攻防世界-逆向(Guess-the-Number、tt3441810、re4-unvm-me)

幻想成为ctf糕手的第五天Guess-the-Number使用反编译软件得到源码在your flag is:后面可以看到answer而ansewr是str_one和str_two异或得到的importjava.math.BigInteger;publicclassguess{staticStringXOR(String_str_one,String_str_two){BigIntegeri1newBigInteger(_str_one,16);BigIntegeri2newBigInteger(_str_two,16);BigIntegerresi1.xor(i2);Stringresultres.toString(16);returnresult;}publicstaticvoidmain(String[]args){intguess_numberfalse;intmy_num349763335;intmy_number1545686892;intflag345736730;if(args.length0){try{intguess_numberInteger.parseInt(args[0]);if(my_number/5guess_number){Stringstr_one4b64ca12ace755516c178f72d05d7061;Stringstr_twoecd44646cfe5994ebeb35bf922e25dba;intvar10000my_numflag;StringanswerXOR(str_one,str_two);System.out.println(your flag is: answer);}else{System.err.println(wrong guess!);System.exit(1);}}catch(NumberFormatExceptionvar8){System.err.println(please enter an integer \nexample: java -jar guess 12);System.exit(1);}}else{System.err.println(wrong guess!);intnum1000000;num;System.exit(1);}}}此时只需要使用python异或即可str_one4b64ca12ace755516c178f72d05d7061str_twoecd44646cfe5994ebeb35bf922e25dbai1int(str_one,16)i2int(str_two,16)xor_resulthex(i1^i2)[2:]print(xor_result)#a7b08c546302cc1fd2a4d48bf2bf2ddbtt3441810打开之后是一堆十六进制00400080 68 66 6C 00 00 48 BF 01 00 00 00 00 00 00 00 48 00400090 8D 34 24 48 BA 02 00 00 00 00 00 00 00 48 B8 01 004000A0 00 00 00 00 00 00 00 0F 05 68 61 67 00 00 48 BF 004000B0 01 00 00 00 00 00 00 00 48 8D 34 24 48 BA 02 00 004000C0 00 00 00 00 00 00 48 B8 01 00 00 00 00 00 00 00 004000D0 0F 05 68 7B 70 00 00 48 BF 01 00 00 00 00 00 00 004000E0 00 48 8D 34 24 48 BA 02 00 00 00 00 00 00 00 48 004000F0 B8 01 00 00 00 00 00 00 00 0F 05 68 6F 70 00 00 00400100 48 BF 01 00 00 00 00 00 00 00 48 8D 34 24 48 BA 00400110 02 00 00 00 00 00 00 00 48 B8 01 00 00 00 00 00 00400120 00 00 0F 05 68 70 6F 00 00 48 BF 01 00 00 00 00 00400130 00 00 00 48 8D 34 24 48 BA 02 00 00 00 00 00 00 00400140 00 48 B8 01 00 00 00 00 00 00 00 0F 05 68 70 72 00400150 00 00 48 BF 01 00 00 00 00 00 00 00 48 8D 34 24 00400160 48 BA 02 00 00 00 00 00 00 00 48 B8 01 00 00 00 00400170 00 00 00 00 0F 05 68 65 74 00 00 48 BF 01 00 00 00400180 00 00 00 00 00 48 8D 34 24 48 BA 02 00 00 00 00 00400190 00 00 00 48 B8 01 00 00 00 00 00 00 00 0F 05 68 004001A0 7D 0A 00 00 48 BF 01 00 00 00 00 00 00 00 48 8D 004001B0 34 24 48 BA 02 00 00 00 00 00 00 00 48 B8 01 00 004001C0 00 00 00 00 00 00 0F 05 48 31 FF 48 B8 3C 00 00 004001D0 00 00 00 00 00 0F 05使用python将内容提取出来最后可以得到flag{poppopret}但是需要提交poppopretre4-unvm-me使用在线工具pyc反编译得到# Source Generated with Decompyle# File: C:/Users/hello world/Desktop/re4-unvm-me.pyc (Python 2.7)importmd5 md5s[0x831DAA3C843BA8B087C895F0ED305CE7L,0x6722F7A07246C6AF20662B855846C2C8L,0x5F04850FEC81A27AB5FC98BEFA4EB40CL,0xECF8DCAC7503E63A6A3667C5FB94F610L,0xC0FD15AE2C3931BC1E140523AE934722L,0x569F606FD6DA5D612F10CFB95C0BDE6DL,0x68CB5A1CF54C078BF0E7E89584C1A4EL,#最前面需要补个00xC11E2CD82D1F9FBD7E4D6EE9581FF3BDL,0x1DF4C637D625313720F45706A48FF20FL,0x3122EF3A001AAECDB8DD9D843C029E06L,0xADB778A0F729293E7E0B19B96A4C5A61L,0x938C747C6A051B3E163EB802A325148EL,0x38543C5E820DD9403B57BEFF6020596DL]printCan you turn me back to python ? ...flagraw_input(well as you wish.. what is the flag: )iflen(flag)69:printnice tryexit()iflen(flag)%5!0:printnice tryexit()foriinrange(0,len(flag),5):sflag[i:i5]ifint(0xmd5.new(s).hexdigest(),16)!md5s[i/5]:printnice tryexit()continueprintCongratz now you have the flag一大串的md5是要我们输入之后以五个字符为一组进行加密结果要和md5s列表中的相等使用md5在线解密破解可以找出大部分的在使用md5在线解密找出剩下的就好了#ALEXCTF{dv5d4s2vj8nk43s8d8l6m1n5l67ds9v41n52nv37j481h3d28n4b6v3k}md5s[0x831DAA3C843BA8B087C895F0ED305CE7,#ALEXC0x6722F7A07246C6AF20662B855846C2C8,#TF{dv0x5F04850FEC81A27AB5FC98BEFA4EB40C,#5d4s20xECF8DCAC7503E63A6A3667C5FB94F610,#vj8nk0xC0FD15AE2C3931BC1E140523AE934722,#43s8d0x569F606FD6DA5D612F10CFB95C0BDE6D,#8l6m10x068CB5A1CF54C078BF0E7E89584C1A4E,#n5l670xC11E2CD82D1F9FBD7E4D6EE9581FF3BD,#ds9v40x1DF4C637D625313720F45706A48FF20F,#1n52n0x3122EF3A001AAECDB8DD9D843C029E06,#v37j40xADB778A0F729293E7E0B19B96A4C5A61,#81h3d0x938C747C6A051B3E163EB802A325148E,#28n4b0x38543C5E820DD9403B57BEFF6020596D,#6v3k}]