首页
社区
课程
招聘
问答 CTF 排行榜 知识库 工具下载 看雪峰会 看雪商城 证书查询
  1. 看雪社区
  2. CTF对抗
    3. 发新帖
[原创]kctf2021 第二题
2021-5-12 11:48 4744

[原创]kctf2021 第二题

saidyou 活跃值
2021-5-12 11:48
4744

逻辑很简单。
图片描述
主要是存在一个二维数组，根据输入得flag来实现位移，最后需要数组所有数非0.

1
2
3
4
5
6
7
8
9
83, 0, 1, 0, 0, 1, 0, 0, 1, 1,
1, 1, 0, 0, 1, 0, 0, 1, 0, 0,
0, 0, 1, 0, 1, 1, 1, 1, 1, 0,
0, 1, 1, 0, 1, 0, 0, 1, 0, 0,
0, 0, 1, 0, 0, 1, 0, 0, 1, 1,
1, 1, 0, 1, 1, 1, 0, 1, 0, 1,
0, 0, 1, 1, 1, 1, 0, 1, 0, 1,
0, 1, 1, 0, 0, 1, 0, 1, 0, 1,
0, 0, 0, 1, 0, 0, 1, 1, 0, 0,

扣代码，爆破。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
char char_table[64]= "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ";
char hash_table[90] = {
    83, 0, 1, 0, 0, 1, 0, 0, 1, 1,
    1, 1, 0, 0, 1, 0, 0, 1, 0, 0,
    0, 0, 1, 0, 1, 1, 1, 1, 1, 0,
    0, 1, 1, 0, 1, 0, 0, 1, 0, 0,
    0, 0, 1, 0, 0, 1, 0, 0, 1, 1,
    1, 1, 0, 1, 1, 1, 0, 1, 0, 1,
    0, 0, 1, 1, 1, 1, 0, 1, 0, 1,
    0, 1, 1, 0, 0, 1, 0, 1, 0, 1,
    0, 0, 0, 1, 0, 0, 1, 1, 0, 0
};
char hash_table_bk[90] = {
    83, 0, 1, 0, 0, 1, 0, 0, 1, 1,
    1, 1, 0, 0, 1, 0, 0, 1, 0, 0,
    0, 0, 1, 0, 1, 1, 1, 1, 1, 0,
    0, 1, 1, 0, 1, 0, 0, 1, 0, 0,
    0, 0, 1, 0, 0, 1, 0, 0, 1, 1,
    1, 1, 0, 1, 1, 1, 0, 1, 0, 1,
    0, 0, 1, 1, 1, 1, 0, 1, 0, 1,
    0, 1, 1, 0, 0, 1, 0, 1, 0, 1,
    0, 0, 0, 1, 0, 0, 1, 1, 0, 0
};
 
 
int __cdecl main2(char* flag)
{
    char flag_ch; // al
    int flag_off=0; // esi
    int offset_in_char_table; // ecx
    int v7; // edx
    int v8; // eax
    unsigned int x1; // ecx
    int v10; // eax
    int is_even; // edx
    int v12; // eax
    char* v13; // eax
    char* v14; // eax
    int v15; // edx
    char* v16; // ecx
    int v17; // eax
    int v18; // eax
    int v19; // eax
    int v20; // [esp+1Ch] [ebp-60h]
    unsigned int y1; // [esp+20h] [ebp-5Ch]
    unsigned int v22; // [esp+24h] [ebp-58h]
    char v23; // [esp+2Bh] [ebp-51h]
    int v24; // [esp+2Ch] [ebp-50h]
 
 
    if (strlen(flag) <= 0x30)
    {
        flag_ch = flag[0];
        if (flag[0])
        {
            flag_off = 0;
            y1 = 0;
            v22 = 0;
            v24 = 36;
            v23 = char_table[0];
        LABEL_4:
            if (v24 > 0)
            {
                offset_in_char_table = 0;
                if (v23 == flag_ch)
                {
                LABEL_11:
                    v7 = (flag_off + offset_in_char_table / 6) % 6;
                    v8 = offset_in_char_table + flag_off;
                    x1 = v22;
                    v20 = v7;
                    v10 = 5 - v8 % 6;
                    for (is_even = 0; ; is_even = 1)
                    {
                        switch (v10)
                        {
                        case 1:
                            ++x1;
                            break;
                        case 2:
                            v17 = (y1++ & 1) == 0;
                            x1 += v17;
                            break;
                        case 3:
                            v12 = (y1++ & 1) != 0;
                            x1 -= v12;
                            break;
                        case 4:
                            --x1;
                            break;
                        case 5:
                            v19 = (y1-- & 1) != 0;
                            x1 -= v19;
                            break;
                        default:
                            v18 = (y1-- & 1) == 0;
                            x1 += v18;
                            break;
                        }
                        if (x1 > 9)
                            break;
                        if (y1 > 8)
                            break;
                        v13 = &hash_table[10 * y1 + x1];
                        if (*v13)
                            break;
                        *v13 = 1;
                        if (is_even == 1)
                        {
                            ++flag_off;
                            v22 = x1;
                            flag_ch = flag[flag_off];
                            if (flag_ch)
                                goto LABEL_4;
                            goto LABEL_19;
                        }
                        v10 = v20;
                    }
                }
                else
                {
                    while (v24 != ++offset_in_char_table)
                    {
                        if (char_table[offset_in_char_table] == flag_ch)
                            goto LABEL_11;
                    }
                }
            }
        }
        else
        {
        LABEL_19:
            //v14 = hash_table;
            //v15 = 0;
            //do
            //{
            //    v16 = v14 + 10;
            //    do
            //        v15 += *v14++ == 0;
            //    while (v16 != v14);
            //} while (&unk_4B70DA != (_UNKNOWN*)v16);
            //if (!v15)
            //{
            //    return v4;
            //}
            return flag_off;
        }
    }
    return flag_off;
}
 
 
 
 
 
void test2(char* flag,int pos) {
    char hash_table_tmp[90];
    memcpy(hash_table_tmp, hash_table, 90);
    for (int i = 0; i < strlen(char_table); i++) {
        flag[pos] = char_table[i];
        memcpy(hash_table, hash_table_bk, 90);
        int res = main2(flag);
        if (pos < res) {
            printf("%d %s\n", res, flag);
            test2(flag, pos + 1);
        }
        memcpy(hash_table, hash_table_tmp, 90);
    }
    flag[pos] = 0;
}
 
int main() {
    char flag[32] = "G1111111";
    test2(flag,0);
    int i = 0;
    return 0;
}

打印结果如下：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
1 G1111111
2 G9111111
3 G9011111
4 G90J1111
5 G90JO111
6 G90JOB11
7 G90JOB41
8 G90JOB4N
9 G90JOB4NG
10 G90JOB4NGB
11 G90JOB4NGB2
6 G90JOL
7 G90JOLK
8 G90JOLKO
9 G90JOLKOB
10 G90JOLKOBA
11 G90JOLKOBAE
12 G90JOLKOBAEB
13 G90JOLKOBAEBO
14 G90JOLKOBAEBOZ
6 G90JON
7 G90JONL
8 G90JONL2
2 GJ
3 GJ0
4 GJ0V
5 GJ0V4
6 GJ0V4L
7 GJ0V4LA
8 GJ0V4LA4
9 GJ0V4LA4V
10 GJ0V4LA4VK
11 GJ0V4LA4VKE
12 GJ0V4LA4VKEB
13 GJ0V4LA4VKEB4
14 GJ0V4LA4VKEB4N
15 GJ0V4LA4VKEB4NG
16 GJ0V4LA4VKEB4NGB
17 GJ0V4LA4VKEB4NGB2
18 GJ0V4LA4VKEB4NGB2L
19 GJ0V4LA4VKEB4NGB2LE
20 GJ0V4LA4VKEB4NGB2LEX
12 GJ0V4LA4VKEN
13 GJ0V4LA4VKENL
14 GJ0V4LA4VKENL2
12 GJ0V4LA4VKEV
13 GJ0V4LA4VKEVQ
14 GJ0V4LA4VKEVQZ
15 GJ0V4LA4VKEVQZS
16 GJ0V4LA4VKEVQZSV
17 GJ0V4LA4VKEVQZSVC
18 GJ0V4LA4VKEVQZSVCN
19 GJ0V4LA4VKEVQZSVCNG
20 GJ0V4LA4VKEVQZSVCNGJ
21 GJ0V4LA4VKEVQZSVCNGJ0
22 GJ0V4LA4VKEVQZSVCNGJ00
23 GJ0V4LA4VKEVQZSVCNGJ00N
2 GX
3 GX2
4 GX2J
5 GX2JO
6 GX2JON
7 GX2JONQ
8 GX2JONQ7
9 GX2JONQ77
10 GX2JONQ77O
8 GX2JONQJ
9 GX2JONQJ0
10 GX2JONQJ05
11 GX2JONQJ059
12 GX2JONQJ059Q
13 GX2JONQJ059QP
14 GX2JONQJ059QPZ
15 GX2JONQJ059QPZQ
16 GX2JONQJ059QPZQ9
17 GX2JONQJ059QPZQ9E
9 GX2JONQJG
10 GX2JONQJGB
11 GX2JONQJGBE

最后获取flag GJ0V4LA4VKEVQZSVCNGJ00N


[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课

收藏
点赞・2
打赏
分享
最新回复 (1)
ccfer
雪    币： 8188
活跃值： (4238)
能力值： ( LV15，RANK：2459 )
在线值：
发帖
回帖
粉丝
私信
ccfer 16 2021-5-12 12:34
2 楼
0
爆破我喜欢
游客
登录 | 注册 方可回帖
　回帖　 表情 雪币赚取及消费
高级回复
返回