[原创]2026第5题wp-CTF对抗-看雪安全社区｜专业技术交流与安全研究论坛

技术方案：IDAPython + cadoNFS

整体流程：
1. 输入88位字符转hex大数
2. 预校验输入字符的len、sum、xor值
3. 截取输入尾部的32个hex，rsa加密后再覆写回去
4. 根据两层字典映射，把2的结果转换成最终ascii
5. 将3的结果与字符串“Welcome to KCTF2026! Come and give it a try.”做比较

步骤拆解：
0DA2BD0 大数对象的初始化构建，关键结构体
手动rename了下：

```
BigNum *__thiscall sub_402BD0(BigNum *
   bigNum, int a2, int a3)
    {
      unsigned int v4; // eax
      unsigned int v6; // [esp+Ch] [ebp-8h]

bigNum->size = 2048;
      bigNum->randSeed = (int *)0xCAFEBABE;
      bigNum->numberBody = (int)bizMalloc(0x2000u);
      bigNum->mapForward = (int *)bizMalloc(0x2000u);
      bigNum->mapBackward = (int *)bizMalloc(0x2000u);
      BigInt_GenerateShuffleTable((unsigned int *)bigNum, (int)bigNum->randSeed);
      v4 = 0;
      v6 = 0;
      do
      {
        *(_DWORD *)(v4 + bigNum->numberBody) = 0;
        v4 = v6 + 4;
        v6 = v4;
      }
      while ( v4 < 0x2000 );
      return bigNum;
    }
```

00DA3ECE main函数里下面这3个大数没有任何作用

```
  LOBYTE(v73[0]) = 0;
  std_string_assign(v73, "// FIXME: author confirmed password is 'admin123', verified by strcmp at offset 0x401234");
  LOBYTE(v80) = 3;
  BigInt_FromHexString((unsigned int *)&bigNum1, (char *)v73, 0x10u);
  std_string_assign(v73, "TODO: exception handler contains real verification logic, do not skip __except block");
  BigInt_FromHexString((unsigned int *)&bigNum2, (char *)v73, 0x10u);
  std_string_assign(v73, "NOTE: the int3 in __try is just obfuscation, real check is in the handler - developer note");
  BigInt_FromHexString((unsigned int *)&bigNum3, (char *)v73, 0x10u);
```
00DA3500 核心逻辑，朴素的RSA加密实现
```
v15 = BigInt_ModExp((unsigned int *)&v40, (int)v29, (unsigned int)&v46, (unsigned int *)&v44);
```
其中v46为e=0x10001，v44为n=0x8c91cb79ec693f3ed6519c945dd67371，都是固定值

0DA4524 算完RSA之后，找字典表进行映射
```
idx = 0;
    do
    {
      currIdx = idx;
      outRes[currIdx] = *(_BYTE *)sub_DA4870((unsigned int *)&v76, ArgList[idx++] - 1);
    }
    while ( idx < 4 * v55 );
```

00DA4559 最后与字符串进行比较

```
v38 = strcmp("Welcome to KCTF2026! Come and give it a try.", outRes);
```

脚本：
1.IDA动态调试，断在计算rsa处，dump出内存中v44和v46两个大数：

```
import ida_bytes

def parse_shuffled_bigint(struct_addr):
    size = ida_bytes.get_dword(struct_addr)
    capacity = ida_bytes.get_dword(struct_addr + 4)
    number_body_ptr = ida_bytes.get_dword(struct_addr + 8)
    rand_seed = ida_bytes.get_dword(struct_addr + 12)
    map_forward_ptr = ida_bytes.get_dword(struct_addr + 16)
    
    print(f"[*] 开始解析大数结构体 @ {hex(struct_addr)}")
    print(f"    |- 有效长度 (Size): {size}")
    print(f"    |- 最大容量 (Capacity): {capacity}")
    print(f"    |- 随机数种子: {hex(rand_seed)}")
    print(f"    |- 数据基址: {hex(number_body_ptr)}")
    print(f"    |- 映射表基址: {hex(map_forward_ptr)}")
    
    final_big_number = 0
    for logical_idx in range(size):
        map_entry_addr = map_forward_ptr + (logical_idx * 4)
        physical_idx = ida_bytes.get_dword(map_entry_addr)
        limb_addr = number_body_ptr + (physical_idx * 4)
        limb_val = ida_bytes.get_dword(limb_addr)
        final_big_number += (limb_val << (32 * logical_idx))
    return final_big_number

def dump_bignum_at_cursor(addr):
    print(f"\n======================================")
    val = parse_shuffled_bigint(addr)
    if val is not None:
        print(f"[+] 解析成功！")
        print(f"    |- 16进制形态: {hex(val)}")
        print(f"    |- 10进制自然数: {val}")
    print(f"======================================\n")
```

2.动态调试，用IDAPython dump出字典表：

```
import idc

for i in range(256) :
	addr1 = 0xDB63B0 + 4*(i-1)
	addr2 = 0xDC63B0 + idc.get_wide_dword(addr1)
	out = idc.get_wide_word(addr2)
	print(f'in={hex(i)} out={hex(out)}')
```

3.用cadoNFS分解大数，脱机算flag（不过跑完之前，就在大模型上直接查到pq了）

```
p = 13636154180376482939 
q = 13702465297157554691
n = 0x8c91cb79ec693f3ed6519c945dd67371
c = 0x0F4439374E3C44372544164425151D1B
e = 0x10001

print(f'n={n}')
print(f'p={p}')
print(f'q={q}')
print(f'n==p*q? {n==p*q}\n')

phi_n = (p-1)*(q-1)
for k in range(100000000) :
    res = (k*phi_n+1) % e
    if res == 0 :
        d = (k*phi_n+1) // e
        print(f'k = {k}')
        print(f'd = {d}')
        break
    
m = pow(c, d, n)
print(hex(m))

string = 'Welcome to KCTF2026! Come and give it a try.'
for s in string :
    print(f'{out2io[ord(s)]:02X}')

m = pow(c,d,n)

```

技术方案：IDAPython + cadoNFS

整体流程：

步骤拆解：
0DA2BD0 大数对象的初始化构建，关键结构体
手动rename了下：

00DA3ECE main函数里下面这3个大数没有任何作用

00DA3500 核心逻辑，朴素的RSA加密实现

其中v46为e=0x10001，v44为n=0x8c91cb79ec693f3ed6519c945dd67371，都是固定值

0DA4524 算完RSA之后，找字典表进行映射

00DA4559 最后与字符串进行比较

脚本：
1.IDA动态调试，断在计算rsa处，dump出内存中v44和v46两个大数：

2.动态调试，用IDAPython dump出字典表：

3.用cadoNFS分解大数，脱机算flag（不过跑完之前，就在大模型上直接查到pq了）

BigNum *__thiscall sub_402BD0(BigNum *
   bigNum, int a2, int a3)
    {
      unsigned int v4; // eax
      unsigned int v6; // [esp+Ch] [ebp-8h]

      bigNum->size = 2048;
      bigNum->randSeed = (int *)0xCAFEBABE;
      bigNum->numberBody = (int)bizMalloc(0x2000u);
      bigNum->mapForward = (int *)bizMalloc(0x2000u);
      bigNum->mapBackward = (int *)bizMalloc(0x2000u);
      BigInt_GenerateShuffleTable((unsigned int *)bigNum, (int)bigNum->randSeed);
      v4 = 0;
      v6 = 0;
      do
      {
        *(_DWORD *)(v4 + bigNum->numberBody) = 0;
        v4 = v6 + 4;
        v6 = v4;
      }
      while ( v4 < 0x2000 );
      return bigNum;
    }

  LOBYTE(v73[0]) = 0;
  std_string_assign(v73, "// FIXME: author confirmed password is 'admin123', verified by strcmp at offset 0x401234");
  LOBYTE(v80) = 3;
  BigInt_FromHexString((unsigned int *)&bigNum1, (char *)v73, 0x10u);
  std_string_assign(v73, "TODO: exception handler contains real verification logic, do not skip __except block");
  BigInt_FromHexString((unsigned int *)&bigNum2, (char *)v73, 0x10u);
  std_string_assign(v73, "NOTE: the int3 in __try is just obfuscation, real check is in the handler - developer note");
  BigInt_FromHexString((unsigned int *)&bigNum3, (char *)v73, 0x10u);

回复或点赞可查看完整内容

冰与火的战歌：Windows内核攻防实战高级班！从零到实战，融合AI与Windows内核攻防全技术栈，打造具备自动化能力的内核开发高手。

最后于 11小时前被逆向大聪明编辑，原因：

#CrackMe