一道linux ctf入门题逆向。

whyida

下载地址:
https://www.52pojie.cn/forum.php ... &page=3#pid17643200
先用ida分析，main 函数入口。

[C] 纯文本查看 复制代码

int __cdecl main(int argc, const char **argv, const char **envp)
{
  int result; // eax
  __int64 v4; // [rsp+0h] [rbp-20h]
  __int64 v5; // [rsp+8h] [rbp-18h]
  __int16 v6; // [rsp+10h] [rbp-10h]
  int v7; // [rsp+14h] [rbp-Ch]
  int v8; // [rsp+18h] [rbp-8h]
  int i; // [rsp+1Ch] [rbp-4h]

  puts("welcome");
  v4 = 0x6D64616E696D6461LL;
  v5 = 0x3332313332316E69LL;
  v6 = 51;
  v8 = 0;
  for ( i = 0; i <= 16; ++i )
  {
    v7 = rand() % 255;
    if ( (unsigned int)check(v7, *((char *)&v4 + i), i) )
      ++v8;
  }
  if ( v8 == 17 )
    result = puts("good job,now you know what is flag!");
  else
    result = puts("wrong\ntry again!!!");
  return result;
}

check 函数

[C] 纯文本查看 复制代码

signed __int64 __fastcall check(unsigned int a1, unsigned int a2, int a3)
{
  int v4; // [rsp+10h] [rbp-50h]
  int v5; // [rsp+14h] [rbp-4Ch]
  int v6; // [rsp+18h] [rbp-48h]
  int v7; // [rsp+1Ch] [rbp-44h]
  int v8; // [rsp+20h] [rbp-40h]
  int v9; // [rsp+24h] [rbp-3Ch]
  int v10; // [rsp+28h] [rbp-38h]
  int v11; // [rsp+2Ch] [rbp-34h]
  int v12; // [rsp+30h] [rbp-30h]
  int v13; // [rsp+34h] [rbp-2Ch]
  int v14; // [rsp+38h] [rbp-28h]
  int v15; // [rsp+3Ch] [rbp-24h]
  int v16; // [rsp+40h] [rbp-20h]
  int v17; // [rsp+44h] [rbp-1Ch]
  int v18; // [rsp+48h] [rbp-18h]
  int v19; // [rsp+4Ch] [rbp-14h]
  int v20; // [rsp+50h] [rbp-10h]

  v4 = 7;
  v5 = 8;
  v6 = 12;
  v7 = 14;
  v8 = 21;
  v9 = 13;
  v10 = 13;
  v11 = 3;
  v12 = 28;
  v13 = 22;
  v14 = 110;
  v15 = 93;
  v16 = 64;
  v17 = 110;
  v18 = 93;
  v19 = 88;
  v20 = 78;
  if ( (a2 ^ a1) != *(&v4 + a3) )
    return 0LL;
  printf("%d,%d,%d\n", a1, a2, (unsigned int)*(&v4 + a3));
  putchar(a2 ^ a1);
  return 1LL;
}

关键代码

[C] 纯文本查看 复制代码

if ( (a2 ^ a1) != *(&v4 + a3) )

只要算出随机数就可得到flag
也就是a1=*(&v4 + a3) ^a2

[Python] 纯文本查看 复制代码

tmp=[7,8,12,14,21,13,13,3,28,22,110,93,64,110,93,88,78]
tmp2=[0x61, 0x64, 0x6d, 0x69, 0x6e, 0x61, 0x64, 0x6d,0x69,0x6E,0x31,0x32,0x33,0x31,0x32,0x33]
t=[]

for i in range(16):
        
    t= ((tmp[i])^(tmp2[i]))
        
    print(chr(t),end='')
    

感谢 Dispa1r 的提醒，修改一处错误。

whyida

9152pojie 发表于 2017-11-9 13:34
怎么一下跑到python了，，，，

linux中许多地方需要用python。

Dispa1r

zeromovie 发表于 2017-11-9 16:43
感谢楼主帮忙解题，问下tmp2是怎么得来的呢

tmp2楼主搞错了我感觉，【0x61, 0x64, 0x6d, 0x69, 0x6e, 0x61, 0x64, 0x6d,0x69,0x6E,0x31,0x32,0x33,0x31,0x32,0x33】，我感觉是这个，跑出来也没问题

李庆喜

膜拜 正在学python

9152pojie

怎么一下跑到python了，，，，

极地冷战

支持新人

MAXtoDEATH

楼上说支持新人的你看看lz比你高几权。。。

vv乐乐ai

赞赞赞赞赞赞赞赞赞赞赞赞

zeromovie

感谢楼主帮忙解题，问下tmp2是怎么得来的呢

whyida

zeromovie 发表于 2017-11-9 16:43
感谢楼主帮忙解题，问下tmp2是怎么得来的呢

主函数中：v4 = 0x6D64616E696D6461LL;在调试器中可以看到取字的完整过程。

亿联网络

kali 就很6了，楼主渗透会不会，发点教程