-
-
[原创]2018看雪CTF第七题WP
-
发表于: 2018-8-2 12:26 2166
-
看了这么多位dalao的WP,写出了一份自己的爆破代码题目需要从:result[16]倒推二十次求出我们的Input[16]根据题设,有16个方程:cube[a][b][c] = d且这个64 * 64 * 64的立方体有一个很特殊的性质是:每一个64的方块都是 0 - 63 的不重复不遗漏的意味着,a,b,c,d四个数我们可以知三求一开始暴力:假设Input[16] = {x0,x1,……,x15}枚举x0,x1,根据cube数组以及result的结果,我们可以反向计算出来x2,即可以少爆破一个64的枚举这样算下来,需要爆破的就不是64 ^ 16,而是很少的几个值,剩下的值在数组中计算,再通过result检查即可代码如下:
#include <iostream> #include <stdio.h> using namespace std; typedef unsigned char u8; u8 cube[64][64][64]; u8 GetNumber1[64][64][64]; u8 GetNumber2[64][64][64]; u8 GetNumber3[64][64][64]; u8 result[16] = {0x14,0x22,0x1E,0x10,0x38,0x30,0x18,0x10,4,0x1A,0x24,8,2,0x26,0x38,0x2A}; void Print(int x){ printf("<%d>: ",x); for(int i = 0; i < 16; i++) printf("%02X ",result[i]); char *sz = "abcdefghijklmnopqrstuvwxyz+-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"; for(int i = 0; i < 16; i++) printf("%c",sz[result[i]]); puts(""); } void test(){ u8 x0,x1,x2,x3,x4,x5,x6,x7,x8,x9,x10,x11,x12,x13,x14,x15; for(x0 = 0; x0 < 64; x0++) for(x1 = 0; x1 < 64; x1++){ x2 = GetNumber3[x0][x1][result[0]]; for(x3 = 0; x3 < 64; x3++){ x4 = GetNumber2[x3][result[1]][x0]; for(x5 = 0; x5 < 64; x5++){ x6 = GetNumber2[x5][result[2]][x0]; if (x6 == GetNumber2[x4][result[4]][x1]){ x7 = GetNumber2[x5][result[3]][x1]; x8 = GetNumber1[result[5]][x2][x3]; x9 = GetNumber1[result[6]][x2][x4]; x10 = GetNumber2[x7][result[7]][x3]; x12 = GetNumber2[x8][result[8]][x5]; x15 = GetNumber1[result[13]][x9][x10]; x11 = GetNumber2[x15][result[14]][x12]; x14 = GetNumber2[x11][result[11]][x9]; x13 = GetNumber2[x11][result[9]][x6]; if (GetNumber1[result[10]][x13][x7] == x12 && GetNumber1[result[12]][x8][x10] == x14 && GetNumber1[result[15]][x13][x14] == x15){ result[0] = x0; result[1] = x1; result[2] = x2; result[3] = x3; result[4] = x4; result[5] = x5; result[6] = x6; result[7] = x7; result[8] = x8; result[9] = x9; result[10] = x10; result[11] = x11; result[12] = x12; result[13] = x13; result[14] = x14; result[15] = x15; return; } } } } } } int main(){ FILE *f = fopen("Escape.exe","rb"); fseek(f,0xe4f0,0); fread(cube,64*64*64,1,f); fclose(f); for(int i = 0; i < 64; i++) for(int j = 0; j < 64; j++) for(int k = 0; k < 64; k++){ GetNumber1[cube[i][j][k]][j][k] = i; GetNumber2[i][cube[i][j][k]][k] = j; GetNumber3[i][j][cube[i][j][k]] = k; } Print(0); for(int i = 1; i <= 0x500; i++){ test(); Print(i); } return 0; }
可以看到,每一轮就爆破了4个值,也就是说复杂度是64 ^ 4,一秒钟就可以运算出来
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课
最后于 2018-8-2 12:28
被pangpwn编辑
,原因:
赞赏
看原图
赞赏
雪币:
留言: