给了,俩个文件
将一个打开用 010editor 打开 像是 python写的
改为.pyc
在线 反编译
得到源码
#!/usr/bin/env python
# encoding: utf-8
# 如果觉得不错,可以推荐给你的朋友!http://tool.lu/pyc
import flag
import random
def generate(flag, key, ran):
res = []
for i in range(len(flag)):
res.append((ord(flag[i]) ^ key[i]) % ran)
return res
def main():
ran = random.randint(99, 109)
print ran
real_flag = flag.flag
key = [
151,
157,
163,
167,
173,
179,
181,
191,
193,
197,
199,
211,
223,
227,
229,
233,
239,
241,
251,
257,
263,
269,
271,
277,
281,
283,
293,
307,
311,
313,
317,
331,
337,
347,
349,
353,
359,
367]
print generate(real_flag, key, ran)
generate(real_flag, key, ran)
if __name__ == '__main__':
main()
import flag
import random
def generate(flag, key, ran):
res = []
for i in range(len(flag)):
res.append((ord(flag[i]) ^ key[i]) % ran)
return res
def main():
ran = random.randint(99, 109)
print ran
real_flag = flag.flag
key = [
151,
157,
163,
167,
173,
179,
181,
191,
193,
197,
199,
211,
223,
227,
229,
233,
239,
241,
251,
257,
263,
269,
271,
277,
281,
283,
293,
307,
311,
313,
317,
331,
337,
347,
349,
353,
359,
367]
print generate(real_flag, key, ran)
generate(real_flag, key, ran)
if __name__ == '__main__':
main()
另外一个文件,base64解密后得到
res:[33, 33, 90, 88, 6, 27, 36, 11, 59, 33, 47, 74, 28, 26, 6, 0, 15, 40, 100, 98, 96, 3, 52, 87, 94, 89, 65, 50, 51, 48, 38, 67, 100, 54, 45, 33, 39, 66]
then
分析一下 then
写个py爆破吧
import random
import string
res=[33,33,90,88,6,27,36,11,59,33,47,74,28,26,6,0,15,40,100,98,96,3,52,87,94,89,65,50,51,48,38,67,100,54,45,33,39,66]
flag=''
dic='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789{}+-'
res1=[]
key=[151,157,163,167,173,179,181,191,193,197,199,211,223,227,229,233,239,241,251,257,263,269,271,277,281,283,293,307,311,313,317,331,337,347,349,353,359,367]
ran=104
for i2 in range(len(key)):
for i1 in dic:
if res[i2]==((ord(i1)^key[i2])%104):
flag+=i1
print flag
break跳出一层循环,这里不能加break,因为
flag{md5} 一共是38位 前面如果有符合的值 就会跳出循环 那么 后面符合的值就得不到了,成功采坑
去掉大写 后
得到flag