[Reverse] CRASH - Cew xp0int Posted on Apr 29 2021 https://bitbucket.org/renorobert/core2elf/src/master/,用core2elf从crash还原elf文件。elf给了8个md5，每个md5都是4个字符的hash值，最后爆破出这8*4个字符再异或0x17就为flag。 ``` #coding=utf-8 from hashlib import md5 import string cmp = ["bf2b36d56f5757c13cad80494b385e78", "3fe9dbae5dc4408350500affa20074aa", "1fa6770eca6b57e47a042ffe52eca8ff", "1aad6b7da1122b4b5a53bf5a4d3b11b0", "e7b77d9e0ab19fc9ea98154f994fccc5", "75d9128cfeb61b8949664f6a067f6469", "d8b0a52c64d6075017b7346140550c46", "306529c7cdedfb06e27b39f7b2babf4d"] dic = string.ascii_letters + string.digits dic = list(dic.encode()) for a in dic: for b in dic: for c in dic: for d in dic: s = [a, b, c, d] s = [_ ^ 0x17 for _ in s] res = md5(bytes(s)).hexdigest() if res in cmp: print(res, bytes(s)) ''' 结果 1aad6b7da1122b4b5a53bf5a4d3b11b0 b'v\x7fut' d8b0a52c64d6075017b7346140550c46 b's.v|' 1fa6770eca6b57e47a042ffe52eca8ff b'~{c|' 75d9128cfeb61b8949664f6a067f6469 b"y|''" 306529c7cdedfb06e27b39f7b2babf4d b'gg `' bf2b36d56f5757c13cad80494b385e78 b'bo&t' 3fe9dbae5dc4408350500affa20074aa b'n&o#' e7b77d9e0ab19fc9ea98154f994fccc5 b'.yb&' ''' # 组合还原 s = list(b"bo&tn&o#~{c|v\x7fut.yb&y|''s.v|gg `") s = [_ ^ 0x17 for _ in s] print(bytes(s)) # b'ux1cy1x4iltkahbc9nu1nk00d9akpp7w' ``` flag{ux1cy1x4iltkahbc9nu1nk00d9akpp7w} 打赏还是打残，这是个问题 赏 Wechat Pay Alipay [Pwn] pwn1 - cpt.shao [Reverse] PE - Cew
没有帐号? 立即注册