-
-
ctf2018-第15题
-
发表于: 2018-7-14 13:46 2942
-
binwalk -e a9rootfs
ultraedit在文件夹中搜索your key, 定位到elf文件sh
argv[0] = v6; argv[1] = 0; while ( 1 ) { printf("please input your key:"); scanf("%100s", v6); len = strlen(v6); enc_112E0(v6, v9, len); dec_11198(v6, v7, len); x_bin2hex(v7, a1, len); if ( !strcmp(a1, "C1371DA51A9030079E21DCDC5B78E38563872139C13F6F") ) break; if ( !strcmp(a1, "2A20D1EE7374B49EE12BCB5809A19") ) { x_hex2bin(v10, "5B7B541D49541B0847551A16435D060D0A66", 18);// flag:you got it [ decrypt_string(v10, 18); puts(v10); } else if ( !strcmp(a1, "8D8A79E3749EBAO60E57D00A6A") ) { x_hex2bin(v10, "721D1D001745531A49591C0E4B52071A1679", 18);// your key is error decrypt_string(v10, 18); puts(v10); } else { if ( !strcmp(v6, "exit") ) { v2 = 0; goto LABEL_17; } x_hex2bin(v10, "721D1D001745531A49591C0E4B52071A1679", 18);// your key is error decrypt_string(v10, 18); puts(v10); } } x_hex2bin(v10, "5B7B541D49541B0847551A16435D060D0A66", 18);// flag:you got it [ decrypt_string(v10, 18); dec_11198(v9, v7, len); x_bin2hex(v7, v9, len); printf("%s%s%c\n", v10, v9, ']'); puts("you have a chance to exploit it: "); memset(v6, 0, 256u); read(0, v6, 256); for ( i = 0; v6[i]; ++i ) { if ( v6[i] == '\r' || v6[i] == '\n' ) v6[i] = 0; } v0 = strlen(v6); x_hex2bin(a1, v6, v0 >> 1); v1 = strlen(a1); decrypt_string(a1, v1); strcpy(v6, a1); execve("/bin/busybox", argv);
argv[0] = v6; argv[1] = 0; while ( 1 ) { printf("please input your key:"); scanf("%100s", v6); len = strlen(v6); enc_112E0(v6, v9, len); dec_11198(v6, v7, len); x_bin2hex(v7, a1, len); if ( !strcmp(a1, "C1371DA51A9030079E21DCDC5B78E38563872139C13F6F") ) break; if ( !strcmp(a1, "2A20D1EE7374B49EE12BCB5809A19") ) { x_hex2bin(v10, "5B7B541D49541B0847551A16435D060D0A66", 18);// flag:you got it [ decrypt_string(v10, 18); puts(v10); } else if ( !strcmp(a1, "8D8A79E3749EBAO60E57D00A6A") ) { x_hex2bin(v10, "721D1D001745531A49591C0E4B52071A1679", 18);// your key is error decrypt_string(v10, 18); puts(v10); } else { if ( !strcmp(v6, "exit") ) { v2 = 0; goto LABEL_17; } x_hex2bin(v10, "721D1D001745531A49591C0E4B52071A1679", 18);// your key is error decrypt_string(v10, 18); puts(v10); } } x_hex2bin(v10, "5B7B541D49541B0847551A16435D060D0A66", 18);// flag:you got it [ decrypt_string(v10, 18); dec_11198(v9, v7, len); x_bin2hex(v7, v9, len); printf("%s%s%c\n", v10, v9, ']'); puts("you have a chance to exploit it: "); memset(v6, 0, 256u); read(0, v6, 256); for ( i = 0; v6[i]; ++i ) { if ( v6[i] == '\r' || v6[i] == '\n' ) v6[i] = 0; } v0 = strlen(v6); x_hex2bin(a1, v6, v0 >> 1); v1 = strlen(a1); decrypt_string(a1, v1); strcpy(v6, a1); execve("/bin/busybox", argv);
[招生]科锐逆向工程师培训(2024年11月15日实地,远程教学同时开班, 第51期)
赞赏
他的文章
- KCTF2022春季赛 第三题 石像病毒 8855
- KCTF2022春季赛 第二题 末日邀请 16176
- KCTF2021秋季赛 第二题 迷失丛林 18803
- KCTF2020秋季赛 第十题 终焉之战 8861
- KCTF2020秋季赛 第九题 命悬一线 6462
看原图
赞赏
雪币:
留言: