본문 바로가기

CTF

[Hitb-xctf 2018] multicheck

1
2
3
4
5
6
7
8
9
10
data = [0x8D0x8F0x930xE60xDD0xDD0xDA0xF00x740xF20x030x6D0xC00xD30x070x290x9A0x970xB70x3D0xD60x0B0xBC0x530xF40x890x8E0x080x210x520xE90x420x350x0D0x0B0x0C0x7D0x0E0x0F0x100x690x440x270x060x150x160x170x180x190x1A0x1B0x1C0x810x180x1F0x200x3D0x220x230x240x550x260x270x280x220x2A0x2B0x2C0xCD0x2E0x2F0x300x3B0x320x330x340x390x370x370x380x3B0x3A0x3B0x3C0xB90x3F0x3F0x400x4D0x420x430x440xD10x470x470x480x480x4A0x4B0x4C0xB90x4F0x4F0x500x790x570x530x540x410x540x570x580x750x5F0x5B0x5C0x6B0x5B0x5F0x600x5F0x670x630x640x240x630x670x680x240x6F0x6B0x6C0x3D0x6B0x6F0x700x250x770x730x740x220x730x770x780x220x7F0x7B0x7C0x1D0x7B0x7F0x800xE60x870x830x840xF30x830x870x880x030x8F0x8B0x8C0x130x8B0x8F0x900x230x970x930x940x530x930x970x980x500x9F0x9B0x9C0x4C0x9B0x9F0xA00x750xA70xA30xA40x7D0xA30xA70xA80x740xAF0xAB0xAC0x4C0xAB0xAF0xB00x540xB70xB30xB40x5D0xB30xB70xB80x4A0xBF0xBB0xBC0x4B0xBB0xBF0xC00x3C0xC70xC30xC40xC00xC00xC70xC80xCB0xCA0xCB0xCC0xC90xCE0xCF0xD00xDB0xD20xD30xD40xDE0xD60xD70xD80xD50xDA0xDB0xDC0xD00xDE0xDF0xE00xEF0xE20xE30xE40xEA0xE60xE70xE80xF80xEA0xEB0xEC0xF90xEE0xEF0xF00xE40xF20xF30xF40xF00xF60xF70xF80xF80xFA0xFB0xFC0x1D0xFA0xFF0x000x0E0x020x030x040x020x060x070x080x090x0A0x0B0x0C0x1D0x0E0x0F0x100x160x120x130x140xFD0x120x170x180x0B0x1A0x1B0x1C0x150x1E0x1F0x200xD90x260x230x240x360x260x270x280x210x2A0x2B0x2C0x2D0x2B0x2F0x300x370x320x330x340x3C0x360x370x380x390x3A0x3B0x3C0x3A0x3E0x3F0x400x480x420x430x440x4D0x430x470x480x400x4A0x4B0x4C0x440x4E0x4F0x500x410x570x530x540x5D0x560x570x580x500x5A0x5B0x5C0x410x5B0x5F0x600x690x620x630x640x6F0x660x670x680x4D0x6F0x6B0x6C0x6F0x6E0x650x700x670x720x730x740x770x760x7E0x780x610x7A0x7B0x7C0x7F0x7E0x7E0x800x810x820x830x840x870x860x860x880x880x8A0x8B0x8C0x8F0x8E0x8F0x900x870x920x930x940x970x960x910x980x8F0x9A0x9B0x9C0x9F0x9E0x980xA00xB70xA20xA30xA40xA70xA60xAF0xA80xBF0xAA0xAB0xAC0xAF0xAE0xA60xB00xA70xB20xB30xB40xB70xB60xB40xB80xA00xBA0xBB0xBC0xBE0xBE0xBE0xC00xC00xC20xC30xC40xC10xC60xC20xC80xD20xCA0xCB0xCC0xC80xCE0xCD0xD00xC60xD20xD30xD40xD30xD60xD30xD80xC30xDA0xDB0xDC0xDF0xDE0xDF0xE00xE00xE20xE30xE40xE60xE60xE70xE80xE90xEA0xEB0xEC0xEE0xEE0xEF0xF00xF10xF20xF30xF40x850xF00xF70xF80xF90xFA0xFB0xFC0xFC0xFE0xFF0x000x010x020x030x040x0A0x000x070x080x3B0x0A0x0B0x0C0x1F0x4E0x2C0x100x1B0x120x350x140x1A0x160x170x180x700x1A0x1B0x1C0x0E0x1E0x3F0x200x020x220x2A0x240x030x260x350x280x290x2A0x420x2C0x2C0x2E0x210x300x310x310x370x340x310x360x370x380x920x910x900x970xF00xF30xF20x8D0xAE0xAD0xAC0xAB0x3D0x100x730x5A0x490x490x4A0x4C0x6D0x4E0x4F0x500x320x2E0x360xBD0xDB0x070x860x810xC30x150x4D0x680x840xFC0xE10xD80x040x8C0x2A0x810x500x9D0x490x840x080x610xA30x480x800xA10xFF0xC50x700x720x720x740x740x760x770x780x640x7C0x7B0x7C0x790x7E0x7F0x800xF10x920x8B0x840x850x860x890x880x880x8A0x8A0x8C0x8D0x8E0x8F0x900xB30x940x930x940x900x960x970x980xA20x9A0x9F0x9C0x4D0x9E0x9F0xA10xAE0xA20xA30xA40xA20xA60xA60xA80xAC0xAA0xAB0xAC0x860xA80xAF0xB00x980xB20xB30xB40xA70xB70x960xD80x650xBA0xBB0xB40x640xBE0xBF0xC80xE00xA00x730xC60xE60xE40xCE0xC80x440xC90x840xCF0xCF0xCF0xEE0xB30xA00x810xD90xD40xC30xD40xF60xF80xFA0xD90xD20xDC0xDC0xCE0xFE0xD40xD40xA20xF10xE40x870xE20xE70xE80xFA0xEF0xCB0xEC0x9C0xAE0xEB0xF00xF30xA60xFF0xF00xE60xF30xFF0xF80x880xAF0xF10xFC0xE90xFD0x270x000x010x0A0x2B0xEA0x140x050x070x080x190x0A0x0F0x0C0x0F0x0E0x0F0x100x2B0x140x130x140x560x160x170x180x680x3A0x1D0x1C0xC10x1E0x130x240x330x220x670x270x210x260x350x380x6D0x280x2F0x2C0x3F0x2F0x3B0x350x880x4B0x040xAA0x270x360x730x3E0x370x3A0x290x2C0x790x390x310x400x530x620x070x4C0x4B0x460x550x780x0D0x430x450x4C0x5F0x4E0x7A0xA00x4D0x520xE30x050xB50x5C0x550x5C0xE90x300xCB0x570x5F0x5F0xE80xDA0x800x690x610x610xD50x1D0xD00xD20xD90xC90x8B0x660x6E0x6A0xDF0xFA0xE10x790x700x750xC20xCC0x960x730x7A0x7F0xCB0xE70xCA0xC40xCF0x220x590x820x830x850xAD0x630x950x880xC20x890x8F0x8C0x9F0x9E0xC40x920x950x920x810x940xE40xB60x920x980x9D0x9A0x970x9C0x8C0x9E0x9F0xA00xA70xA20xA10xA40xA50xA60xA70xA80xE70xAC0xAB0xAC0x9A0xAE0xAF0xB00x900xF20x530xB40xB50xB40x940xB90xB00xBA0xA90xBC0x9C0xAC0x8A0xE50xEE0xC20x1B0xC60xC00xC50x830xCB0xCD0xCA0x1E0xFF0x320xCE0x420xE30x9E0xD10xD20xD60x0D0xD40xD20xDA0x9D0xD90xDF0xDC0x3C0xDD0xDC0xE80x340xD10x1C0xE40x680xD50xA80xEB0xE80xE80x330xEE0xE80xEF0xAB0xF30xF50xF20x120xF70xF60xE60x220xCB0x060xFA0x760xCF0xB20xFD0xFE0x020x450x000x070x040xE40x040x050x100xDC0x280xF40x0C0x800x2C0x400x120x100x170xCB0x140x150x170xCF0x1D0x1C0x1E0x330xCD0x0C0x1F0x1F0x200x270x220x210x240x240x260x270x280x750x2C0x2B0x2C0x190x2E0x2F0x300x100x720xD20x340x350x340x140x390x330x3A0x290x3C0x1C0x7C0x0A0x650x6D0x420x9B0x460x400x450x0F0x4A0x4D0x480x3A0x5C0x4F0x4E0x4D0x500x5B0x500x8B0x570x500x540x1F0x5B0x5D0x590x2A0x4C0x5F0x5E0x5C0x600x6B0x610x830x670x660x6E0xD10x5A0xB10x690x6E0x6D0x250x6D0x6B0x730x000x620x710x740x760x760x7D0x7B0x990x790x780x6C0xCB0x4C0x370x830x850x870x630x870x860x9E0x310xBA0xC20x880x8A0x8C0x550x8E0x8F0x910x490x970x960x900xBD0x420x860x990x9A0x9A0x9A0x9C0x9F0x9E0x9F0xA00xCB0xA40xA30xA40xAA0xA60xA70xA80xC70xBA0xA20xAC0xAF0xAE0xA30xB00xC00xA20xB00xB40xB50xB60xBB0xB80xDB0xBB0xBA0xBC0xCC0x9E0xB40xC00xD10xC20xC90xC40xCA0xC60xC70xC80xC80xCA0xCB0xCC0xCD0xCE0xCF0xD00xD40xD20xD30xD40xD60xD60xD60xD80xDA0xDA0xDA0xDC0xDC0xDE0xDF0xE00xE00xE20xE30xE40xE10xE60xE70xE80xEB0xEA0xEB0xEC0xE40xEE0xE60xF00xF00xF20xF30xF40xFC0xF60xF70xF80xFD0xFA0xFB0xFC0xF40xFE0xFE0x000x0B0x020x020x040x070x060x070x080x030x0A0x0A0x0C0x0F0x0E0x0F0x100x180x120x120x140x1D0x2A0x740x740x700x740x720x680x230x1E0x190x1C0x480x4C0x4A0x500x1B0x260x260x6A0x290x200x680x440x480x4D0x440x1E0x5B0x530x450x550x350x370x7E0x380x3B0x730x790x3C0x3C0x720x3F0x420x0D0x0E0x430x470x090x0A0x0E0x480x4C0x060x070x050x010x070x4F0x5D0x1D0x310x3C0x390x7A0x370x780x1B0x310x3F0x380x370x660x5E0x4D0x2C0x0B0x030x150x050x4A0x0A0x060x060x0E0x450x240x0E0x070x0B0x0C0x040x4A0x720x610x380x1F0x170x010x190x560x160x1A0x120x1A0x510x2C0xF40xF30xEB0xED0xE30xBE0x860x950xC40xE30xEB0xFD0xED0xA20xE20xEE0xFE0xF60xBD0xC00xED0xE60xE20xF20xF50xA20x9A0x890xD00xF70xFF0xE90xC10x8E0xD70xD70xCD0xC90x890xE60xDA0xDB0xCB0xD20xDF0x960xAE0xAE0xE60xB10xB40xE50xF80xFC0xFA0xFE0xF10xB90xBB0xE10xBC0xBF0xE40xF30xC00xC20x980x8F0x880xC50xC40x9C0x8A0xC90xC80x900x850xCD0xCF0xAE0xD00xD80xB30xA10xA60xB40xAF0xB40xB70xA90xA30xDB0xDD0xBF0xDE0xDA0x830x890x870x800x8F0xE50xE00x820x990x9C0x8B0x870x9F0xED0xE60x880x950x850xB00x8A0x800x900x850xF70xC40xF90xFD0xF50xFE0xE80x780xFD0x6B0xA50x000x160xC60x050x030x070x0F0x070x0A0x380x0D0x0D0x090x010x1F0x3C0x3C0x130x500x140x160x100x050x430x510x270x570x560x220x980x770x1E0x220x2B0x200x250x260x270x280x2E0x240x600x540x110xEA0x120x2E0x850x9D0x720x080x090x360x100x3A0x390x3A0x3C0x320x670x750xA90xF40xF50xD30x1C0x440x590x440x470x480x4E0x440x110x070x4C0x590x400x8E0x0C0x520x070x550x550x510x590x580x5B0x5A0x530x5C0x5D0x540x5E0x6A0x610xEA0xE30x600xF10x620x660xE90xE90x6E0xE30x690x6C0x640xCF0x750x700x7B0xCF0x710x740x7E0xD70x7E0x780x700xC30x7B0x7C0x740xC70x880x800x8B0x330x8D0x880x860x870x880x890x8A0x8B0x8C0x8C0x8E0x8F0x900x910x920x930x940x940x960x970x980x850x9A0x9B0x9C0xED0x9E0x9F0xA00xA30xA20xA30xA40xAE0xA60xA70xA80x490xAA0xAB0xAC0xAE0xAE0xAF0xB00xBB0xB20xB30xB40xB90xB70xB70xB80xBD0xBA0xBB0xBC0xBF0xBE0xBF0xC00x450xC30xC30xC40xC00xC60xC70xC80xC50xCA0xCB0xCC0x590xCF0xCF0xD00xD70xD20xD30xD40xD40xD60xD70xD80x2D0xDB0xDB0xDC0xDC0xFE0xDF0xE00xE90xE20xE30xE40xF10xE40xE70xE80xE80xFA0xEB0xEC0xE50xEE0xEF0xF00x110xF60xF30xF40xF70xD60xF70xF80xE50xFA0xFB0xFC0xD10xFB0xFF0x000x020x220x030x040x0D0x060x070x080x060x0C0x0B0x0C0x0D0x2E0x0F0x100x100x120x130x140x650x100x170x180x190x0A0x1B0x1C0x1C0x1E0x1F0x200xBD0x240x230x24]
 
= ''
= 233
for c in data:
    s += chr(c ^ (n & 0xff))
    n += 1
 
with open('real_check.dex''wb') as f:
    f.write(s)
cs


real_check source

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
package com.a;
 
import java.util.Arrays;
 
public class Check
{
  private static int[] a = { -1414812757-842150451-269488145305419896 };
  private static byte[] b = { 99124101-23-11481-47-39-102792252-39-94-66-72101-1873-2753-546-209711-5636-19-49-112-75 };
  
  private static int a(byte paramByte)
  {
    int i = paramByte;
    if (paramByte < 0) {
      i = paramByte + 256;
    }
    return i;
  }
  
  public static byte[] a(byte[] paramArrayOfByte)
  {
    int i = 8 - paramArrayOfByte.length % 8;
    byte[] arrayOfByte = new byte[paramArrayOfByte.length + i];
    arrayOfByte[0= ((byte)i);
    System.arraycopy(paramArrayOfByte, 0, arrayOfByte, i, paramArrayOfByte.length);
    paramArrayOfByte = new byte[arrayOfByte.length];
    i = 0;
    while (i < paramArrayOfByte.length)
    {
      System.arraycopy(a(arrayOfByte, i, a, 32), 0, paramArrayOfByte, i, 8);
      i += 8;
    }
    return paramArrayOfByte;
  }
  
  static byte[] a(byte[] paramArrayOfByte, int paramInt1, int[] paramArrayOfInt, int paramInt2)
  {
    paramArrayOfByte = a(paramArrayOfByte, paramInt1);
    int i = paramArrayOfByte[0];
    paramInt1 = paramArrayOfByte[1];
    int k = 0;
    int m = paramArrayOfInt[0];
    int n = paramArrayOfInt[1];
    int i1 = paramArrayOfInt[2];
    int i2 = paramArrayOfInt[3];
    int j = 0;
    while (j < paramInt2)
    {
      k -= 1640531527;
      i += ((paramInt1 << 4+ m ^ paramInt1 + k ^ (paramInt1 >> 5+ n);
      paramInt1 += ((i << 4+ i1 ^ i + k ^ (i >> 5+ i2);
      j += 1;
    }
    paramArrayOfByte[0= i;
    paramArrayOfByte[1= paramInt1;
    return a(paramArrayOfByte, 0);
  }
  
  private static byte[] a(int[] paramArrayOfInt, int paramInt)
  {
    byte[] arrayOfByte = new byte[paramArrayOfInt.length << 2];
    int i = 0;
    while (paramInt < arrayOfByte.length)
    {
      arrayOfByte[(paramInt + 3)] = ((byte)(paramArrayOfInt[i] & 0xFF));
      arrayOfByte[(paramInt + 2)] = ((byte)(paramArrayOfInt[i] >> 8 & 0xFF));
      arrayOfByte[(paramInt + 1)] = ((byte)(paramArrayOfInt[i] >> 16 & 0xFF));
      arrayOfByte[paramInt] = ((byte)(paramArrayOfInt[i] >> 24 & 0xFF));
      i += 1;
      paramInt += 4;
    }
    return arrayOfByte;
  }
  
  private static int[] a(byte[] paramArrayOfByte, int paramInt)
  {
    int[] arrayOfInt = new int[paramArrayOfByte.length >> 2];
    int i = 0;
    while (paramInt < paramArrayOfByte.length)
    {
      arrayOfInt[i] = (a(paramArrayOfByte[(paramInt + 3)]) | a(paramArrayOfByte[(paramInt + 2)]) << 8 | a(paramArrayOfByte[(paramInt + 1)]) << 16 | paramArrayOfByte[paramInt] << 24);
      i += 1;
      paramInt += 4;
    }
    return arrayOfInt;
  }
  
  public static boolean check(String paramString)
  {
    return Arrays.equals(a(paramString.getBytes()), b);
  }
}
 
cs


Solve

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
#include <stdio.h>
#include <stdlib.h>
 
void decrypt(int* enc, int n) 
{
    int table[] = { -1414812757-842150451-269488145305419896 };
    int sum = -957401312;
    unsigned int key = 1640531527;
    for (int i = 0; i < 32; i++) {
        enc[n + 1-= ((enc[n] << 4+ table[2]) ^ (enc[n] + sum) ^ ((enc[n] >> 5+ table[3]);
        enc[n] -= ((enc[n + 1<< 4+ table[0]) ^ (enc[n + 1+ sum) ^ ((enc[n + 1>> 5+ table[1]);
        sum += key;
    }
}
 
int main()
{
    int enc[] = { 99124101-23-11481-47-39-102792252-39-94-66-72101-1873-2753-546-209711-5636-19-49-112-75 };
    int shift[4= { 241680 };
    int byte[32 >> 2= { 0, };
 
    //byte_to_int
    int j = 0;
    for (int i = 0; i < 32; i += 4)
    {
        byte[j] = ((enc[i + 3& 0xff| ((enc[i + 2& 0xff<< 8| ((enc[i + 1& 0xff<< 16| ((enc[i] & 0xff<< 24));
        j += 1;
    }
 
    for (int i = 0; i < 8; i += 2)
        decrypt(byte, i);
 
    for (int i = 1; i < 8; i++)
    {
        for (int j = 0; j < 4; j++)
        {
            printf("%c", (byte[i] >> shift[j]) & 0xff);
        }
    }
    printf("\n");
    return 0;
}
cs

Flag = HITB{SEe!N9_IsN'T_bELIEV1Ng}

'CTF' 카테고리의 다른 글

[RCTF 2018] simple vm  (4) 2018.05.21
[ASIS CTF 2018] Density  (0) 2018.05.18
CODEGATE 2018 본선 후기  (1) 2018.04.06
[Codegate final 2018] Shall We Dance  (0) 2018.04.06
[Codegate final 2018] G0Crack  (0) 2018.04.06