{"id":736,"date":"2024-02-08T15:36:22","date_gmt":"2024-02-08T07:36:22","guid":{"rendered":"https:\/\/shangwendada.top\/?p=736"},"modified":"2024-08-13T10:23:32","modified_gmt":"2024-08-13T02:23:32","slug":"beginctf%e7%9c%9f%e9%be%99%e4%b9%8b%e5%8a%9b","status":"publish","type":"post","link":"https:\/\/blog.shangwendada.top\/index.php\/2024\/02\/08\/beginctf%e7%9c%9f%e9%be%99%e4%b9%8b%e5%8a%9b\/","title":{"rendered":"[BeginCTF]\u771f\u9f99\u4e4b\u529b"},"content":{"rendered":"

\u5b89\u88c5\u7a0b\u5e8f<\/h2>\n

\u53cc\u51fb\u5b89\u88c5<\/h3>\n

\"file\"<\/div>
\n\u51fa\u73b0\u4e86\u5b89\u88c5\u5931\u8d25\u7684\u6807\u7b7e\uff0c\u5f00\u53d1\u8005\u4e0d\u5141\u8bb8\u6d4b\u8bd5\u3002<\/p>\n

\u67e5\u770bMainfest\u5165\u53e3\u6587\u4ef6<\/h3>\n
<?xml version="1.0" encoding="utf-8"?>\n<manifest xmlns:android="http:\/\/schemas.android.com\/apk\/res\/android" android:versionCode="1" android:versionName="1.0" android:compileSdkVersion="32" android:compileSdkVersionCodename="12" package="com.example.dragon" platformBuildVersionCode="32" platformBuildVersionName="12">\n    <uses-sdk android:minSdkVersion="22" android:targetSdkVersion="32"\/>\n    <application android:theme="@style\/Theme.Dragon" android:label="@string\/app_name" android:icon="@mipmap\/ic_launcher" android:debuggable="true" android:testOnly="true" android:allowBackup="true" android:supportsRtl="true" android:fullBackupContent="@xml\/backup_rules" android:roundIcon="@mipmap\/ic_launcher_round" android:appComponentFactory="androidx.core.app.CoreComponentFactory" android:dataExtractionRules="@xml\/data_extraction_rules">\n        <activity android:name="com.example.dragon.MainActivity" android:exported="true">\n            <intent-filter>\n                <action android:name="android.intent.action.MAIN"\/>\n                <category android:name="android.intent.category.LAUNCHER"\/>\n            <\/intent-filter>\n        <\/activity>\n    <\/application>\n<\/manifest><\/code><\/pre>\n
\u53ef\u4ee5\u53d1\u73b0android:testOnly:"true",\u4e5f\u5c31\u662f\u5bfc\u81f4\u6211\u4eec\u65e0\u6cd5\u5b89\u88c5\u7684\u4e3b\u8981\u539f\u56e0\u3002<\/p>\n
AndroidKiller\u4fee\u6539Mainfest\u6587\u4ef6\u8fdb\u884c\u5b89\u88c5\u3002<\/h3>\n
\"file\"<\/div>
\n\u5728AndroidKiller\u4e2d\u5c06Mainfest\u6587\u4ef6\u4fee\u6539\u6210android:testOnly:"flase"\u6216\u8005\u76f4\u63a5\u5220\u9664\u8fd9\u4e00\u53e5\uff0c\u7136\u540e\u7f16\u8bd1\u7b7e\u540d\u5b89\u88c5\u5c31\u53ef\u4ee5\u4e86\u3002<\/p>\n
abd\u76f4\u63a5\u5b89\u88c5<\/h3>\n
adb install -t .\\dragon.apk<\/code>
\n\u4f7f\u7528-t\u53c2\u6570\u76f4\u63a5\u6d4b\u8bd5\u5b89\u88c5\u3002
\n
\"file\"<\/div><\/p>\n
\u5206\u6790\u7a0b\u5e8f\u6e90\u4ee3\u7801<\/h2>\n
\"file\"<\/div>
\n\u5165\u53e3\u662fMainActivity\u76f4\u63a5\u8fdb\u5165\u67e5\u770b
\n
\"file\"<\/div>
\n\u4e24\u4e2a\u6309\u94ae\u7684\u76d1\u542c\u4e8b\u4ef6\uff0c
\n
\"file\"<\/div><\/p>\n
button1<\/h3>\n
\u70b9\u51fb\u540e\u76f4\u63a5\u5982\u4e0b\u7c7b
\n
\"file\"<\/div>
\n\u8fd9\u4e2aencryptString()\u65b9\u6cd5\u5728\u6700\u5f00\u59cb\u88ab\u6ce8\u518c\uff0c\u6765\u81ea\u4e8enative\u5c42
\n
\"file\"<\/div>
\n\u4e5f\u5c31\u662f\u5728native\u5c42\u9a8c\u8bc1KEY\u662f\u5426\u6b63\u786e<\/p>\n
button2<\/h3>\n
\"file\"<\/div>
\n\u4f7f\u7528\u4e86\u4e00\u7cfb\u5217\u7b97\u6cd5\u5982\u4e0b<\/p>\n
package com.example.dragon;\n\nimport java.util.Arrays;\nimport java.util.function.ToIntFunction;\n\n\/* compiled from: MainActivity.java *\/\n\/* loaded from: classes3.dex *\/\nclass DragonSwap {\n    private static final int BLOCK_SIZE = 16;\n    private static final int[] S_BOX = {9, 11, 25, 20, 15, 30, 24, 23, 2, 26, 28, 13, 16, 19, 29, 31, 5, 4, 17, 12, 14, 8, 27, 21, 22, 3, 7, 0, 18, 6, 10, 1};\n\n    private static byte[] encrypt1(byte[] message, String KEY) {\n        A a = new A();\n        B b = new B();\n        long KEY2 = b.math(KEY);\n        int[] B_BOX = a.rand(KEY2).stream().mapToInt(new ToIntFunction() { \/\/ from class: com.example.dragon.DragonSwap$$ExternalSyntheticLambda0\n            @Override \/\/ java.util.function.ToIntFunction\n            public final int applyAsInt(Object obj) {\n                Integer valueOf;\n                valueOf = Integer.valueOf(((Integer) obj).intValue());\n                return valueOf.intValue();\n            }\n        }).toArray();\n        for (int i = 0; i < message.length; i += 16) {\n            byte[] block = Arrays.copyOfRange(message, i, i + 16);\n            for (int j = 0; j < 16; j++) {\n                int aa = (B_BOX[j] * j) % 16;\n                byte tmp = block[j];\n                block[j] = block[aa];\n                block[aa] = tmp;\n            }\n            System.arraycopy(block, 0, message, i, 16);\n        }\n        return message;\n    }\n\n    private static byte[] SSBBOOXX(byte[] message) {\n        byte[] encryptedMessage = new byte[message.length];\n        for (int i = 0; i < message.length; i++) {\n            encryptedMessage[i] = message[S_BOX[i]];\n        }\n        return encryptedMessage;\n    }\n\n    private static String encrypt2(byte[] message) {\n        for (int i = 0; i < 16; i++) {\n            message = SSBBOOXX(message);\n        }\n        StringBuilder sb = new StringBuilder();\n        for (byte b : message) {\n            sb.append(String.format("%02X", Byte.valueOf(b)));\n        }\n        return sb.toString();\n    }\n\n    public String finalenc(String ID, String KEY) {\n        byte[] flag = ID.getBytes();\n        byte[] paddedFlag = new byte[(((flag.length + 16) - 1) \/ 16) * 16];\n        System.arraycopy(flag, 0, paddedFlag, 0, flag.length);\n        byte[] encrypted1 = encrypt1(paddedFlag, KEY);\n        return encrypt2(encrypted1);\n    }\n}<\/code><\/pre>\n
\u53ef\u4ee5\u53d1\u73b0\u7b97\u6cd5\u53ea\u662f\u6d89\u53ca\u5230\u4e86\u5bc6\u6587\u7684\u4f4d\u7f6e\u7f6e\u6362\uff0c\u4e0d\u6d89\u53ca\u4efb\u4f55\u7684\u52a0\u5bc6\u7b49\u3002
\n\u5177\u4f53\u903b\u8f91\u5c31\u662f\u901a\u8fc7\u586b\u514500\u7136\u540e\u7f6e\u6362\u4e4b\u540e\u4e0e\u5bc6\u6587\u8fdb\u884c\u6bd4\u8f83\uff0c\u6b63\u786e\u5219\u8f93\u51fa\u201dYOU GET IT\u201c\u4e0d\u6b63\u786e\u5219\u8f93\u51fa\u4ea4\u6362\u7684\u7ed3\u679c\u3002<\/p>\n
\u89e3\u9898<\/h2>\n
\u5bf9\u4e8enative\u5c42\u7684\u7a0b\u5e8f\uff0c\u6211\u4eec\u9700\u8981\u4f7f\u7528\u538b\u7f29\u5305\u6253\u5f00apk\u6587\u4ef6\u5728lib\u6587\u4ef6\u5939\u4e2d\u5219\u53ef\u4ee5\u770b\u5230so\u6587\u4ef6\uff0c\u5176\u4e2d\u6587\u4ef6\u540d\u4ee3\u8868\u7684\u662f\u4e0d\u540c\u7684\u67b6\u6784
\n
\"file\"<\/div>
\n\u627e\u5230\u4e3b\u8981\u903b\u8f91
\n
\"file\"<\/div><\/p>\n
\"file\"<\/div>
\n\u903b\u8f91\u5c31\u662ftea\u52a0\u5bc6\uff0c\u8f6c\u5316\u4e3a16\u8fdb\u5236\u5b57\u7b26\u4e32\u7136\u540e\u6bd4\u5bf9\u3002<\/p>\n
\u9996\u5148\u6211\u4eec\u89e3TEA\uff0c\u7136\u540e\u6839\u636e\u7a0b\u5e8f\u81ea\u5df1\u8f93\u51fa\u7684\u8c03\u6362\u4f4d\u7f6e\u5c06\u5b57\u7b26\u8fd8\u539f\u5373\u53ef<\/p>\n
#include<iostream>\n#include<algorithm>\n#include<cstdio>\n#include<cmath>\n#include<map>\n#include<vector>\n#include<queue>\n#include<stack>\n#include<set>\n#include<string>\n#include<cstring>\n#include<list>\n#include<stdlib.h>\nusing namespace std;\ntypedef int status;\ntypedef int selemtype;\n\/*\n                   _ooOoo_\n                  o8888888o\n                  88" . "88\n                  (| -_- |)\n                  O\\  =  \/O\n               ____\/`---'\\____\n            .'  \\\\|     |\/\/  `.\n            \/  \\\\|||  :  |||\/\/  \\\n           \/  _||||| -:- |||||-  \\\n           |   | \\\\\\  -  \/\/\/ |   |\n           | \\_|  ''\\---\/''  |   |\n           \\  .-\\__  `-`  ___\/-. \/\n         ___`. .'  \/--.--\\  `. . __\n      ."" '<  `.___\\_<|>_\/___.'  >'"".\n     | | :  `- \\`.;`\\ _ \/`;.`\/ - ` : | |\n     \\  \\ `-.   \\_ __\\ \/__ _\/   .-` \/  \/\n======`-.____`-.___\\_____\/___.-`____.-'======\n                   `=---='\n^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n    \u4f5b\u7956\u4fdd\u4f51       \u6c38\u4e0d\u5b95\u673a     \u6c38\u65e0BUG\n*\/\nunsigned int __cdecl xtea_encryption(unsigned int *a1, const unsigned int *a2) {\n    unsigned int result; \/\/ eax\n    int i; \/\/ [esp+0h] [ebp-18h]\n    unsigned int v4; \/\/ [esp+8h] [ebp-10h]\n    unsigned int v5; \/\/ [esp+Ch] [ebp-Ch]\n    unsigned int v6; \/\/ [esp+10h] [ebp-8h]\n\n    v6 = *a1;\n    v5 = a1[1];\n    v4 = 0x9E3779B9*32;\n    for ( i = 0; i < 32; ++i ) {\n        v5 -= (a2[(v4 >> 11) & 3] + v4) ^ (v6 + ((v6 >> 4) ^ (32 * v6)));\n        v4 -= 0x9E3779B9;\n        v6 -= (a2[v4 & 3] + v4) ^ (v5 + ((v5 >> 4) ^ (32 * v5)));\n\n    }\n    *a1 = v6;\n    result = v5;\n    a1[1] = v5;\n    return result;\n}\nunsigned int qword_B0930[4] =\n{ 19088743,(unsigned int) -1985229329,(unsigned int) -19088744,(unsigned int) 1985229328 };\n\nunsigned enc[4] = {0x1b253544,0xfcc56bb0};\n\nint main () {\n    xtea_encryption(enc,qword_B0930);\n    printf("%s\\n",enc);\n    \/\/2024YYDS\n    char table[] = "qwertyuiopasdfghjklzxcvbnmA";\n    char mask[] = "cyqbfvzornmxstdpkjweailAugh";\n    char res[] = "i{biecfuialflnlv_eegieo}Ntt";\n    char opt[256] = {0};\n    unsigned char dic[77] = {0};\n    for(int i = 0 ; i <27 ; i ++ ){\n        for(int j = 0 ; j < 27 ; j ++ ){\n            if(table[j] == mask[i]){\n                dic[i] = j;\n            }\n        }\n    }\n    for(int i = 0 ; i < 27 ; i ++ ){\n        opt[dic[i]] = res[i];\n    }\n    printf("%s",opt);\n}<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"
\u5b89\u88c5\u7a0b\u5e8f \u53cc\u51fb\u5b89\u88c5 \u51fa\u73b0\u4e86\u5b89\u88c5\u5931\u8d25\u7684\u6807\u7b7e\uff0c\u5f00\u53d1\u8005\u4e0d\u5141\u8bb8\u6d4b\u8bd5\u3002 \u67e5\u770bMainfest\u5165\u53e3\u6587\u4ef6 <?xml  […]<\/p>\n","protected":false},"author":1,"featured_media":692,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[13,1],"tags":[],"class_list":["post-736","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-android","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/posts\/736","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/comments?post=736"}],"version-history":[{"count":5,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/posts\/736\/revisions"}],"predecessor-version":[{"id":755,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/posts\/736\/revisions\/755"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/media\/692"}],"wp:attachment":[{"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/media?parent=736"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/categories?post=736"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/tags?post=736"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}