WHUCTF-RE

原创已于 2025-04-10 02:13:27 修改 · 671 阅读

10 ·

本内容遵循CC 4.0 BY-SA版权协议

GEO检测

于 2025-03-31 00:15:36 首次发布

签到

-10

v31=[0] * 19
v31[0] = 112 
v31[1] = 118 
v31[2] = 107 
v31[3] = 113 
v31[4] = 133 
v31[5] = 118 
v31[6] = 111 
v31[7] = 126 
v31[8] = 49 
v31[9] = 125 
v31[10] = 105 
v31[11] = 124 
v31[12] = 111 
v31[13] = 128 
v31[14] = 111 
v31[15] = 124 
v31[16] = 125 
v31[17] = 111 
v31[18] = 135 
for i in range(19):
    print(chr(v31[i]-10),end='')

flag{let’s_reverse}

跳舞的小人

打开string窗口发现secret.png,跳转过去，找到写入的目录，找到图片，直接网站解密
WHUCTF{but_zero_is_start}

ezrust

打硬件断点动调看逻辑，先和key操作了一下，然后进入了一个函数，一眼异或，管他什么算法，把异或值调出来就得了。

unsigned char v14[42] = {18,47,59,23,3,-50,71,-88,93,-34,55,103,8};
unsigned char key[9] = "thisiskey";
unsigned char xor[42] = {0x8b, 0xb0 ,0xa6,0xb6, 0xaa ,0x6c,0xb1,0x42, 0xf9, 0x40, 0xc3 ,0x89, 0x96,0x8c, 0x02 ,0x29 ,0x56,0xfd,0xd4,0x74,0x62,0xec,0x40,0x75,0x5a,0x25,0xed,0xc5,0x7e,0xac,0xae,0x3b,0x64,0x55,0x6c,0x32,0x77,0xae,0x2c,0xba,0x51,0x50};
int main(){
    v14[1] = 47;
    v14[2] = 59;
    v14[3] = 23;
    v14[4] = 3;
    v14[5] = -50;
    v14[6] = 71;
    v14[7] = -88;
    v14[8] = 93;
    v14[9] = -34;
    v14[10] = 55;
    v14[11] = 103;
    v14[12] = 8;
    v14[13] = 87;
    v14[14] = -47;
    v14[15] = -61;
    v14[16] = -56;
    v14[17] = 91;
    v14[18] = 52;
    v14[19] = -125;
    v14[20] = -115;
    v14[21] = 61;
    v14[22] = -78;
    v14[23] = -98;
    v14[24] = -5;
    v14[25] = -51;
    v14[26] = 54;
    v14[27] = 15;
    v14[28] = -98;
    v14[29] = 66;
    v14[30] = 13;
    v14[31] = -53;
    v14[32] = -86;
    v14[33] = -11;
    v14[34] = -125;
    v14[35] = -108;
    v14[36] = -71;
    v14[37] = 9;
    v14[38] = -34;
    v14[39] = 107;
    v14[40] = -74;
    v14[41] = -53;
    for(int i=0;i<42;i++){
        v14[i] ^= xor[i];
        v14[i] += key[8-(i%9)];
        v14[i] ^= key[i%9];
        printf("%c",v14[i]);
    }
}

easyNT

打开发现跑不了也调不了，根据盘子提示猜出来转unicode再md5，长度<=4python爆，>=5的网站爆。

import hashlib
import string
from itertools import product

def brute_force_md5(target_md5, n):
    """
    遍历所有由n个字节的可打印字符组成的字符串，寻找与目标MD5匹配的字符串。
    
    :param target_md5: 目标MD5哈希值（16进制字符串）
    :param n: 字符串长度（字节数）
    :return: 匹配的字符串（如果找到），否则返回None
    """
    # 可打印字符集：包括数字、字母和常见符号
    printable_chars = string.printable[:-6]  # 去掉不可见字符（如换行符等）

    #print(f"开始暴力破解，目标MD5: {target_md5}, 字符串长度: {n}")
    #print(f"使用的字符集: {printable_chars}")

    # 遍历所有可能的n字节组合
    for candidate_tuple in product(printable_chars, repeat=n):
        # 将元组转换为字符串
        candidate_str = ''.join(candidate_tuple)
        
        # 计算候选字符串的MD5哈希值
        candidate_md5 = hashlib.md5(candidate_str.encode('utf-16-le')).hexdigest()
        
        # 检查是否匹配目标MD5
        if candidate_md5 == target_md5:
            print(f"find:{candidate_str}")
            return candidate_str

    print("none")
    return None

# 示例用法
if __name__ == "__main__":
    # 用户输入目标MD5和字符串长度
    # print("what".encode('utf-16-le'))
    target_md5 = "dfd7572d3b4a5b786de1328be0057577"
    n = 4
    
    # 执行暴力破解
    result = brute_force_md5(target_md5, n)
    if result:
        print(f"success:{result}")
    else:
        print("fail")

WHUCTF{Cl0se_S0urc3d_System_1s_N0t_SO_Ha3d}

天堂之门

给了hint之后搜了一下天堂之门，得知将关键代码patch到64位程序上即可。然后key变动了一下，可以在输入处或key处打硬件断点得到。

int main(){
    int j; // [rsp+Ch] [rbp-14h]
    unsigned int v5; // [rsp+10h] [rbp-10h]
    unsigned int v6; // [rsp+14h] [rbp-Ch]
    unsigned int v7; // [rsp+18h] [rbp-8h]
    unsigned int i;
    unsigned char a1[] = {
        0x7F, 0xC5, 0x15, 0xD9, 0x53, 0x54, 0x1F, 0x5C, 0x64, 0xA9, 
  0xA1, 0xE1, 0xA7, 0x3F, 0xDA, 0xE9, 0xAF, 0xBF, 0x49, 0x08, 
  0x10, 0x1D, 0x1B, 0x1C, 0x0F, 0xF1, 0xF4, 0xD2, 0xE2, 0xB1, 
  0xCB, 0xAA, 0x3B, 0x54, 0x37, 0xB4, 0xAA, 0xD3, 0x1A, 0xF9, 
  0xCC, 0x31, 0xFE, 0x19, 0x06, 0xF6, 0x0F, 0xC2, 0x2F, 0x85, 
  0x95, 0x90, 0xC6, 0x3C, 0xC9, 0xC7, 0xA8, 0xA1, 0x51, 0xE4, 
  0x84, 0x76, 0x8E, 0x29, 0xF8, 0xFC, 0xB3, 0xD9, 0x22, 0xD9, 
  0x06, 0x39, 0x8F, 0xC1, 0x54, 0xC7, 0x8D, 0xF7, 0x79, 0xEE
    };
    unsigned char a2[16] = {0x48, 0x65, 0x61, 0x76, 0x65, 0x6E, 0x5F, 0x74, 0x68, 0x65, 
        0x5F, 0x64, 0x6F, 0x6F, 0x6F, 0x72};
    for ( i = 0; ; i += 2 )
  {
    // result = i;
    if ( (int)i >= 20 )
      break;
    v7 = *(unsigned int *)(4 * (int)i + a1);
    v6 = *(unsigned int *)(4 * ((int)i + 1) + a1);
    v5 = -32 * 1640531527;
    for ( j = 0; j <= 31; ++j )
    {
      v6 -= (v7 + ((v7 >> 5) ^ (16 * v7))) ^ (*(unsigned int *)(4 * ((v5 >> 11) & 3) + a2) + v5);
      v5 += 1640531527;
      v7 -= (v6 + ((v6 >> 5) ^ (16 * v6))) ^ (*(unsigned int *)(4 * (v5 & 3) + a2) + v5);
    }
    *(unsigned int *)(4 * (int)i + a1) = v7;
    *(unsigned int *)(4 * ((int)i + 1) + a1) = v6;
  }
  for (int i=0;i<80;i++){
    printf("%c",a1[i]);
  }
  for (int i=0;i<16;i++){
    printf("%c",a2[i]);
  }
}

WHUCTF{haha_I’m_a_j0j0_fan_and_congr4tulations_that_u_open_the_d0or_0f_h3aVen!!}

login

账号直接调试apk得到:this_isss_keey!!
然后是最爱的so了。SM4，但是魔改了。好消息是可以逆转轮密钥解密，坏消息是居然程序偏偏用的是x86版本的，模拟器调不了，没有真机，没法通过调试直接patch得到结果，完蛋。
于是直接手撕，第一次手撕居然不是AES也不是DES，是SM4。将源代码从头到尾看了一遍（真的不熟），一晚上直接从入门到精通，然后把so里的代码copy下来，补上各种宏，以为改完密钥顺序就成了，结果不行，此时已经凌晨3点，我直接睡觉。
第二天上完天堂继续login，为了ak开始慢慢调试，发现生成的轮密钥和在加密过程中的不一样，怎么回事？IDA伪C乱用地址导致的，加密结果写着写着居然写进轮密钥地址空间里了，之后和mie同学了解到64位根本没有此问题，我是调试时看到源程序load的是32位才用的32位，真™倒霉。重新定义几个变量，终于解决。
就因为这个login，两天里绝望太多次了，但是到最后没有放弃，绝处逢生了。下面就是超绝又臭又长的wp。

#include <stdio.h>
#include <stdbool.h>
#include <string.h>
#include <windows.h>
#include <stdint.h> // For uint32_t and uint64_t
#define ROL(x,y)    ((x)<<(y) |    (x)>>(32-(y)))
// 提取第 1 字节 (最低有效字节)
#define BYTE3(val) ((uint8_t)(val & 0xFF))

// 提取第 2 字节
#define BYTE1(val) ((uint8_t)((val >> 8) & 0xFF))

// 提取第 3 字节
#define BYTE2(val) ((uint8_t)((val >> 16) & 0xFF))

// 提取第 4 字节 (最高有效字节)
#define BYTE3(val) ((uint8_t)((val >> 24) & 0xFF))
// 定义一个宏用于组合两个 32 位值到一个 64 位值
#define __PAIR64__(hi, lo) (((uint64_t)(hi) << 32) | (uint64_t)(lo))

#define LODWORD(x) ((DWORD)(x))                // 提取低 32 位
#define HIDWORD(x) ((DWORD)((x) >> 32)) 
unsigned int dword_530[32] =
{
  462358,
  472066610,
  943670862,
  1415275114,
  1886879366,
  -1936483678,
  -1464879426,
  -993275174,
  -521670922,
  -66909678,
  404694574,
  876298826,
  1347903078,
  1819507330,
  -2003855714,
  -1532251462,
  -1060647210,
  -589042958,
  -117504498,
  337322538,
  808926790,
  1280531042,
  1752135294,
  -2071227750,
  -1599623498,
  -1128019246,
  -656414994,
  -184876534,
  269950502,
  741554754,
  1213159006,
  1684763258
};
unsigned char byte_5B0[256] =
{
    0xD6, 0x90, 0xE9, 0xFE, 0xCC, 0xE1, 0x3D, 0xB7, 0x16, 0xB6, 
    0x14, 0xC2, 0x28, 0xFB, 0x2C, 0x05, 0x2B, 0x67, 0x9A, 0x76, 
    0x2A, 0xBE, 0x04, 0xC3, 0xAA, 0x44, 0x13, 0x26, 0x49, 0x86, 
    0x06, 0x99, 0x9C, 0x42, 0x50, 0xF4, 0x91, 0xEF, 0x98, 0x7A, 
    0x33, 0x54, 0x0B, 0x43, 0xED, 0xCF, 0xAC, 0x62, 0xE4, 0xB3, 
    0x1C, 0xA9, 0xC9, 0x08, 0xE8, 0x95, 0x80, 0xDF, 0x94, 0xFA, 
    0x75, 0x8F, 0x3F, 0xA6, 0x47, 0x07, 0xA7, 0xFC, 0xF3, 0x73, 
    0x17, 0xBA, 0x83, 0x59, 0x3C, 0x19, 0xE6, 0x85, 0x4F, 0xA8, 
    0x68, 0x6B, 0x81, 0xB2, 0x71, 0x64, 0xDA, 0x8B, 0xF8, 0xEB, 
    0x0F, 0x4B, 0x70, 0x56, 0x9D, 0x35, 0x1E, 0x24, 0x0E, 0x5E, 
    0x63, 0x58, 0xD1, 0xA2, 0x25, 0x22, 0x7C, 0x3B, 0x01, 0x21, 
    0x78, 0x87, 0xD4, 0x00, 0x46, 0x57, 0x9F, 0xD3, 0x27, 0x52, 
    0x4C, 0x36, 0x02, 0xE7, 0xA0, 0xC4, 0xC8, 0x9E, 0xEA, 0xBF, 
    0x8A, 0xD2, 0x40, 0xC7, 0x38, 0xB5, 0xA3, 0xF7, 0xF2, 0xCE, 
    0xF9, 0x61, 0x15, 0xA1, 0xE0, 0xAE, 0x5D, 0xA4, 0x9B, 0x34, 
    0x1A, 0x55, 0xAD, 0x93, 0x32, 0x30, 0xF5, 0x8C, 0xB1, 0xE3, 
    0x1D, 0xF6, 0xE2, 0x2E, 0x82, 0x66, 0xCA, 0x60, 0xC0, 0x29, 
    0x23, 0xAB, 0x0D, 0x53, 0x4E, 0x6F, 0xD5, 0xDB, 0x37, 0x45, 
    0xDE, 0xFD, 0x8E, 0x2F, 0x03, 0xFF, 0x6A, 0x72, 0x6D, 0x6C, 
    0x5B, 0x51, 0x8D, 0x1B, 0xAF, 0x92, 0xBB, 0xDD, 0xBC, 0x7F, 
    0x11, 0xD9, 0x5C, 0x41, 0x1F, 0x10, 0x5A, 0xD8, 0x0A, 0xC1, 
    0x31, 0x88, 0xA5, 0xCD, 0x7B, 0xBD, 0x2D, 0x74, 0xD0, 0x12, 
    0xB8, 0xE5, 0xB4, 0xB0, 0x89, 0x69, 0x97, 0x4A, 0x0C, 0x96, 
    0x77, 0x7E, 0x65, 0xB9, 0xF1, 0x09, 0xC5, 0x6E, 0xC6, 0x84, 
    0x18, 0xF0, 0x7D, 0xEC, 0x3A, 0xDC, 0x4D, 0x20, 0x79, 0xEE, 
    0x5F, 0x3E, 0xD7, 0xCB, 0x39, 0x48
};
unsigned long bswap32(unsigned long value) {
    return ((value & 0xFF000000) >> 24) |  // 移动最高字节到最低位置
           ((value & 0x00FF0000) >> 8)  |  // 移动次高字节到次低位置
           ((value & 0x0000FF00) << 8)  |  // 移动次低字节到次高位置
           ((value & 0x000000FF) << 24);   // 移动最低字节到最高位置
}
int main() {
    const char *v7; // r9
    const char *v8; // r11
    int v9; // r4
    int v10; // r0
    signed int v11; // r5
    unsigned int v12; // r2
    unsigned int v13; // r8
    size_t v14; // r4
    unsigned int v15; // r6
    size_t v16; // r9
    void *v17; // r10
    int v18; // r0
    int v19; // r10
    int v20; // r3
    unsigned int v21; // r12
    unsigned int v22; // r1
    int v23; // r6
    unsigned int v24; // r9
    unsigned __int8 *v25; // r2
    unsigned int v26; // r1
    unsigned int v27; // r0
    int v28; // r1
    unsigned int v29; // r3
    unsigned int v30; // r0
    int *v31; // r0
    unsigned char *v32; // r1
    unsigned int *v33; // r6
    unsigned int v34; // r9
    unsigned int v35; // lr
    int v36; // r5
    unsigned int v37; // r10
    int v38; // r3
    unsigned int v39; // r8
    unsigned __int8 *v40; // r12
    unsigned int v41; // r0
    unsigned int v42; // r5
    int v43; // r6
    int v44; // r2
    int v45; // r0
    unsigned int v46; // r6
    int v47; // r2
    unsigned int v48; // r4
    unsigned int v49; // r0
    int v50; // r1
    int *v51; // r0
    unsigned int v52; // r0
    int v53; // r3
    int v54; // r4
    unsigned int v55; // r6
    unsigned int v56; // r5
    unsigned int v57; // r0
    char *v58; // r8
    int v59; // r5
    char *v60; // r4
    int v61; // r4
    //_BOOL4 result; // r0
    size_t n; // [sp+4h] [bp-15Ch]
    const char *v64; // [sp+8h] [bp-158h]
    int v65; // [sp+10h] [bp-150h]
    //JNIEnv *v66; // [sp+14h] [bp-14Ch]
    int v67; // [sp+18h] [bp-148h]
    unsigned char *v68; // [sp+1Ch] [bp-144h]
    unsigned int *ptr; // [sp+20h] [bp-140h]
    unsigned char *v70; // [sp+24h] [bp-13Ch]
    unsigned int v71; // [sp+28h] [bp-138h]
    unsigned int *v72; // [sp+28h] [bp-138h]
    unsigned int v73; // [sp+2Ch] [bp-134h]
    int v74; // [sp+2Ch] [bp-134h]
    unsigned int v75[32]; // [sp+30h] [bp-130h]
    int v76[32]; // [sp+B0h] [bp-B0h] BYREF
    unsigned int v77; // [sp+130h] [bp-30h]
    int v78; // [sp+134h] [bp-2Ch]
    int v79; // [sp+138h] [bp-28h]
    unsigned int v80; // [sp+13Ch] [bp-24h]

  unsigned char enc[48] = {0x78, 0x2D, 0x69, 0xC1, 0x23, 0xCF, 0x20, 0xD7, 0xA6, 0x99, 
    0xB2, 0x01, 0x1F, 0x01, 0x04, 0x0F, 0xEB, 0x22, 0x4B, 0x4F, 
    0x9B, 0x62, 0x64, 0x86, 0xD9, 0x97, 0xBD, 0x12, 0xF6, 0x27, 
    0xE7, 0xBD, 0x53, 0x89, 0x89, 0xC4, 0x95, 0x2B, 0xBB, 0xE2, 
    0x0B, 0xA3, 0x98, 0x5E, 0x54, 0x6B, 0xBD, 0xFC};
  unsigned char key[16] = "this_isss_keey!!";
  v7 = key;
  v8 = (void *)enc;
  v9 = 16;
  v10 = 48;
  if ( v9 == 16 )
  {
    v11 = v10;
    v73 = *(unsigned int*)v7;
    v12 = *((unsigned int*)v7 + 1);
    v13 = *((unsigned int*)v7 + 2);
    v64 = v7;
    v14 = ((v11 + ((unsigned int)(v11 >> 31) >> 28)) & 0xFFFFFFF0) - v11 + 16;
    v15 = *((unsigned int*)v7 + 3);
    v16 = v14 + v10;
    v71 = v12;
    v17 = malloc(((v11 + ((unsigned int)(v11 >> 31) >> 28)) & 0xFFFFFFF0) + 16);
    memcpy(v17, v8, v11);
    //printf("v11:%d\n",v11);
    v18 = (int)v17 + v11;
    ptr = (unsigned int *)v17;
    n = v11;
    v19 = v16;
    memset((void *)v18, v14, (unsigned __int8)v14);
    v68 = malloc(v16);
    v20 = bswap32(v15) ^ 0xB27022DC;
    v21 = bswap32(v13) ^ 0x677D9197;
    v22 = bswap32(v71) ^ 0x56AA3350;
    v23 = 0;
    v76[3] = (v20);
    v76[2] = (v21);
    v76[1] = (v22);
    v76[0] = bswap32(v73) ^ 0xA3B1BAC6;
    do
    {
      v24 = v21;
      v21 = v20;
      v25 = byte_5B0;
      v26 = v22 ^ dword_530[v23] ^ v20 ^ v24;
      v27 = (byte_5B0[BYTE2(v26)] << 16) | (byte_5B0[BYTE3(v26)] << 24);
      v28 = byte_5B0[(unsigned __int8)v26] | (byte_5B0[BYTE1(v26)] << 8);
      v29 = v28 + v27;
      v30 = (((v28 + v27) << 13) | (v27 >> 19)) ^ ((v28 << 23) | ((v28 + v27) >> 9)) ^ v76[v23];
      v22 = v24;
      v20 = v29 ^ v30;
      // v75[v23++] = v20;
      v76[v23+4] = v20;

      v23++;
      // if(v23 % 4 == 3){
      //   printf("\n");
      // }
    }
    while ( v23 != 32 );
    // printf("v75:");
    // for(int i=0;i<32;i++){
    //   printf("%02x ",v75[i]);
    // }
    // printf("\nv76:");
    // for(int i=0;i<36;i++){
    //   printf("%02x ",v76[i]);
    // }

    if ( v19 >= 1 )
    {
      v32 = v68;
      v33 = ptr;
      do
      {
        v70 = v32;
        v34 = bswap32(v33[1]);
        v35 = bswap32(v33[2]);
        v74 = v19;
        v36 = bswap32(v33[3]);
        v37 = bswap32(*v33);
        v38 = 0;
        v72 = v33;
        // printf("明文:");
        // for(int i=0;i<4;i++){
        //   printf("%02x ",v33[i]);
        // }
        // printf("\n");
        unsigned int out[100] = {0};
        do
        {
          v39 = v34;
          v34 = v35;
          v35 = v36;
          v40 = v25;
          v41 = v76[35 - v38] ^ v36 ^ v34 ^ v39;
          //printf("tempkey:%x\n",v76[35 - v38]);
          v42 = v25[BYTE3(v41)];
          v43 = v25[BYTE2(v41)];
          v44 = BYTE1(v41);
          v45 = v40[(unsigned __int8)v41];
          v46 = (v43 << 16) | (v42 << 24);
          v47 = v45 | (v40[v44] << 8);
          v48 = v47 + v46;
          v49 = ((v45 << 24) | ((v47 + v46) >> 8)) ^ (((v47 + v46) << 10) | (v46 >> 22)) ^ ((v47 << 16) | HIWORD(v46)) ^ v37;
          v50 = (4 * (v47 + v46)) | (v42 >> 6);
          v25 = v40;
          v37 = v39;
          v36 = v49 ^ v50 ^ v48;
          out[v38++] = v36;
          // v51 = &v76[v38++];
          // v51[4] = v36;
        }
        while ( v38 != 32 );
        v52 = out[28];
        v53 = out[29];
        v54 = out[30];
        v55 = out[31];
        v19 = v74 - 16;
        v70[15] = v52;
        v70[3] = v55;
        v70[14] = BYTE1(v52);
        v56 = HIWORD(v52);
        v70[11] = v53;
        v70[12] = BYTE3(v52);
        v70[10] = BYTE1(v53);
        v70[9] = BYTE2(v53);
        v70[8] = BYTE3(v53);
        v70[6] = BYTE1(v54);
        v70[5] = BYTE2(v54);
        v70[4] = BYTE3(v54);
        v70[2] = BYTE1(v55);
        v70[1] = BYTE2(v55);
        v57 = BYTE3(v55);
        v70[7] = v54;
        v70[13] = v56;
        
        v33 = v72 + 4;
        *v70 = v57;
        if (v74 > 16) {
          for (int i = 0; i < 16; i++){
            printf("%c",v70[i]);
          }
        }
        v32 = v70 + 16;
      }
      while ( v74 > 16 );
    }
  }
}