[羊城杯 2020]login

思路：一个py编译的exe，需要解包，然后反编译成py文件

1.解包：python pyinstxtractor.py login.exe

提示：pyinstxtractor.py这玩意github 上很多，随便找

2.进入文件夹，然后进行login版本hex填充

用编辑工具010打开login和struct，进行对比，main前面缺少几个字节，我们直接将struct前面的几个字节复制到main上面去，再将login保存为pyc格式文件

3.uncompyle6 login.pyc

3.uncompyle6 login.pyc >> login.py

import sys
input1 = input('input something:')
if len(input1) != 14:print('Wrong length!')sys.exit()
else:code = []for i in range(13):code.append(ord(input1[i]) ^ ord(input1[(i + 1)]))code.append(ord(input1[13]))a1 = code[2]a2 = code[1]a3 = code[0]a4 = code[3]a5 = code[4]a6 = code[5]a7 = code[6]a8 = code[7]a9 = code[9]a10 = code[8]a11 = code[10]a12 = code[11]a13 = code[12]a14 = code[13]if (a1 * 88 + a2 * 67 + a3 * 65 - a4 * 5 + a5 * 43 + a6 * 89 + a7 * 25 + a8 * 13 - a9 * 36 + a10 * 15 + a11 * 11 + a12 * 47 - a13 * 60 + a14 * 29 == 22748) & (a1 * 89 + a2 * 7 + a3 * 12 - a4 * 25 + a5 * 41 + a6 * 23 + a7 * 20 - a8 * 66 + a9 * 31 + a10 * 8 + a11 * 2 - a12 * 41 - a13 * 39 + a14 * 17 == 7258) & (a1 * 28 + a2 * 35 + a3 * 16 - a4 * 65 + a5 * 53 + a6 * 39 + a7 * 27 + a8 * 15 - a9 * 33 + a10 * 13 + a11 * 101 + a12 * 90 - a13 * 34 + a14 * 23 == 26190) & (a1 * 23 + a2 * 34 + a3 * 35 - a4 * 59 + a5 * 49 + a6 * 81 + a7 * 25 + (a8 << 7) - a9 * 32 + a10 * 75 + a11 * 81 + a12 * 47 - a13 * 60 + a14 * 29 == 37136) & (a1 * 38 + a2 * 97 + a3 * 35 - a4 * 52 + a5 * 42 + a6 * 79 + a7 * 90 + a8 * 23 - a9 * 36 + a10 * 57 + a11 * 81 + a12 * 42 - a13 * 62 - a14 * 11 == 27915) & (a1 * 22 + a2 * 27 + a3 * 35 - a4 * 45 + a5 * 47 + a6 * 49 + a7 * 29 + a8 * 18 - a9 * 26 + a10 * 35 + a11 * 41 + a12 * 40 - a13 * 61 + a14 * 28 == 17298) & (a1 * 12 + a2 * 45 + a3 * 35 - a4 * 9 - a5 * 42 + a6 * 86 + a7 * 23 + a8 * 85 - a9 * 47 + a10 * 34 + a11 * 76 + a12 * 43 - a13 * 44 + a14 * 65 == 19875) & (a1 * 79 + a2 * 62 + a3 * 35 - a4 * 85 + a5 * 33 + a6 * 79 + a7 * 86 + a8 * 14 - a9 * 30 + a10 * 25 + a11 * 11 + a12 * 57 - a13 * 50 - a14 * 9 == 22784) & (a1 * 8 + a2 * 6 + a3 * 64 - a4 * 85 + a5 * 73 + a6 * 29 + a7 * 2 + a8 * 23 - a9 * 36 + a10 * 5 + a11 * 2 + a12 * 47 - a13 * 64 + a14 * 27 == 9710) & (a1 * 67 - a2 * 68 + a3 * 68 - a4 * 51 - a5 * 43 + a6 * 81 + a7 * 22 - a8 * 12 - a9 * 38 + a10 * 75 + a11 * 41 + a12 * 27 - a13 * 52 + a14 * 31 == 13376) & (a1 * 85 + a2 * 63 + a3 * 5 - a4 * 51 + a5 * 44 + a6 * 36 + a7 * 28 + a8 * 15 - a9 * 6 + a10 * 45 + a11 * 31 + a12 * 7 - a13 * 67 + a14 * 78 == 24065) & (a1 * 47 + a2 * 64 + a3 * 66 - a4 * 5 + a5 * 43 + a6 * 112 + a7 * 25 + a8 * 13 - a9 * 35 + a10 * 95 + a11 * 21 + a12 * 43 - a13 * 61 + a14 * 20 == 27687) & (a1 * 89 + a2 * 67 + a3 * 85 - a4 * 25 + a5 * 49 + a6 * 89 + a7 * 23 + a8 * 56 - a9 * 92 + a10 * 14 + a11 * 89 + a12 * 47 - a13 * 61 - a14 * 29 == 29250) & (a1 * 95 + a2 * 34 + a3 * 62 - a4 * 9 - a5 * 43 + a6 * 83 + a7 * 25 + a8 * 12 - a9 * 36 + a10 * 16 + a11 * 51 + a12 * 47 - a13 * 60 - a14 * 24 == 15317):print('flag is GWHT{md5(your_input)}')print('Congratulations and have fun!')else:print('Sorry,plz try again...')

z3约束

from z3 import *
def main():s=Solver()a1=Int('a1')a2=Int('a2')a3=Int('a3')a4=Int('a4')a5=Int('a5')a6=Int('a6')a7=Int('a7')a8=Int('a8')a9=Int('a9')a10=Int('a10')a11=Int('a11')a12=Int('a12')a13=Int('a13')a14=Int('a14')s.add(a1 * 88 + a2 * 67 + a3 * 65 - a4 * 5 + a5 * 43 + a6 * 89 + a7 * 25 + a8 * 13 - a9 * 36 + a10 * 15 + a11 * 11 + a12 * 47 - a13 * 60 + a14 * 29 == 22748)s.add(a1 * 89 + a2 * 7 + a3 * 12 - a4 * 25 + a5 * 41 + a6 * 23 + a7 * 20 - a8 * 66 + a9 * 31 + a10 * 8 + a11 * 2 - a12 * 41 - a13 * 39 + a14 * 17 == 7258)s.add(a1 * 28 + a2 * 35 + a3 * 16 - a4 * 65 + a5 * 53 + a6 * 39 + a7 * 27 + a8 * 15 - a9 * 33 + a10 * 13 + a11 * 101 + a12 * 90 - a13 * 34 + a14 * 23 == 26190)s.add(a1 * 23 + a2 * 34 + a3 * 35 - a4 * 59 + a5 * 49 + a6 * 81 + a7 * 25 + a8*128  - a9 * 32 + a10 * 75 + a11 * 81 + a12 * 47 - a13 * 60 + a14 * 29 == 37136)s.add(a1 * 38 + a2 * 97 + a3 * 35 - a4 * 52 + a5 * 42 + a6 * 79 + a7 * 90 + a8 * 23 - a9 * 36 + a10 * 57 + a11 * 81 + a12 * 42 - a13 * 62 - a14 * 11 == 27915)s.add(a1 * 22 + a2 * 27 + a3 * 35 - a4 * 45 + a5 * 47 + a6 * 49 + a7 * 29 + a8 * 18 - a9 * 26 + a10 * 35 + a11 * 41 + a12 * 40 - a13 * 61 + a14 * 28 == 17298)s.add(a1 * 12 + a2 * 45 + a3 * 35 - a4 * 9 - a5 * 42 + a6 * 86 + a7 * 23 + a8 * 85 - a9 * 47 + a10 * 34 + a11 * 76 + a12 * 43 - a13 * 44 + a14 * 65 == 19875)s.add(a1 * 79 + a2 * 62 + a3 * 35 - a4 * 85 + a5 * 33 + a6 * 79 + a7 * 86 + a8 * 14 - a9 * 30 + a10 * 25 + a11 * 11 + a12 * 57 - a13 * 50 - a14 * 9 == 22784)s.add(a1 * 8 + a2 * 6 + a3 * 64 - a4 * 85 + a5 * 73 + a6 * 29 + a7 * 2 + a8 * 23 - a9 * 36 + a10 * 5 + a11 * 2 + a12 * 47 - a13 * 64 + a14 * 27 == 9710)s.add(a1 * 67 - a2 * 68 + a3 * 68 - a4 * 51 - a5 * 43 + a6 * 81 + a7 * 22 - a8 * 12 - a9 * 38 + a10 * 75 + a11 * 41 + a12 * 27 - a13 * 52 + a14 * 31 == 13376)s.add(a1 * 85 + a2 * 63 + a3 * 5 - a4 * 51 + a5 * 44 + a6 * 36 + a7 * 28 + a8 * 15 - a9 * 6 + a10 * 45 + a11 * 31 + a12 * 7 - a13 * 67 + a14 * 78 == 24065)s.add(a1 * 47 + a2 * 64 + a3 * 66 - a4 * 5 + a5 * 43 + a6 * 112 + a7 * 25 + a8 * 13 - a9 * 35 + a10 * 95 + a11 * 21 + a12 * 43 - a13 * 61 + a14 * 20 == 27687)s.add(a1 * 89 + a2 * 67 + a3 * 85 - a4 * 25 + a5 * 49 + a6 * 89 + a7 * 23 + a8 * 56 - a9 * 92 + a10 * 14 + a11 * 89 + a12 * 47 - a13 * 61 - a14 * 29 == 29250)s.add(a1 * 95 + a2 * 34 + a3 * 62 - a4 * 9 - a5 * 43 + a6 * 83 + a7 * 25 + a8 * 12 - a9 * 36 + a10 * 16 + a11 * 51 + a12 * 47 - a13 * 60 - a14 * 24 == 15317)if s.check()==sat:print(s.model())code=[None]*14code[0]=10code[1]=24code[2]=119code[3]=7code[4]=104code[5]=43code[6]=28code[7]=91code[8]=108code[9]=52code[10]=88code[11]=74code[12]=88code[13]=33inputs=[None]*14inputs[13]=code[13]flag=""for i in range(12,-1,-1):inputs[i]=(code[i]^inputs[i+1])for i in range(14):flag+=chr(inputs[i])print(flag)if __name__=='__main__':main()

flag{58964088b637e50d3a22b9510c1d1ef8}

[SUCTF2019]hardcpp（angr去除控制流平坦化）

angr版本==8.19.4.5（版本不能太高

高呼夜影我滴神

pip uninstall angrpip install angr==8.19.4.5

下载反混淆脚本，执行以下代码

python deflat.py filename function_address(hex)

去除成功

对比

去除前

去除后

主函数

int __cdecl main(int argc, const char **argv, const char **envp)
{char v3; // alchar v4; // alchar v5; // alchar v6; // alchar v8; // alchar v9; // alchar v10; // alchar v11; // alchar v12[8]; // [rsp+A0h] [rbp-90h] BYREFchar v13[8]; // [rsp+A8h] [rbp-88h] BYREFchar v14[8]; // [rsp+B0h] [rbp-80h] BYREFchar v15[8]; // [rsp+B8h] [rbp-78h] BYREFchar v16[8]; // [rsp+C0h] [rbp-70h] BYREFchar v17[7]; // [rsp+C8h] [rbp-68h] BYREFchar v18; // [rsp+CFh] [rbp-61h]int v19; // [rsp+D0h] [rbp-60h]int v20; // [rsp+D4h] [rbp-5Ch]int v21; // [rsp+D8h] [rbp-58h]int v22; // [rsp+DCh] [rbp-54h]char s; // [rsp+E0h] [rbp-50h] BYREFchar v24[23]; // [rsp+E1h] [rbp-4Fh] BYREFchar v25[8]; // [rsp+F8h] [rbp-38h] BYREFchar v26[8]; // [rsp+100h] [rbp-30h] BYREFchar v27[8]; // [rsp+108h] [rbp-28h] BYREFchar v28[4]; // [rsp+110h] [rbp-20h] BYREFint v29; // [rsp+114h] [rbp-1Ch]const char **v30; // [rsp+118h] [rbp-18h]int v31; // [rsp+120h] [rbp-10h]int v32; // [rsp+124h] [rbp-Ch]int v33; // [rsp+128h] [rbp-8h]bool v34; // [rsp+12Eh] [rbp-2h]v32 = 0;v31 = argc;v30 = argv;v29 = time(0LL);puts("func(?)=\"01abfc750a0c942167651c40d088531d\"?");s = getchar();fgets(v24, 21, stdin);v22 = time(0LL);v21 = v22 - v29;v33 = v22 - v29;if ( y >= 10 && ((((_BYTE)x - 1) * (_BYTE)x) & 1) != 0 )goto LABEL_13;while ( 1 ){v20 = strlen(&s);v34 = v20 != 21;if ( y < 10 || ((((_BYTE)x - 1) * (_BYTE)x) & 1) == 0 )break;
LABEL_13:v20 = strlen(&s);}while ( 1 ){v19 = 1;if ( y < 10 || ((((_BYTE)x - 1) * (_BYTE)x) & 1) == 0 )break;v19 = 1;}while ( v19 < 21 ){if ( y >= 10 && ((((_BYTE)x - 1) * (_BYTE)x) & 1) != 0 ){v18 = v21 ^ *(&s + v19);v17[0] = main::$_0::operator()((__int64)v27, v18);// s[v19]v16[0] = main::$_1::operator()((__int64)v25, *(&s + v21 + v19 - 1));// s[v19-1]v8 = main::$_1::operator() const(char)::{lambda(int)#1}::operator()(v16, 7);// s[v19-1]%7v18 = main::$_0::operator() const(char)::{lambda(char)#1}::operator()((__int64)v17, v8);// s[v19]+v8v15[0] = main::$_2::operator()((__int64)v28, v18);v14[0] = main::$_2::operator()((__int64)v28, *(&s + v21 + v19 - 1));v9 = main::$_2::operator() const(char)::{lambda(char)#1}::operator()(v14, 18);// s[v19-1]^18v13[0] = main::$_3::operator()((__int64)v26, v9);v10 = main::$_3::operator() const(char)::{lambda(char)#1}::operator()(v13, 3);// s[v19-1]*3v12[0] = main::$_0::operator()((__int64)v27, v10);v11 = main::$_0::operator() const(char)::{lambda(char)#1}::operator()((__int64)v12, 2);// s[v19-1]+2v18 = main::$_2::operator() const(char)::{lambda(char)#1}::operator()(v15, v11);// s[v19]^s[v19-1]}do{v18 = v21 ^ *(&s + v19);v17[0] = main::$_0::operator()(v27, (unsigned int)v18);v16[0] = main::$_1::operator()(v25, (unsigned int)*(&s + v21 + v19 - 1));v3 = main::$_1::operator() const(char)::{lambda(int)#1}::operator()(v16, 7LL);v18 = main::$_0::operator() const(char)::{lambda(char)#1}::operator()(v17, (unsigned int)v3);v15[0] = main::$_2::operator()(v28, (unsigned int)v18);v14[0] = main::$_2::operator()(v28, (unsigned int)*(&s + v21 + v19 - 1));v4 = main::$_2::operator() const(char)::{lambda(char)#1}::operator()(v14, 18LL);v13[0] = main::$_3::operator()(v26, (unsigned int)v4);v5 = main::$_3::operator() const(char)::{lambda(char)#1}::operator()(v13, 3LL);v12[0] = main::$_0::operator()(v27, (unsigned int)v5);v6 = main::$_0::operator() const(char)::{lambda(char)#1}::operator()(v12, 2LL);v18 = main::$_2::operator() const(char)::{lambda(char)#1}::operator()(v15, (unsigned int)v6);}while ( enc[v19 - 1] != v18 );while ( y >= 10 && ((((_BYTE)x - 1) * (_BYTE)x) & 1) != 0 );++v19;}if ( y >= 10 && ((((_BYTE)x - 1) * (_BYTE)x) & 1) != 0 )goto LABEL_16;while ( 1 ){puts("You win");if ( y < 10 || ((((_BYTE)x - 1) * (_BYTE)x) & 1) == 0 )break;
LABEL_16:puts("You win");}return 0;
}

main:

[羊城杯 2020]login [SUCTF2019]hardcpp相关推荐

1. buuctf————[羊城杯 2020]login

   1.查壳. 无壳,64位.(当时还不知到PyInstaller ) 2.直接丢到IDA反编译.发现啥也没有. (连个提示性的字符串也没有,但运行是有input something.很迷.) 看了看大佬 ...

2. [羊城杯 2020]GMC

   [羊城杯 2020]GMC 题目 from Crypto.Util.number import getPrime,bytes_to_long,getRandomNBitInteger from sec ...

3. [羊城杯 2020]Power

   [羊城杯 2020]Power 题目 from Crypto.Util.number import * import gmpy2 from secret import flagp = getPrime ...

4. [羊城杯 2020]RRRRRRRSA

   [羊城杯 2020]RRRRRRRSA 题目 import hashlib import sympy from Crypto.Util.number import *flag = 'GWHT{**** ...

5. [羊城杯 2020]Bytecode [UTCTF2020]babymips

   文章目录 [羊城杯 2020]Bytecode 查看题目 python代码 注意点: BINARY_SUBTRACT 这个是减法 BINARY_SUBSCR 这个是索引 Z3约束脚本 注意点: 注意最 ...

6. [羊城杯 2020]逃离东南亚

   [羊城杯 2020]逃离东南亚 考点 复现过程 参考链接 考点 1.图片高度隐写 2.silenteye 3.空格与tab隐写 4.需要编程找到隐写内容并进行解码 复现过程 解压压缩包有三个压缩包文件 ...

7. [羊城杯2020]easyphp --- 伪协议的使用时机，---python上传.htaccess的利用 -- preg_match绕过

   目录: 一. 自己做: 二.学到的.不足: 三. 1. 利用.htaccess来设置文件自动包含 2. 绕过 \n 的过滤 3. 绕过stristr的过滤. 4. 绕过preg_match 2.思路二 ...

8. [羊城杯 2020]easyre

   用PE查壳 用ida打开找到main函数 int __cdecl main(int argc, const char **argv, const char **envp) {int v3; // ea ...

9. [羊城杯 2020] Web

   easycon 打开就是 扫出来个index.php 然后访问 提示eval post cmd,看来是post了个cmd可以执行命令 找到bbbbbbbbb.txt文件,用base64解码得到包含fl ...

最新文章

1. 数据可视化 | Matplotlib
2. 明明白白学C#第0章准备工作
3. 如何通过数据包套接字攻击Linux内核
4. Windows如何上传代码到Github
5. Socket编程实践(12) --UDP编程基础
6. （转）C#开发微信门户及应用(3)--文本消息和图文消息的应答
7. Vue列表搜索和排序---vue工作笔记0010
8. ajax的嵌套需要注意的问题
9. 计算机记录乐器声音的文件是,一、用计算机录音的过程.pptx
10. 四叶草社交平台——十天冲刺（7）
11. 【CentOS 7架构16】，限制user_agent#171226
12. js使用闭包循环为a标签正确添加事件
13. 星环大数据使用经验总结
14. Request header field x-token is not allowed by Access-Control-Allow-Headers in preflight response.
15. 聊聊UI的扁平化设计趋势与拟物化设计
16. 从0开始，如何设计一个社交电商产品
17. 赠人玫瑰，手有余香，分享五款黑科技软件
18. MapReduce强化实验
19. c语言yb,通达信逐笔委托标识（C、YB 、YS 、VS 、VB）等代表什么含义？
20. HBase MOB特性介绍

热门文章

1. it巨头的组织架构图
2. 分布式电源在潮流计算中的一些思考与总结
3. Matlab软件实现算法运算
4. 提高程序运行速度的方法
5. 迈思德物联网网关极简宣传页
6. WuThreat身份安全云-TVD每日漏洞情报-2023-05-19
7. php 微信红包支付开发文档,【微信支付】现金红包开发者文档
8. RV1126按键中断驱动和应用调试
9. DirectX12（D3D12）基础教程（七）——渲染到纹理、正交投影、UI渲染基础
10. abap中利用函数RV_READ_INVOICE_INDEX未开票信息（包括交货单、销售订单）