-
-
[原创]2019看雪CTF 晋级赛Q3 签到题：乱世鬼雄 by 心学
-
发表于:
2019-9-18 19:23
5827
-
[原创]2019看雪CTF 晋级赛Q3 签到题：乱世鬼雄 by 心学
这是一道简单的根据【
用户名
】和【序列号】校验是否符合要求。
其逻辑是：【用户名】与【序列号】异或后，计算MD5值，并与内置的16字节数据进行比较，相等则通过。
知道处理过程后，进行计算
KCTF对应的序列号是：8DA79EF3CED2B8FCCFB2BBB6CBEFBCE1
# -*- coding: UTF-8 -*-
import binascii
print('输入信息：')
username_Str = 'KCTF'
builtin_HexStr = 'C6E4CAB5CED2B8FCCFB2BBB6CBEFBCE1'
print('username:\t%s'%(username_Str))
print('builtinHex:\t%s'%(builtin_HexStr))
print('\n转换成字节流')
username_Bytes = str.encode(username_Str)
builtin_Bytes = binascii.unhexlify(builtin_HexStr)
print('username:\t%s'%(username_Bytes))
print('builtinHex:\t%s'%(builtin_Bytes))
print('\n转换成整数：小端获取')
username_hex = int.from_bytes(username_Bytes, byteorder = 'little')
builtin_Hex = int.from_bytes(builtin_Bytes, byteorder = 'little')
print('username:\t%02X'%(username_hex))
print('builtinHex:\t%02X'%(builtin_Hex))
print('\n异或操作：此结果是字节反转的。主要是为了进行异或操作的对齐')
xorAB = username_hex^builtin_Hex
print('xor：\t\t%02X'%(xorAB))
print('\n转换成字节流')
SN_Re_HexStr = '%02X'%(xorAB)
SN_Re_Bytes = binascii.unhexlify(SN_Re_HexStr)
print('序列号字节流:\t%s'%(SN_Re_Bytes))
print('\n转换成整数：小端获取')
SN = int.from_bytes(SN_Re_Bytes, byteorder = 'little')
print('序列号:\t\t%02X'%(SN))
#8DA79EF3CED2B8FCCFB2BBB6CBEFBCE1
# -*- coding: UTF-8 -*-
import binascii
print('输入信息：')
username_Str = 'KCTF'
builtin_HexStr = 'C6E4CAB5CED2B8FCCFB2BBB6CBEFBCE1'
print('username:\t%s'%(username_Str))
print('builtinHex:\t%s'%(builtin_HexStr))
print('\n转换成字节流')
username_Bytes = str.encode(username_Str)
builtin_Bytes = binascii.unhexlify(builtin_HexStr)
print('username:\t%s'%(username_Bytes))
print('builtinHex:\t%s'%(builtin_Bytes))
print('\n转换成整数：小端获取')
username_hex = int.from_bytes(username_Bytes, byteorder = 'little')
builtin_Hex = int.from_bytes(builtin_Bytes, byteorder = 'little')
print('username:\t%02X'%(username_hex))
print('builtinHex:\t%02X'%(builtin_Hex))
print('\n异或操作：此结果是字节反转的。主要是为了进行异或操作的对齐')
xorAB = username_hex^builtin_Hex
print('xor：\t\t%02X'%(xorAB))
print('\n转换成字节流')
SN_Re_HexStr = '%02X'%(xorAB)
SN_Re_Bytes = binascii.unhexlify(SN_Re_HexStr)
print('序列号字节流:\t%s'%(SN_Re_Bytes))
print('\n转换成整数：小端获取')
SN = int.from_bytes(SN_Re_Bytes, byteorder = 'little')
print('序列号:\t\t%02X'%(SN))
#8DA79EF3CED2B8FCCFB2BBB6CBEFBCE1
00000000 MyMD5 struc ; (sizeof=0x58, mappedto_60)
00000000 ; XREF: sub_8819D0/r
00000000 unkownUInt dd ? ; XREF: sub_8819D0+191/w
00000000 ; sub_8819D0+1DB/r ...
00000004 unkownInt dd ? ; XREF: sub_8819D0+19D/w
00000008 vectorOrMD5Value __m128i ? ; XREF: sub_8819D0+1A9/w
00000008 ; sub_8819D0+1B4/w ...
00000018 value __m128i ?
00000028 unkownM128I __m128i 3 dup(?)
00000058 MyMD5 ends
00000000 MyMD5 struc ; (sizeof=0x58, mappedto_60)
00000000 ; XREF: sub_8819D0/r
00000000 unkownUInt dd ? ; XREF: sub_8819D0+191/w
00000000 ; sub_8819D0+1DB/r ...
00000004 unkownInt dd ? ; XREF: sub_8819D0+19D/w
00000008 vectorOrMD5Value __m128i ? ; XREF: sub_8819D0+1A9/w
00000008 ; sub_8819D0+1B4/w ...
00000018 value __m128i ?
00000028 unkownM128I __m128i 3 dup(?)
00000058 MyMD5 ends
主函数是sub_8819D0()
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！
。
郝若宁
