问题

attachment-10.zip
image.png

附件信息如上,帮我求flag

思考

bash -lc python3 - <<'PY' from hashlib import sha256 import struct inner=b'IhouawyriuaIstlleyeoldc'

def rc4(data,key): S=list(range(256)); j=0 for i in range(256): j=(j+S[i]+key[i%len(key)])&0xff S[i],S[j]=S[j],S[i] i=j=0; out=[] for byte in data: i=(i+1)&0xff j=(j+S[i])&0xff S[i],S[j]=S[j],S[i] out.append(byte ^ S[(S[i]+S[j])&0xff]) return bytes(out) stage1=rc4(inner,b'344') stage2=bytes(b^b'21'[i%2] for i,b in enumerate(stage1)) stage3=bytes((b+b'89'[i%2])&0xff for i,b in enumerate(stage2)) key=sha256(b'233').digest()[:16]; K=struct.unpack('<4I',key); DELTA=0x9e3779b9; MASK=0xffffffff

def tea_enc_block(b): v0,v1=struct.unpack('<2I',b); s=0; k0,k1,k2,k3=K for _ in range(32): s=(s+DELTA)&MASK v0=(v0+(((v1<<4)+k0&MASK) ^ ((v1+s)&MASK) ^ ((v1>>5)+k1&MASK)))&MASK v1=(v1+(((v0>>5)+k3&MASK) ^ ((v0<<4)+k2&MASK) ^ ((v0+s)&MASK)))&MASK return struct.pack('<2I',v0,v1) pad=8-(len(stage3)&7) if pad>=8: pad=8 p=stage3+bytes([pad])*pad ct=b''.join(tea_enc_block(p[i:i+8]) for i in range(0,len(p),8)) print(stage1.hex(), stage2.hex(), stage3.hex(), p.hex(), ct.hex().upper()) PY

Thought for 4m 36s

回答

求出来的 flag 是:

text
ISCC{IhouawyriuaIstlleyeoldc}

我按程序里的校验逻辑逆了一遍:有效洞对应的数字是 344, 21, 89, 233,依次逆 TEA、减法、异或、RC4 后得到花括号内内容。

分享这个问答