题目下载:攻防世界APK-逆向2

题解

前期分析

查询程序信息

发现是.NET的程序我们需要使用到的软件就是dnSpy
然后我们使用dnSpy打开文件

分析程序

主函数

private static void Main(string[] args)
{
    string hostname = "127.0.0.1";
    int port = 31337;
    TcpClient tcpClient = new TcpClient();
    try
    {
        Console.WriteLine("Connecting...");
        tcpClient.Connect(hostname, port);
    }
    catch (Exception)
    {
        Console.WriteLine("Cannot connect!\nFail!");
        return;
    }
    Socket client = tcpClient.Client;
    string text = "Super Secret Key";
    string text2 = Program.read();
    client.Send(Encoding.ASCII.GetBytes("CTF{"));
    foreach (char x in text)
    {
        client.Send(Encoding.ASCII.GetBytes(Program.search(x, text2)));
    }
    client.Send(Encoding.ASCII.GetBytes("}"));
    client.Close();
    tcpClient.Close();
    Console.WriteLine("Success!");
}

简单的分析就是程序在连接成功之后将text赋值为Super Secret Key然后将text2赋值为read函数读取的内容然后在search函数中处理包上CTF{}就是我们的flag了

关键函数

read

private static string read()
{
    string fileName = Process.GetCurrentProcess().MainModule.FileName;//获取文件的绝对路径
    string[] array = fileName.Split(new char[]
    {
        '\\'
    });
    string path = array[array.Length - 1];
    string result = "";
    using (StreamReader streamReader = new StreamReader(path))
    {
        result = streamReader.ReadToEnd();
    }//读取文件的内容之后return
    return result;
}

从返回值和程序内容可以看出read函数就是从程序内部读取一个值然后返回给text2

search

private static string search(char x, string text)
{
    int length = text.Length;
    for (int i = 0; i < length; i++)
    {
        if (x == text[i])
        {
            int value = i * 1337 % 256;
            return Convert.ToString(value, 16).PadLeft(2, '0');
        }
    }
    return "??";
}

内容意思就是在text中寻找x然后对找到的 x的下标处理，然后转化为16进制最后如果不足16位的话就往前面补0

EXP

方法一：暴力解密

text = 'Super Secret Key'
text2 = open('./1.exe', 'r', encoding='unicode-escape').read()
flag = 'CTF{'
num = len(text2)

def search(i, text, num):
    for j in range(0, num):
        if i == text[j]:
            x = j * 1337 % 256
            return '%02x' % x

for i in text:
    flag += search(i, text2, num)
print(flag + '}')

获取http监听内容

直接连接软件所监听的端口

import http.server

server_address = ('127.0.0.1', 31337)
handler_class = http.server.BaseHTTPRequestHandler
httpd = http.server.HTTPServer(server_address, handler_class)
httpd.serve_forever()