DASCTF X BUUOJ 五月 re wp

最近比赛挺多的，做得来的也就das了，哈哈哈，太菜了，后面其他比赛看看有没有wp，然后复现一下吧。

PaperPlease

就一个字符串解密

python脚本

1
2
3
4
5
6
7
8
9
10
11

a=[ 0x56, 0x05, 0x53, 0x52, 0x04, 0x03, 0x53, 0x54, 0x04, 0x0B,
  0x53, 0x51, 0x06, 0x06, 0x0F, 0x55, 0x05, 0x5B, 0x03, 0x56,
  0x0E, 0x07, 0x57, 0x0E, 0x01, 0x0D, 0x56, 0x00, 0x04, 0x06,
  0x0A, 0x5D,]
s='5c715207e3abed7dfb7c8ea9c82d0e29'
print("DASCTF{",end='')
for i in range(len(s)):
    print(chr(ord(s[i])^a[i]),end='')
print("}")
#DASCTF{cfdc11cca823cb81c9456b67b5dd4c8d}

end

先upx脱壳，然后分析一下发现是个迷宫加md5加密

脚本

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52

#include<stdio.h>
//上8 下2 左4 右6

//sdssddwddsssaassddd
int main(void)
{
	int map[56]={0x0000005e,0x00000000,0x00000000,0x00000000,0x00000000,0x00000000,0x00000000,0x00000001,0x00000001,0x00000000,0x00000000,0x00000000,0x00000000,0x00000000,0x00000000,0x00000001,0x00000000,0x00000001,0x00000001,0x00000001,0x00000000,0x00000000,0x00000001,0x00000001,0x00000001,0x00000000,0x00000001,0x00000000,0x00000000,0x00000000,0x00000000,0x00000000,0x00000000,0x00000001,0x00000000,0x00000001,0x00000000,0x00000000,0x00000001,0x00000001,0x00000001,0x00000000,0x00000001,0x00000000,0x00000000,0x00000001,0x00000000,0x00000000,0x00000000,0x00000000,0x00000000,0x00000000,0x00000001,0x00000001,0x00000001,0x00000023};
  	char path[]="sdssddwddsssaassddd";
  	int flag[20]={0};
  	int num;
  	char Buffer[20];
  int i;
  for(i=0;i<56;i++)
  {
  	printf("%02d ",map[i]);
  	if((i+1)%7==0)
  	{
  		printf("\n");
	}
  }
  	for(i=0;i<20;i++)
  	{
  		switch(path[i])
  		{
  			case 'w':
  				flag[i]=8;
			  	printf("8");
			 	break;
  			case 's':
  				flag[i]=2;
			  	printf("2");
			 	break;
  			case 'a':
  				flag[i]=4;
			  	printf("4");
			 	break;
  			case 'd':
  				flag[i]=6;
			  	printf("6");
			 	break;
		}
  			
	}
	for(i=0;i<20;i++)
	{
		num+=flag[i];
	}
	sprintf(Buffer, "%d", num);
	printf("\n%s",Buffer);
}
//md5(80)

得到f033ab37c30201f73f142449d037028d