0x01. 进入环境,下载附件
题目给出的是一个pyc我们反编译文件
uncompyle6 c2eebf52980f444684130672c821d789.pyc > test1.py
在相应的目录下找到反编译python文件test1.py。内容如下:
# uncompyle6 version 3.8.0 # Python bytecode 2.7 (62211) # Decompiled from: Python 3.8.8 (default, Apr 13 2021, 15:08:03) [MSC v.1916 64 bit (AMD64)] # Embedded file name: unvm_me.py # Compiled at: 2016-12-21 05:44:01 import md5 md5s = [ 174282896860968005525213562254350376167, 137092044126081477479435678296496849608, 26300127609096051658061491018211963916, 314989972419727999226545215739316729360, 256525866025901597224592941642385934114, 115141138810151571209618282728408211053, 8705973470942652577929336993839061582, 256697681645515528548061291580728800189, 39818552652170274340851144295913091599, 65313561977812018046200997898904313350, 230909080238053318105407334248228870753, 196125799557195268866757688147870815374, 74874145132345503095307276614727915885] print 'Can you turn me back to python ? ...' flag = raw_input('well as you wish.. what is the flag: ') if len(flag) > 69: print 'nice try' exit() if len(flag) % 5 != 0: print 'nice try' exit() for i in range(0, len(flag), 5): s = flag[i:i 5] if int('0x' m5.new(s).hexdigest(), 16) != md5s[(i / 5)]:
print 'nice try'
exit()
print 'Congratz now you have the flag'
# okay decompiling c2eebf52980f444684130672c821d789.pyc
0x02. 问题分析
观察上述代码,需要输入flag,其中flag需要满足:
- flag长度需要小于69
- flag需要整除5
- for循环中,flag每次取五位,转换成16进制后的字符形式,再转换成int数据,需要和对应次数的md5s值对应,最终会输出Congratz now you have the flag
要满足上述条件,我们暴力破解将会比较麻烦,直接尝试将上述给出的md5s整形数据转换成16进制再进行md5解密即可找到flag。先将给出的整形数据转换成16进制:
在线整型数据转16进制网址:https://tool.lu/hexconvert/
831daa3c843ba8b087c895f0ed305ce7
6722f7a07246c6af20662b855846c2c8
5f04850fec81a27ab5fc98befa4eb40c
ecf8dcac7503e63a6a3667c5fb94f610
c0fd15ae2c3931bc1e140523ae934722
569f606fd6da5d612f10cfb95c0bde6d
68cb5a1cf54c078bf0e7e89584c1a4e # 此条数据无法解密,少了一位,应该是出题人挖的坑,需要再首位补0,再进行解密
c11e2cd82d1f9fbd7e4d6ee9581ff3bd
1df4c637d625313720f45706a48ff20f
3122ef3a001aaecdb8dd9d843c029e06
adb778a0f729293e7e0b19b96a4c5a61
938c747c6a051b3e163eb802a325148e
38543c5e820dd9403b57beff6020596d
接着将其md5解密,在线md5解密网站:https://www.somd5.com/
ALEXC
TF{
dv
5d4s2
vj8nk
43s8d
8l6m1
n5l67
ds9v4
1n52n
v37j4
81h3d
28n4b
6v3k}
将其整理后,最终的答案为:ALEXCTF{dv5d4s2vj8nk43s8d8l6m1n5l67ds9v41n52nv37j481h3d28n4b6v3k}