{"id":416,"date":"2024-10-25T18:25:53","date_gmt":"2024-10-25T10:25:53","guid":{"rendered":"https:\/\/noobxiaomeng.top\/?p=416"},"modified":"2024-10-25T18:27:57","modified_gmt":"2024-10-25T10:27:57","slug":"dasctf_10_ezre","status":"publish","type":"post","link":"https:\/\/noobxiaomeng.top\/index.php\/2024\/10\/25\/dasctf_10_ezre\/","title":{"rendered":"DASCTF\u5341\u6708\u6311\u6218\u8d5b EZRE"},"content":{"rendered":"

\u6587\u4ef6\u4fe1\u606f<\/h3>\n

\"\"<\/div><\/a><\/p>\n

\u8131\u58f3\u90e8\u5206<\/h3>\n

\u8fd9\u91cc\u67e5\u5230\u4e00\u4e2aThemida3.X\u7684\u58f3\uff0c\u901a\u8fc7\u641c\u7d22\uff0cgithub\u6709\u4e00\u4e2a\u5f00\u6e90\u9879\u76ee\u7528\u4e8e\u8131\u6389\u8fd9\u79cd\u58f3<\/p>\n

\u9879\u76ee\u5730\u5740\uff1ahttps:\/\/github.com\/ergrelet\/unlicense<\/a><\/p>\n

\u6211\u4eec\u4e0b\u8f7d\u8be5\u9879\u76ee\u7684release\u5c31\u53ef\u4ee5\u4e86\uff0c\u4e4b\u540e\u4f7f\u7528\u5bf9\u5e94\u7684exe\u53bb\u6253\u5f00\u9898\u76ee\u9644\u4ef6
\n

\"\"<\/div><\/a><\/p>\n

\u53bb\u9664\u82b1\u6307\u4ee4<\/h3>\n

\u8fd9\u6837\u5c31\u8131\u597d\u4e86\uff0c\u6211\u4eec\u4f7f\u7528IDA\u6253\u5f00
\n

\"\"<\/div><\/a><\/p>\n

\u8fd9main\u51fd\u6570\u4e00\u6837\u7ecf\u5178\u82b1\u6307\u4ee4\uff0c\u5148\u628a\u4e0a\u9762\u7684jz\/jnz\u539f\u5730\u8df3\u8f6cnop\u4e86\uff0c\u518d\u628a\u4e0b\u9762\u7684call\u53bbD\u4e00\u4e0b\uff0c\u7136\u540e\u628a0E8h<\/code>nop\u6389\uff0c\u5269\u4e0b\u7684C\u5c06\u5b57\u8282\u7801\u8f6c\u6210\u6c47\u7f16\uff0c\u9009\u4e2d\u5168\u90e8\u7684main\u51fd\u6570p\u4e00\u4e0b\u5b9a\u4e49\u5c31\u53ef\u4ee5\u4e86<\/p>\n

\u4fee\u597d\u4e3b\u51fd\u6570\u7684\u82b1\u6307\u4ee4\u4e4b\u540e\u5e94\u8be5\u662f\u8fd9\u6837\uff1a<\/p>\n

int __cdecl main(int argc, const char **argv, const char **envp)\n{\n  char v4[44]; \/\/ [esp+14h] [ebp-90h]\n  int i; \/\/ [esp+40h] [ebp-64h]\n  int j; \/\/ [esp+44h] [ebp-60h]\n  char v7[44]; \/\/ [esp+48h] [ebp-5Ch] BYREF\n  char v8[44]; \/\/ [esp+74h] [ebp-30h] BYREF\n\n  v4[0] = 0x50;\n  v4[1] = 0xD4;\n  v4[2] = 0xC8;\n  v4[3] = 0xC4;\n  v4[4] = 0x8F;\n  v4[5] = 0x84;\n  v4[6] = 0x40;\n  v4[7] = 0xEB;\n  v4[8] = 0x32;\n  v4[9] = 0x81;\n  v4[10] = 0x8F;\n  v4[11] = 0x85;\n  v4[12] = 0x6C;\n  v4[13] = 0xB2;\n  v4[14] = 0x2B;\n  v4[15] = 6;\n  v4[16] = 0xBF;\n  v4[17] = 5;\n  v4[18] = 0x35;\n  v4[19] = 0x5D;\n  v4[20] = 0x2E;\n  v4[21] = 0xE3;\n  v4[22] = 0x7D;\n  v4[23] = 0x46;\n  v4[24] = 0x8D;\n  v4[25] = 0x35;\n  v4[26] = 1;\n  v4[27] = 0x70;\n  v4[28] = 0x3A;\n  v4[29] = 0x80;\n  v4[30] = 0x81;\n  v4[31] = 0xC5;\n  v4[32] = 0xE6;\n  v4[33] = 0x71;\n  v4[34] = 0xD3;\n  v4[35] = 0xD6;\n  v4[36] = 0x50;\n  v4[37] = 0x69;\n  v4[38] = 0x6F;\n  v4[39] = 0xE2;\n  v4[40] = 0x6E;\n  v4[41] = 0x78;\n  v4[42] = 0x14;\n  v4[43] = 0xD8;\n  sub_F61020(Format, aPleaseEnterYou);\n  sub_F61050("%s", v7);\n  (loc_F61290)(v7, v8);\n  for ( i = 0; i <= 36; ++i )\n    (loc_F613C0)(&v8[i]);\n  for ( j = 0; j < 44; ++j )\n  {\n    if ( v4[j] != v8[j] )\n    {\n      sub_F61020(Format, aWrong);\n      break;\n    }\n  }\n  if ( j == 44 )\n    sub_F61020(Format, aCongratulation);\n  return 0;\n}<\/code><\/pre>\n
\u903b\u8f91\u8fd8\u662f\u5f88\u6e05\u6670\u7684\uff0cv4\u5c31\u662f\u6211\u4eec\u7684\u5bc6\u6587\uff0c\u7136\u540eprintf\u548cscanf\u5c31\u4e0d\u8fc7\u591a\u8bb2\u8ff0\u4e86\uff0c\u53d1\u73b0\u4e86\u4e24\u4e2a\u51fd\u6570loc_F61290<\/code>\u548cloc_F613C0<\/code>\u90fd\u5bf9\u6211\u4eec\u7684\u8f93\u5165\u8fdb\u884c\u4e86\u64cd\u4f5c\uff0c\u6700\u540e\u8ddf\u5bc6\u6587\u8fdb\u884c\u6bd4\u8f83<\/p>\n
\u53cc\u51fb\u8fdb\u5165\u8fd9\u4e24\u4e2a\u51fd\u6570\u4e4b\u540e\u53d1\u73b0\u76f4\u63a5\u8df3\u5230\u6c47\u7f16\u4e86\uff0c\u8bf4\u660e\u662f\u65e0\u6cd5F5\u7684\uff0c\u7136\u540e\u53c8\u770b\u89c1\u4e86\u7ecf\u5178\u7684jz\/jnz <\/code>\u548c call    near ptr<\/code>\uff0c\u6211\u4eec\u7ee7\u7eednop\u53bb\u82b1<\/p>\n
\u5c06\u51e0\u5904\u82b1\u5168\u90e8\u53bb\u6389\u4e4b\u540e\u5c31\u80fd\u591f\u770b\u89c1\u51fd\u6570\u7684\u5177\u4f53\u5b9e\u73b0\u4e86\uff0c\u6211\u6280\u672f\u6709\u9650\uff0c\u4e5f\u5c31\u53ea\u80fd\u4fee\u6210\u8fd9\u6837\u4e86
\n
\"\"<\/div><\/a><\/p>\n
RC4\u52a0\u5bc6<\/h3>\n
sub_1290\uff1a<\/p>\n
char __cdecl sub_F61290(char *a1, int a2)\n{\n  char result; \/\/ al\n  unsigned int i; \/\/ [esp+18h] [ebp-10h]\n  char *v4; \/\/ [esp+1Ch] [ebp-Ch]\n  unsigned __int8 v6; \/\/ [esp+26h] [ebp-2h]\n  unsigned __int8 v7; \/\/ [esp+27h] [ebp-1h]\n\n  v7 = 0;\n  v6 = 0;\n  sub_F610C0();\n  v4 = a1;\n  do\n    result = *v4;\n  while ( *v4++ );\n  for ( i = 0; i < v4 - (a1 + 1); ++i )\n  {\n    v6 += byte_F643B0[++v7];\n    sub_F61080(&byte_F643B0[v7], &byte_F643B0[v6]);\n    *(i + a2) = (byte_F643B0[(byte_F643B0[v6] + byte_F643B0[v7])] ^ 0x33) + a1[i];\n    result = i + 1;\n  }\n  return result;\n}<\/code><\/pre>\n
\u5176\u4e2d\u7684sub_F610C0\u51fd\u6570\u662f\u8fd9\u6837\u7684<\/p>\n
void *sub_F610C0()\n{\n  void *result; \/\/ eax\n  int v1; \/\/ [esp+18h] [ebp-128h]\n  int j; \/\/ [esp+1Ch] [ebp-124h]\n  char *v3; \/\/ [esp+20h] [ebp-120h]\n  unsigned int i; \/\/ [esp+24h] [ebp-11Ch]\n  int k; \/\/ [esp+28h] [ebp-118h]\n  char v6[256]; \/\/ [esp+30h] [ebp-110h] BYREF\n  char v7[12]; \/\/ [esp+130h] [ebp-10h] BYREF\n\n  strcpy(v7, "th0s_i0_ke9");\n  for ( i = 0; i < 0x100; ++i )\n    byte_F643B0[i] = i;\n  v3 = &v7[strlen(v7) + 1];\n  result = memset(v6, 0, sizeof(v6));\n  for ( j = 0; j < 256; ++j )\n  {\n    result = j;\n    v6[j] = v7[j % (v3 - &v7[1])];\n  }\n  v1 = 0;\n  for ( k = 0; k < 256; ++k )\n  {\n    v1 = (v6[k] + v1 + byte_F643B0[k]) % 256;\n    result = sub_F61080(&byte_F643B0[k], &byte_F643B0[v1]);\n  }\n  return result;\n}<\/code><\/pre>\n
\u4e0d\u96be\u770b\u51fa\u8fd9\u662f\u4e00\u4e2aRC4\u7684\u52a0\u5bc6\uff0c\u4e0d\u8fc7\u6709\u4e9b\u8bb8\u9b54\u6539\uff0c\u5faa\u73af\u4e8644\u548c\u5f02\u6216\u4e860x33<\/p>\n
\"\"<\/div><\/a><\/p>\n
52\u7684\u4f6c\u8fd8\u662f\u8bb2\u5f97\u5f88\u597d\u7684<\/p>\n
xTEA\u52a0\u5bc6<\/h3>\n
sub_F613C0\uff1a<\/p>\n
int *__cdecl sub_F613C0(int *a1)\n{\n  int *result; \/\/ eax\n  int v2[4]; \/\/ [esp+Ch] [ebp-24h]\n  int v3; \/\/ [esp+1Ch] [ebp-14h]\n  int i; \/\/ [esp+20h] [ebp-10h]\n  unsigned int v5; \/\/ [esp+24h] [ebp-Ch]\n  unsigned int v6; \/\/ [esp+28h] [ebp-8h]\n  unsigned int v7; \/\/ [esp+2Ch] [ebp-4h]\n\n  v2[0] = 0x6E982837;\n  v2[1] = 0x44332211;\n  v2[2] = 0x11223344;\n  v2[3] = 0x3728986E;\n  v6 = *a1;\n  v5 = a1[1];\n  v7 = 0x66778899;\n  v3 = 0x9E3779B8;\n  for ( i = 0; i <= 32; ++i )\n  {\n    v6 += (v2[v7 & 3] + v7) ^ (v5 + ((v5 >> 6) ^ (32 * v5)));\n    v7 += v3;\n    v5 += (v2[(v7 >> 11) & 3] + v7) ^ (v6 + ((v6 >> 5) ^ (16 * v6)));\n  }\n  *a1 = v6;\n  result = a1;\n  a1[1] = v5;\n  return result;\n}<\/code><\/pre>\n
\u8fd9\u4e2a\u4e0d\u7528\u89e3\u91ca\u4e86\uff0c\u4e00\u773cxTEA\uff0c\u4e0d\u8fc7\u8fd8\u662f\u8fdb\u884c\u4e86\u4e00\u5b9a\u7684\u9b54\u6539\uff0c\u6bd4\u5982\u8bf4\u8f6e\u6b21\u53d8\u6210\u4e8633\uff0c\u5728\u4e3b\u51fd\u6570\u4e2d\u53c8\u5faa\u73af\u4e8637\u6b21(\u5934\u5927<\/p>\n
exp<\/h3>\n
\u65e2\u7136\u5982\u6b64\u6bcf\u4e2a\u6b65\u9aa4\u90fd\u5206\u6790\u5b8c\u4e86\u5199\u4e2a\u89e3\u5bc6\u811a\u672c\u4e0d\u662f\u7b80\u7b80\u5355\u5355(bushi<\/p>\n
#include <iostream>\n#include <cstring>\n#include <cstdint>\n\nusing namespace std;\n\nunsigned char S[256];\n\nvoid swap(unsigned char& a, unsigned char& b) {\n    unsigned char temp = a;\n    a = b;\n    b = temp;\n}\n\nvoid rc4_key_setup(unsigned char* key, int key_length, unsigned char S[256]) {\n    unsigned char T[256];\n    int j = 0;\n\n    for (int i = 0; i < 256; i++) {\n        S[i] = i;\n        T[i] = key[i % key_length];\n    }\n\n    for (int i = 0; i < 256; i++) {\n        j = (j + S[i] + T[i]) % 256;\n        swap(S[i], S[j]);\n    }\n}\n\nvoid decrypt(const char* a1, char* a2, int length) {\n    unsigned char v6 = 0;\n    unsigned char v7 = 0;\n\n    for (int i = 0; i < length; ++i) {\n        v6 += S[++v7];\n        swap(S[v7], S[v6]);\n        a2[i] = a1[i] - (S[(unsigned char)(S[v6] + S[v7])] ^ 0x33);\n    }\n}\n\nvoid xtea_decrypt(uint32_t* a1) {\n    int v2[4] = { 1855465527, 1144201745, 287454020, 925407342 };\n    uint32_t v6 = a1[0];\n    uint32_t v5 = a1[1];\n\n    uint32_t v7 = 1719109785 + (0x9E3779B8 * 33);\n    int v3 = 0x9E3779B8;\n\n    for (int i = 0; i <= 32; ++i) {\n        v5 -= (v2[(v7 >> 11) & 3] + v7) ^ (v6 + ((v6 >> 5) ^ (16 * v6)));\n        v7 -= v3;\n        v6 -= (v2[v7 & 3] + v7) ^ (v5 + ((v5 >> 6) ^ (32 * v5)));\n    }\n\n    a1[0] = v6;\n    a1[1] = v5;\n}\n\nint main() {\n    unsigned char key[] = "th0s_i0_ke9";\n    int key_length = strlen((const char*)key);\n\n    \/\/ \u521d\u59cb\u5316S\u76d2\n    rc4_key_setup(key, key_length, S);\n\n    unsigned char encenc[] = {\n        0x50, 0xD4, 0xC8, 0xC4, 0x8F, 0x84, 0x40, 0xEB, 0x32,\n        0x81, 0x8F, 0x85, 0x6C, 0xB2, 0x2B, 0x06, 0xBF, 0x05,\n        0x35, 0x5D, 0x2E, 0xE3, 0x7D, 0x46, 0x8D, 0x35, 0x01,\n        0x70, 0x3A, 0x80, 0x81, 0xC5, 0xE6, 0x71, 0xD3, 0xD6,\n        0x50, 0x69, 0x6F, 0xE2, 0x6E, 0x78, 0x14, 0xD8, 0x25\n    };\n\n    \/\/ XTEA\u89e3\u5bc6\n    for (int i = 36; i >= 0; i--) {\n        xtea_decrypt((uint32_t*)&encenc[i]);\n    }\n\n    \/\/ RC4\u89e3\u5bc6\n    char encrypted_data[45]; \/\/ \u6ce8\u610f\u8fd9\u91cc\u9700\u8981 +1 \u4ee5\u5bb9\u7eb3\u7ed3\u675f\u7b26\n    decrypt((char*)encenc, encrypted_data, 44);\n    encrypted_data[44] = '\\0'; \/\/ \u6dfb\u52a0\u7ed3\u675f\u7b26\n\n    cout << encrypted_data << endl;\n    return 0;\n}\n\/\/DASCTF{Th1l_t8e1a_rc4_l8s_s8o_int9r3es4t1ng}<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"
\u6587\u4ef6\u4fe1\u606f \u8131\u58f3\u90e8\u5206 \u8fd9\u91cc\u67e5\u5230\u4e00\u4e2aThemida3.X\u7684\u58f3\uff0c\u901a\u8fc7\u641c\u7d22\uff0cgithub\u6709\u4e00\u4e2a\u5f00\u6e90\u9879\u76ee\u7528\u4e8e\u8131\u6389\u8fd9\u79cd\u58f3  […]<\/p>\n","protected":false},"author":1,"featured_media":422,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[],"class_list":["post-416","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-re"],"_links":{"self":[{"href":"https:\/\/noobxiaomeng.top\/index.php\/wp-json\/wp\/v2\/posts\/416","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/noobxiaomeng.top\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/noobxiaomeng.top\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/noobxiaomeng.top\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/noobxiaomeng.top\/index.php\/wp-json\/wp\/v2\/comments?post=416"}],"version-history":[{"count":1,"href":"https:\/\/noobxiaomeng.top\/index.php\/wp-json\/wp\/v2\/posts\/416\/revisions"}],"predecessor-version":[{"id":423,"href":"https:\/\/noobxiaomeng.top\/index.php\/wp-json\/wp\/v2\/posts\/416\/revisions\/423"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/noobxiaomeng.top\/index.php\/wp-json\/wp\/v2\/media\/422"}],"wp:attachment":[{"href":"https:\/\/noobxiaomeng.top\/index.php\/wp-json\/wp\/v2\/media?parent=416"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/noobxiaomeng.top\/index.php\/wp-json\/wp\/v2\/categories?post=416"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/noobxiaomeng.top\/index.php\/wp-json\/wp\/v2\/tags?post=416"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}