-
-
[原创]第十题 侠义双雄
-
发表于:
2018-12-19 21:40
3964
-
程序弹出的消息框标题是VBScript，所以猜测核心判断部分应该在脚本里
之后OD中搜索字符串发现了一段像是判断函数的js脚本，但是这段脚本好像并不完整，而且也被eval加密了
1 | eval(function(s,p,a,c,k,e,d){for(i=0;i<k.length;i++)k[i]=k[i].replace(s, '');e=function(c){eval(document.write(String.fromCharCode(13)));return(eval(c<a)?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)d[e(c)]=k[c]||e(c);k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c]);return p}('$$$','8 4() { 1 = 6.3.e.f; 9 (1 == "b") { 2("5!") } 7 { 2("g!<" + 1 + "> a d c 0 ;-)") }}',62,17,'GUID$$$@a$$$@alert$$$@all$$$@ckpswd$$$@congratulations$$$@document$$$@else$$$@function
|
通过反复下访问断点跟踪这段脚本
1 | eval(function(s,p,a,c,k,e,d){for(i=0;i<k.length;i++)k[i]=k[i].replace(s, '');e=function(c){eval(document.write(String.fromCharCode(13)));return(eval(c<a)?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)d[e(c)]=k[c]||e(c);k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c]);return p}('$$$','8 4() { 1 = 6.3.e.f; 9 (1 == "b") { 2("5!") } 7 { 2("g!<" + 1 + "> a d c 0 ;-)") }}',62,17,'GUID$$$@a$$$@alert$$$@all$$$@ckpswd$$$@congratulations$$$@document$$$@else$$$@function
|
通过反复下访问断点跟踪这段脚本
最后得到完整的html+js代码
1 2 | <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<script>eval(function(s,p,a,c,k,e,d){for(i=0;i<k.length;i++)k[i]=k[i].replace(s, '');e=function(c){eval(document.write(String.fromCharCode(13)));return(eval(c<a)?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)d[e(c)]=k[c]||e(c);k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c]);return p}('$$$','8 4() { 1 = 6.3.e.f; 9 (1 == "b") { 2("5!") } 7 { 2("g!<" + 1 + "> a d c 0 ;-)") }}',62,17,'GUID$$$@a$$$@alert$$$@all$$$@ckpswd$$$@congratulations$$$@document$$$@else$$$@function$$$@if$$$@is$$$@kanxueCTF2018bySimpower91$$$@my$$$@not$$$@pswd$$$@value$$$@wrong$$$'.split('@'),0,{}))</script>..CTF 2018®<script language="vbscript">..function alert(msg_str)..MsgBox msg_str,vbOKOnly + vbExclamation + vbApplicationModal,""..End Function..</script>..<center><br><br><br><input value="" id="pswd" size=39></input><br><br><br><input type=button value="checkMyFlag" onclick="ckpswd();"></center>
|
把中间的js放到浏览器里解密得到ckpswd()函数代码
1 2 | <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<script>eval(function(s,p,a,c,k,e,d){for(i=0;i<k.length;i++)k[i]=k[i].replace(s, '');e=function(c){eval(document.write(String.fromCharCode(13)));return(eval(c<a)?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)d[e(c)]=k[c]||e(c);k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c]);return p}('$$$','8 4() { 1 = 6.3.e.f; 9 (1 == "b") { 2("5!") } 7 { 2("g!<" + 1 + "> a d c 0 ;-)") }}',62,17,'GUID$$$@a$$$@alert$$$@all$$$@ckpswd$$$@congratulations$$$@document$$$@else$$$@function$$$@if$$$@is$$$@kanxueCTF2018bySimpower91$$$@my$$$@not$$$@pswd$$$@value$$$@wrong$$$'.split('@'),0,{}))</script>..CTF 2018®<script language="vbscript">..function alert(msg_str)..MsgBox msg_str,vbOKOnly + vbExclamation + vbApplicationModal,""..End Function..</script>..<center><br><br><br><input value="" id="pswd" size=39></input><br><br><br><input type=button value="checkMyFlag" onclick="ckpswd();"></center>
|
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
