DASCTF 2023六月挑战赛 二进制专项 RE writeup

arr = [0x18, 0x57, 0x68, 0x64]

with open('COD101.bin', 'rb') as f:

    b = f.read()

b = bytearray(b)

for i in range(len(b)):

    b[i] = b[i] ^ arr[i % 4]

with open('COD_de.bin', 'wb') as f:

    f.write(b)

class RC4:

    def __init__(self, key) -> None:

        self.key = key

        self.S = 0

        self.__rc4_init__()

    def __rc4_init__(self):

        S = [i for i in range(256)]

        j = 0

        for i in range(256):

            j = (2 * j + S[i] + key[i % len(key)]) % 256

            S[i], S[j] = S[j], S[i]

        self.S = S

    def rc4_encrypt(self, plain) -> list:

        i = 0

        j = 0

        cipher = []

        cnt = 0

        for p in plain:

            p = (p + 256 - cnt % 0xd) % 256

            cnt += 1

            i = (i + j) % 256

            j = (j + self.S[i]) % 256

            self.S[i], self.S[j] = self.S[j], self.S[i]

            tmp = self.S[(self.S[i] + self.S[j] + j) % 256]

            k = p ^ tmp

            cipher.append(k)

        return cipher

key = [0x5D , 0x42 , 0x62 , 0x29 , 0x3, 0x36 , 0x47 , 0x41 , 0x15, 0x36]

data = [0xF7, 0x2E, 0x34, 0xF0, 0x72, 0xCF, 0x5E, 0x0A, 0xBB, 0xEC, 0xB1, 0x2B, 0x70, 0x88, 0x88, 0xED,

0x46, 0x38, 0xDB, 0xDA, 0x6C, 0xBD, 0xD4, 0x06, 0x77, 0xF2, 0xCF, 0x56, 0x88, 0xC6, 0x31, 0xD2,

0xB7, 0x5A, 0xC1, 0x42, 0xB0, 0xF4, 0x48, 0x37, 0xF5, 0x2C, 0xF5, 0x58]

rc4 = RC4(key)

plain = rc4.rc4_encrypt(data)

print(''.join(map(chr,plain)))

#!/usr/bin/env python

# visit https://tool.lu/pyc/ for more information

# Version: Python 3.11

import ctypes

from time import *

from ctypes import *

from ctypes import wintypes

from hashlib import md5

class _STARTUPINFO(Structure):

    _fields_ = [

        ('cb', c_ulong),

        ('lpReserved', c_char_p),

        ('lpDesktop', c_char_p),

        ('lpTitle', c_char_p),

        ('dwX', c_ulong),

        ('dwY', c_ulong),

        ('dwXSize', c_ulong),

        ('dwYSize', c_ulong),

        ('dwXCountChars', c_ulong),

        ('dwYCountChars', c_ulong),

        ('dwFillAttribute', c_ulong),

        ('dwFlags', c_ulong),

        ('wShowWindow', c_ushort),

        ('cbReserved2', c_ushort),

        ('lpReserved2', c_char_p),

        ('hStdInput', c_ulong),

        ('hStdOutput', c_ulong),

        ('hStdError', c_ulong)]

class _PROCESS_INFORMATION(Structure):

    _fields_ = [

        ('hProcess', c_void_p),

        ('hThread', c_void_p),

        ('dwProcessId', c_ulong),

        ('dwThreadId', c_ulong)]

StartupInfo = _STARTUPINFO()

ProcessInfo = _PROCESS_INFORMATION()

key1 = bytes(md5(b'bin1bin1bin1').hexdigest().encode())

file = open('bin1', 'rb').read()

arr = range(len(file))()

open('bin1', 'wb').write(bytes(arr))

sleep(0)

bet = ctypes.windll.kernel32.CreateProcessA(b'bin1', ctypes.c_int(0), ctypes.c_int(0), ctypes.c_int(0), ctypes.c_int(0), ctypes.c_int(0), ctypes.c_int(0), ctypes.c_int(0), byref(StartupInfo), byref(ProcessInfo))

ctypes.windll.kernel32.WaitForSingleObject(ctypes.c_int(ProcessInfo.hProcess), ctypes.c_int(-1))

open('bin1', 'wb').write(file)

import marshal, dis

f = open("ez_py.pyc", "rb").read()

code = marshal.loads(f[16:])			#这边从 16 位开始取因为是 python3 python2 从 8 位开始取

dis.dis(code)

Disassembly of <code object <listcomp> at 0x00000297CC7F8E70, file "ez_py.py", line 59>:

 59           0 RESUME                   0

              2 BUILD_LIST               0

              4 LOAD_FAST                0 (.0)

        >>    6 FOR_ITER                50 (to 108)

              8 STORE_FAST               1 (i)

             10 LOAD_GLOBAL              0 (key1)

             22 LOAD_FAST                1 (i)

             24 LOAD_GLOBAL              3 (NULL + len)

             36 LOAD_GLOBAL              0 (key1)

             48 PRECALL                  1

             52 CALL                     1

             62 BINARY_OP                6 (%)

             66 BINARY_SUBSCR

             76 LOAD_GLOBAL              4 (file)

             88 LOAD_FAST                1 (i)

             90 BINARY_SUBSCR

            100 BINARY_OP               12 (^)

            104 LIST_APPEND              2

            106 JUMP_BACKWARD           51 (to 6)

        >>  108 RETURN_VALUE

from hashlib import md5

key1 = bytes(md5(b'bin1bin1bin1').hexdigest().encode())

# print(key1)

file = open('bin1', 'rb').read()

arr = [key1[i % len(key1)] ^ file[i] for i in range(len(file))]

# open('bin1', 'wb').write(bytes(arr))

with open('bin1__','wb') as f:

    f.write(bytes(arr))

from hashlib import md5

key1 = bytes(md5(b'bin2bin2bin2').hexdigest().encode())

# print(key1)

file = open('bin2', 'rb').read()

arr = [key1[i % len(key1)] ^ file[i] for i in range(len(file))]

# open('bin1', 'wb').write(bytes(arr))

with open('bin2__','wb') as f:

    f.write(bytes(arr))

key = "enc_by_dasctf"

with open('cap.bin', 'rb') as f:

    s = bytearray(f.read())

for i in range(len(s)):

    s[i] ^= ord(key[(i+1) % len(key)])

with open('flag.bmp', 'wb') as f:

    f.write(s)

import gmpy2

from Crypto.Util.number import long_to_bytes

n = 0x1d884d54d21694ccd120f145c8344b729b301e782c69a8f3073325b9c5

p = 37636318457745167234140808130156739

q = 21154904887215748949280410616478423

c = 0xfad53ce897d2c26f8cad910417fbdd1f0f9a18f6c1748faca10299dc8

e = 0x10001

phi = (p - 1) * (q - 1)

d = gmpy2.invert(e, phi)

m = pow(c, d, n)

print(long_to_bytes(m))

# E@sy_RSA_enc7ypt

from Crypto.Cipher import AES

password = b'E@sy_RSA_enc7ypt'  # 秘钥必须为 16 字节或者 16 字节的倍数的字节型数据

iv = b'E@sy_RSA_enc7ypt'  # iv 偏移量，bytes 类型

with open('encrypted.bin','rb') as f:

    en_text = f.read()

aes = AES.new(password, AES.MODE_CBC, iv)  # CBC 模式下解密需要重新创建一个 aes 对象

de_text = aes.decrypt(en_text)

with open('decrypt.exe','wb') as f:

    f.write(de_text)