x74,0xc2,0xd0,0xad,0x76,0x7c,0xb7]
然后RC4变下形:
#include<bits/stdc++.h>
using namespace std;
signed main(){
int base64_table[] = {0x3d,0x2e,0x07,0x23,0x4d,0xd8,0x51,0xef,0x9d,0xf2,0x0c,0x74,0xc2,0xd0,0xad,0x76,0x7c,0xb7};
string key = "XFFTnT";
string key2="FSCTF";
int s[256],k[256];
int j=0;
for (int i = 0; i < 256; i++) {
s[i] = i;
k[i] = key[i % key.length()];
}
for (int i2 = 0; i2 < 256; i2++) {
j = (s[i2] + j + k[i2]) & 255;
int temp = s[i2];
s[i2] = s[j];
s[j] = temp;
}
int j2 = 0;
int i3 = 0;int cnt=0;
for (int i4 : base64_table) {
i3 = (i3 + 1) & 255;
j2 = (s[i3] + j2) & 255;
int temp2 = s[i3];
s[i3] = s[j2];
s[j2] = temp2;
int rnd = s[(s[i3] + s[j2]) & 255];
cout<<((char) (i4 ^ rnd^key2[++cnt%5]));
// cnt++;
}
}
flag:
FSCTF{G00d_j0b!!!}