分析:

主验证函数：

void __cdecl check(char *username, unsigned int N_username, char *password, int N_password)
{
  char hash[16]; // [esp+4h] [ebp-70h]
  char output[32]; // [esp+14h] [ebp-60h]
  char pwd_decoded[32]; // [esp+34h] [ebp-40h]
  char ct1[32]; // [esp+54h] [ebp-20h]

  if ( N_username >= 3 && N_username <= 0x14 && N_password == 64 )
  {
    if ( format_check(password, 64, (int)pwd_decoded) != 32
      || (aes(pwd_decoded, 32, ct1, (int)g_key, 128, 0), rsa(ct1, 32, output), output[0])
      || output[1] != 2
      || output[15] )
    {
      printf(aBadSn);
    }
    else
    {
      hash_0(username, N_username, hash);
      if ( !memcmp(hash, &output[16], 0x10u) )
        printf(aCongratulation);
    }
  }
}

密文长度为16整数倍，key长度为16 ————> AES
65537 ————> rsa,N,E直接给出，factordb 分解后算出d
用的是openssl,bignum是大端存储的。。。
sha512+salt,md5+salt算username的hash，和rsa结果的高16字节比较

解决：

from Crypto.Cipher import AES
from Crypto.Util.number import inverse as inv
from hashlib import md5,sha512

username = 'KCTF'

N = 47722871591096725757997518891734102017424753321232253627204800066229728054329
P = 201522792635114097998567775554303915819
Q = 236811285547763449711675622888914229291
assert(P*Q==N)
e = 65537
d = inv(e,(P-1)*(Q-1))

key = b'H\x0bb\xc3\xac\xd6\xc8\xa3k\x18\xd9\xe9\x06\xcd\x90\xd2'
ci = AES.new(key,AES.MODE_ECB)

hashed_un = md5(sha512(username.encode()+b'\xde\xed\xbe\xef').digest()).digest()
hashed_un = md5(sha512(hashed_un+b'\xb9\x79\x37\x9e').digest()).digest()

assert(len(hashed_un)==16)
x = hashed_un.rjust(32,b'\x00')
x = list(x)
x[0]=0
x[1]=2
x[15]=0
x = bytes(x)
# print(x)

x = int(x.hex(),16)
# print(hex(x))
x = pow(x,d,N)
x = bytes.fromhex(hex(x)[2:].rjust(64,'0'))
ct = ci.encrypt(x)
print(ct.hex())

ef589f333382266883b13d8df4c6c4c2a786c2e7d9538e4a3d98e7b6cfcddce1

4h入门PHP代码审计之反序列化