2022DASCTF X SU 三月春季挑战赛 easyre
2022DASCTF X SU 三月春季挑战赛 easyre
前奏
查壳
查壳，asp壳，esp定律脱之，修复可以看我的上一篇文章
main函数
main函数的反汇编代码
int __cdecl main(int argc, const char **argv, const char **envp) { unsigned __int8 Dest[50]; // [esp+1Ch] [ebp-74h] BYREF char Str[50]; // [esp+4Eh] [ebp-42h] BYREF __time32_t Time; // [esp+80h] [ebp-10h] BYREF int v7; // [esp+84h] [ebp-Ch] int v8; // [esp+88h] [ebp-8h] struct tm *v9; // [esp+8Ch] [ebp-4h] sub_40DCF0(); time(&Time); v9 = gmtime(&Time); sub_47C7D0((int)&dword_487F00, Str); if ( strlen(Str) != 42 ) { sub_47BAB0((int)&dword_488140, aWrong); exit(0); } if ( Str[0] != 'D' || Str[1] != 'A' || Str[2] != 'S' || Str[3] != 'C' || Str[4] != 'T' || Str[5] != 'F' ) { sub_47BAB0((int)&dword_488140, aWrong); exit(0); } mbscpy(Dest, (const unsigned __int8 *)Str); v8 = v9->tm_year + 1900; v7 = 0; sub_4019BE(Str); sub_401771((char *)Dest); system(Command); return 0; } Str是我们的输入
sub_47BAB0是printf
sub_47C7D0是scanf
修复后的代码
int __cdecl main(int argc, const char **argv, const char **envp) { unsigned __int8 Dest[50]; // [esp+1Ch] [ebp-74h] BYREF char Str[50]; // [esp+4Eh] [ebp-42h] BYREF __time32_t Time; // [esp+80h] [ebp-10h] BYREF int v7; // [esp+84h] [ebp-Ch] int v8; // [esp+88h] [ebp-8h] struct tm *v9; // [esp+8Ch] [ebp-4h] sub_40DCF0(); time(&Time); v9 = gmtime(&Time); scanf(&dword_487F00, Str); if ( strlen(Str) != 42 ) { printf_0(&dword_488140, aWrong); exit(0); } if ( Str[0] != 'D' || Str[1] != 'A' || Str[2] != 'S' || Str[3] != 'C' || Str[4] != 'T' || Str[5] != 'F' ) { printf_0(&dword_488140, aWrong); exit(0); } mbscpy(Dest, Str); v8 = v9->tm_year + 1900; v7 = 0; sub_4019BE(Str); sub_401771(Dest); system(Command); return 0; } 可以分析得出，我们输入的内容需要首先满足Str[0] != 'D' || Str[1] != 'A' || Str[2] != 'S' || Str[3] != 'C' || Str[4] != 'T' || Str[5] != 'F' 和= 42这两个条件
所以可以我们可以构造如下的满足条件的输入
DASCTFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
然后根据代码，程序会进入下面两个函数
sub_4019BE(Str); sub_401771(Dest); sub_4019BE(Str)
代码
size_t __cdecl sub_4019BE(char *Str) { size_t result; // eax char v2[84]; // [esp+1Ch] [ebp-7Ch] BYREF char *v3; // [esp+70h] [ebp-28h] size_t Size; // [esp+74h] [ebp-24h] int v5; // [esp+78h] [ebp-20h] int v6; // [esp+7Ch] [ebp-1Ch] int v7; // [esp+84h] [ebp-14h] size_t v8; // [esp+88h] [ebp-10h] int i; // [esp+8Ch] [ebp-Ch] strcpy(&v2[59], 26St9k3bNYWAadAhJJjDCRVx); v5 = 0; v6 = 0; Size = 138 * strlen(Str) / 0x64 + 1; strcpy(v2, 123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz); v3 = malloc(Size); v8 = 0; memset(v3, 0, Size); while ( v8 < strlen(Str) ) { v7 = Str[v8]; for ( i = Size - 1; ; --i ) { v7 += v3[i] << 8; v3[i] = v7 % 58; v7 /= 58; if ( !v7 ) break; } for ( i = 0; !v3[i]; ++i ) ; ++v8; } for ( i = 0; !v3[i]; ++i ) ; while ( 1 ) { result = Size - 1; if ( (Size - 1) < i ) break; Str[i] = v2[v3[i]]; ++i; } return result; } 根据strcpy(v2, 123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz);这一段，可以发现是base58
对strcpy(&v2[59], 26St9k3bNYWAadAhJJjDCRVx);中的v2进行解码，可以发现是个fake flag
那就不管他，看sub_401771(Dest);
sub_401771(Dest)
代码
int __cdecl sub_401771(char *Str) { int v2[50]; // [esp+1Ch] [ebp-DCh] BYREF int v3; // [esp+E4h] [ebp-14h] int j; // [esp+E8h] [ebp-10h] int i; // [esp+ECh] [ebp-Ch] v3 = strlen(Str); sub_401500(); sub_40152B(); sub_401593(); sub_401619(Str, v3); for ( i = 0; i < v3; ++i ) byte_492A60[i] = (LOBYTE(dword_492940[i]) ^ Str[i]) + 71; memset(v2, 0, sizeof(v2)); v2[0] = -61; v2[1] = -128; v2[2] = -43; v2[3] = -14; v2[4] = -101; v2[5] = 48; v2[6] = 11; v2[7] = -76; v2[8] = 85; v2[9] = -34; v2[10] = 34; v2[11] = -125; v2[12] = 47; v2[13] = -105; v2[14] = -72; v2[15] = 32; v2[16] = 29; v2[17] = 116; v2[18] = -47; v2[19] = 1; v2[20] = 115; v2[21] = 26; v2[22] = -78; v2[23] = -56; v2[24] = -59; v2[25] = 116; v2[26] = -64; v2[27] = 91; v2[28] = -9; v2[29] = 15; v2[30] = -45; v2[31] = 1; v2[32] = 85; v2[33] = -78; v2[34] = -92; v2[35] = -82; v2[36] = 123; v2[37] = -84; v2[38] = 92; v2[39] = 86; v2[40] = -68; v2[41] = 35; for ( j = 0; j <= 41; ++j ) { if ( v2[j] != byte_492A60[j] ) exit(0); } return printf_0(&dword_488140, aRight); } 根据最后的
if ( v2[j] != byte_492A60[j] ) exit(0); 这个代码，倒推需要我们input的flag
可以知道需要我们输入的flag的验证逻辑是
flag = (byte_492A60[j]-71)^LOBYTE(dword_492940[i]) 根据byte_492A60[i] = (LOBYTE(dword_492940[i]) ^ Str[i]) + 71;这段代码，可以知道我们需要LOBYTE(dword_492940[i])的数值
这里我直接使用了动态分析（静态分析太麻烦）
动态调试
先输入我们上一把得到的过第一层校验的字符串DASCTFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
程序此时已经断在了我们需要的地方
此时我们就可以去拿dword_492940的值了
以BYTE的格式（因为前文有提示说是BYTE）
unsigned char dword_492940[171] = { 0x38, 0x00, 0x00, 0x00, 0x78, 0x00, 0x00, 0x00, 0xDD, 0x00, 0x00, 0x00, 0xE8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xAF, 0x00, 0x00, 0x00, 0xBF, 0x00, 0x00, 0x00, 0x3A, 0x00, 0x00, 0x00, 0x6B, 0x00, 0x00, 0x00, 0xFB, 0x00, 0x00, 0x00, 0xB8, 0x00, 0x00, 0x00, 0x0C, 0x00, 0x00, 0x00, 0x85, 0x00, 0x00, 0x00, 0x35, 0x00, 0x00, 0x00, 0x5C, 0x01, 0x00, 0x00, 0xAD, 0x00, 0x00, 0x00, 0xE6, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xE0, 0x00, 0x00, 0x00, 0x8A, 0x00, 0x00, 0x00, 0x1D, 0x00, 0x00, 0x00, 0xBD, 0x00, 0x00, 0x00, 0x46, 0x01, 0x00, 0x00, 0xD2, 0xFF, 0xFF, 0xFF, 0x2B, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x15, 0x00, 0x00, 0x00, 0x24, 0x00, 0x00, 0x00, 0xC6, 0x00, 0x00, 0x00, 0xAD, 0x00, 0x00, 0x00, 0xA1, 0x00, 0x00, 0x00, 0xC9, 0x00, 0x00, 0x00, 0x7B, 0x00, 0x00, 0x00, 0x12, 0x00, 0x00, 0x00, 0x28, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x72, 0x00, 0x00, 0x00, 0x3E, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0xA1, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; 因为LOBYTE(dword_492940[i])的要求，所以我们需要低字节
#include<stdio.h> int main(){ unsigned char dword_492940[171] = { 0x38, 0x00, 0x00, 0x00, 0x78, 0x00, 0x00, 0x00, 0xDD, 0x00, 0x00, 0x00, 0xE8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xAF, 0x00, 0x00, 0x00, 0xBF, 0x00, 0x00, 0x00, 0x3A, 0x00, 0x00, 0x00, 0x6B, 0x00, 0x00, 0x00, 0xFB, 0x00, 0x00, 0x00, 0xB8, 0x00, 0x00, 0x00, 0x0C, 0x00, 0x00, 0x00, 0x85, 0x00, 0x00, 0x00, 0x35, 0x00, 0x00, 0x00, 0x5C, 0x01, 0x00, 0x00, 0xAD, 0x00, 0x00, 0x00, 0xE6, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xE0, 0x00, 0x00, 0x00, 0x8A, 0x00, 0x00, 0x00, 0x1D, 0x00, 0x00, 0x00, 0xBD, 0x00, 0x00, 0x00, 0x46, 0x01, 0x00, 0x00, 0xD2, 0xFF, 0xFF, 0xFF, 0x2B, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x15, 0x00, 0x00, 0x00, 0x24, 0x00, 0x00, 0x00, 0xC6, 0x00, 0x00, 0x00, 0xAD, 0x00, 0x00, 0x00, 0xA1, 0x00, 0x00, 0x00, 0xC9, 0x00, 0x00, 0x00, 0x7B, 0x00, 0x00, 0x00, 0x12, 0x00, 0x00, 0x00, 0x28, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x72, 0x00, 0x00, 0x00, 0x3E, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0xA1 }; for(int i = 0;i < 171;i=i+4){ printf(%d,,dword_492940[i]); } } 输出
56,120,221,232,0,175,191,58,107,251,184,12,133,53,92,173,230,0,224,138,29,189,70,210,43,0,21,36,198,173,161,201,123,18,40,0,5,0,114,62,16,161,0 我们现在已知byte_492A60和LOBYTE(dword_492940[])
再加上flag的逻辑是
flag = (byte_492A60[i]-71)^LOBYTE(dword_492940[i]) 接下来就可以写逆向脚本了
#include<stdio.h> int main(){ int v1[43] = {56,120,221,232,0,175,191,58,107,251,184,12,133,53,92,173,230,0,224,138,29,189,70,210,43,0,21,36,198,173,161,201,123,18,40,0,5,0,114,62,16,161,43,0}; int v2[41]; v2[0] = -61; v2[1] = -128; v2[2] = -43; v2[3] = -14; v2[4] = -101; v2[5] = 48; v2[6] = 11; v2[7] = -76; v2[8] = 85; v2[9] = -34; v2[10] = 34; v2[11] = -125; v2[12] = 47; v2[13] = -105; v2[14] = -72; v2[15] = 32; v2[16] = 29; v2[17] = 116; v2[18] = -47; v2[19] = 1; v2[20] = 115; v2[21] = 26; v2[22] = -78; v2[23] = -56; v2[24] = -59; v2[25] = 116; v2[26] = -64; v2[27] = 91; v2[28] = -9; v2[29] = 15; v2[30] = -45; v2[31] = 1; v2[32] = 85; v2[33] = -78; v2[34] = -92; v2[35] = -82; v2[36] = 123; v2[37] = -84; v2[38] = 92; v2[39] = 86; v2[40] = -68; v2[41] = 35; char flag[42]; for (int i =0;i <43 ;i++) { flag[i] = (v2[i]-71)^v1[i]; printf(%c,flag[i]); } } 
DASCTF{Welc0me-t0-j01n-SU-l0ve-suyug1eg1e}