当前位置:网站首页>[buuctf.reverse] 159_[watevrCTF 2019]Watshell
[buuctf.reverse] 159_[watevrCTF 2019]Watshell
2022-07-06 04:43:00 【石氏是时试】
这个题应该叫c语言入门
__int64 __fastcall main(int a1, char **a2, char **a3)
{
int v4; // [rsp+Ch] [rbp-3A4h]
const char *nptr; // [rsp+18h] [rbp-398h]
char *s1; // [rsp+20h] [rbp-390h]
FILE *stream; // [rsp+28h] [rbp-388h]
char v8[32]; // [rsp+30h] [rbp-380h] BYREF
char v9[32]; // [rsp+50h] [rbp-360h] BYREF
__int64 v10[25]; // [rsp+70h] [rbp-340h] BYREF
char delim[2]; // [rsp+13Eh] [rbp-272h] BYREF
char v12[80]; // [rsp+140h] [rbp-270h] BYREF
char s[504]; // [rsp+190h] [rbp-220h] BYREF
unsigned __int64 v14; // [rsp+388h] [rbp-28h]
v14 = __readfsqword(0x28u);
signal(14, handler);
alarm(0x3Cu);
strcpy(delim, " ");
v4 = 0;
sub_13A5();
sub_157F();
puts("Welcome to watshell, we ofcourse use our own super secure cryptographic functions to ensure user privacy!");
printf("%s", "Command: ");
fflush(stdout);
fgets(s, 500, stdin);
strlen(s);
for ( nptr = strtok(s, delim); nptr && v4 != 25; nptr = strtok(0LL, delim) )// 空格分隔的数字
v10[v4++] = atol(nptr);
sub_EB7(v8, v9);
s1 = (char *)sub_11AF(v10, 8 * (v4 + 1), (__int64)(8 * (v4 + 1)) >> 63, v9);
if ( !strcmp(s1, "give_me_the_flag_please") )
{
stream = fopen("/home/ctf/flag.txt", "r");
if ( !stream )
printf("The file does not exist!");
fgets(v12, 74, stream);
printf("Alright, alright %s\n", v12);
fclose(stream);
}
free(s1);
return 0LL;
}
在main里边直接将输入用空格分开,然后转成整型。用了一个入门但不常用的函数strok,这个函数将空格(分隔符)的位置改为0并每次传回前一段的指针。
然后sub_EB7()看不明白,但由于没用到输入的内容,所以一定是个固定值,用gdb跟到这就能得到结果.
然后调用11AF进行加密,逐个对刚转出来的整数处理
for ( i = 0uLL; size >> 3 > i; i += 1uLL )
ptr[i] = sub_DC3(*(_QWORD *)(8 * i + a1), a4[2], *a4);// 加密 pow(n,0x71,0x8f)
sub_DC3也是入门级的算法:快速降幂法
__int64 __fastcall sub_DC3(__int64 a1, __int64 a2, __int64 a3)
{
__int64 result; // rax
__int64 v4; // [rsp+18h] [rbp-8h]
if ( a1 < 0 || a2 < 0 || a3 <= 0 )
exit(1);
v4 = a1 % a3;
if ( !a2 )
return 1LL;
if ( a2 == 1 )
return a1 % a3;
if ( (a2 & 1) == 0 )
return sub_DC3(v4 * v4 % a3, a2 / 2, a3) % a3;
result = a2 % 2;
if ( a2 % 2 == 1 )
return v4 * sub_DC3(v4, a2 - 1, a3) % a3;
return result;
}
程序加密方法很是明了:要求输入一串数字空格分隔,然后每个数字作Rsa加密(e:0x71,n:0x8f)得到字符串"give_me_the_flag_please" 然后后台就会将flag给出来。
麻雀虽小五脏俱全。
边栏推荐
- npm命令--安装依赖包--用法/详解
- Implementation of knowledge consolidation source code 1: epoll implementation of TCP server
- Quatre méthodes de redis pour dépanner les grandes clés sont nécessaires pour optimiser
- SQL注入漏洞(MSSQL注入)
- [detailed steps of FreeRTOS shift value for the first time]
- P2102 floor tile laying (DFS & greed)
- Introduction of several RS485 isolated communication schemes
- 二叉树基本知识和例题
- 程序员在互联网行业的地位 | 每日趣闻
- The value of two date types is subtracted and converted to seconds
猜你喜欢
Visio draws Tai Chi
Dry goods collection | Vulkan game engine video tutorial
ISP learning (2)
Sorting out the latest Android interview points in 2022 to help you easily win the offer - attached is the summary of Android intermediate and advanced interview questions in 2022
The value of two date types is subtracted and converted to seconds
View workflow
Case of Jiecode empowerment: professional training, technical support, and multiple measures to promote graduates to build smart campus completion system
Fuzzy -- basic application method of AFL
The ECU of 21 Audi q5l 45tfsi brushes is upgraded to master special adjustment, and the horsepower is safely and stably increased to 305 horsepower
English Vocabulary - life scene memory method
随机推荐
newton interpolation
MPLS experiment
[HBZ share] reasons for slow addition and deletion of ArrayList and fast query
Sorting out the latest Android interview points in 2022 to help you easily win the offer - attached is the summary of Android intermediate and advanced interview questions in 2022
acwing周赛58
CADD course learning (8) -- virtual screening of Compound Library
我想问一下 按照现在mysql-cdc的设计,全量阶段,如果某一个chunk的binlog回填阶段,
What should the project manager do if there is something wrong with team collaboration?
Ue5 small knowledge points to enable the setting of lumen
A blog to achieve embedded entry
The most detailed and comprehensive update content and all functions of guitar pro 8.0
[Yu Yue education] reference materials of complex variable function and integral transformation of Northwestern Polytechnic University
ORM aggregate query and native database operation
[HBZ sharing] how to locate slow queries in cloud database
RTP GB28181 文件测试工具
麥斯克電子IPO被終止:曾擬募資8億 河南資產是股東
2328. Number of incremental paths in the grid graph (memory search)
【HBZ分享】云数据库如何定位慢查询
内核判断i2c地址上是否挂载外设
ISP学习(2)