前言
和 Nebula 的队员们一起参加了这次的 L3HCTF ，最后排名第7，很不错的成绩。记录一下我做的 re 。
比赛官网：https://l3hctf.xctf.org.cn
比赛时间：2021-11-13 09:00:00 到 2021-11-15 09:00:00
reverse
IDAAAAAA
没给程序，给了一个ida的i64文件，直接拖入ida。
正常流程分析下来，是输入三个整数，判断5个等式，但是无法同时满足，应该是程序将判断流程隐藏了，但是程序中找不到修改代码段的行为。
看反汇编窗口，发现main函数有一个断点，打开断点列表（ida开始卡了），发现condition里有东西，复制condition到文本编辑器（文本编辑器开始卡了），是一个很大的idapython脚本。
ida下断点在0x40201F，当执行到这条cmp时就触发断点，执行上面的脚本，在另一个位置下断点，获得断点信息，并修改断点添加condition为idapython脚本，之后修改[rsp]和rip的值使程序转到设置的断点，触发断点执行脚本，并根据输入的input[i]确定需要解密的index和key，使用sub_401DB5（维吉尼亚）解密，并且修改[rsp]设置返回地址，并在返回地址设置断点，解密完成后返回时触发断点，继续执行脚本，解密出来的数据将会作为下一个断点的脚本，而这个脚本又会重复上面的过程。
这样可知，原程序并不能判断flag，真正控制执行流程的是idapython脚本。
尝试了很久，除了第一个断点的脚本，几乎每个脚本解密出来都是这样的形式：
NyPGpw = idaapi.get_byte(5127584 + N4QKUt)
NyPGpw -= ord('a')
if NyPGpw == 0:
afvkwL = 667
hsYnNw = b'vjHiPd4bBuf'
elif NyPGpw == 1:
afvkwL = 667
hsYnNw = b'vjHiPd4bBuf'
elif NyPGpw == 2:
afvkwL = 667
hsYnNw = b'vjHiPd4bBuf'
else:
afvkwL = -1
if afvkwL < 0:
# ...
else:
# …
# ...
每个if/elif内部赋了两个值，第一个数值是需要解密的下一个脚本的序号index，第二个bytes是解密的密钥key；下面的if判断，如果序号为负，就直接结束；else块会解密出一个脚本，继续重复上述流程。
初始的断点脚本中间也有这样的if/elif结构，将if块的数据提取出来得：
[287, b'lqAT7pNI3BX']
[96, b'z3Uhis74aPq']
[8, b'9tjseMGBHR5']
[777, b'FhnvgMQjexH']
[496, b'SKnZ51f9WsE']
[822, b'gDJy104BSHW']
[914, b'PbRV4rSM7fd']
[550, b'WHPnoMTsbx3']
[273, b'mLx5hvlqufG']
[259, b'QvKgNmUFTnW']
[334, b'TCrHaitRfY1']
[966, b'm26IAvjq1zC']
[331, b'dQb2ufTZwLX']
[680, b'Y6Sr7znOeHL']
[374, b'hLFj1wl5A0U']
[717, b'H6W03R7TLFe']
[965, b'fphoJwDKsTv']
[952, b'CMF1Vk7NH4O']
[222, b'43PSbAlgLqj']
观察发现，每个解密的key长度都为11，而且解密出的第一行除了起始的变量名（变量名长度也都是6），后面是完全相同的，所以可以直接异或得到key：
keys = []
dec = 'NyPGpw = idaapi.get_byte(5127584 + N4QKUt)'[11: ]
for i in encs: # BIG bytes array, encrypted scripts, length 1000
enc = i.decode()[11: ]
t = ''
for a, b in zip(enc, dec):
t += chr(ord(a) ^ ord(b))
if not t[11: ].startswith(t[: 11]):
keys.append(None)
else:
keys.append(t[:11])
得到keys后，发现keys.count(None) == 1，再结合ida中最后flag的格式：
输入有最短，那么这应该是一个图问题，找最短路径，每个解密出来的脚本的if/elif块即为判断是否存在这条边，存在则进入下一节点。只有一个节点没有这个块，应该是图的终点。
于是编写脚本：
#!/usr/bin/python3
import networkx as nx
from hashlib import md5
encs = [
# BIG bytes array, encrypted scripts, length 1000
]
def veg_xor_crypt(src, key):
dec = b''
for i in range(len(src)):
dec += chr(src[i] ^ key[i % len(key)]).encode()
return dec.decode()
def parse_graph(script):
i_name = 'N4QKUt'
var_name = script[: script.index(' ')]
lines = script.splitlines()
if lines[0] == var_name + ' = idaapi.get_byte(5127584 + ' + i_name + ')':
if lines[1] == var_name + ' -= ord(\'a\')':
if lines[2] == 'if ' + var_name + ' == 0:':
# enc = [[int(lines[3][lines[3].index('=') + 2: ]), lines[4][lines[4].index('=') + 2:][2: -1].encode()]]
enc = [int(lines[3][lines[3].index('=') + 2: ])]
i = 5
while lines[i].startswith('elif ' + var_name + ' == '):
assert(int(lines[i][lines[i].index('==') + 3: -1]) == (i - 2) // 3)
enc.append(int(lines[i + 1][lines[i + 1].index('=') + 2: ]))
i += 3
assert(lines[i] == 'else:')
return enc
print("parse error: ")
print(script)
return None
keys = []
edges = []
dec = 'NyPGpw = idaapi.get_byte(5127584 + N4QKUt)'[11: ]
for i in encs:
enc = i.decode()[11: ]
t = ''
for a, b in zip(enc, dec):
t += chr(ord(a) ^ ord(b))
if not t[11: ].startswith(t[: 11]):
keys.append(None)
edges.append([])
else:
keys.append(t[:11])
edges.append(parse_graph(veg_xor_crypt(i, keys[-1].encode())))
assert(keys[8] == '9tjseMGBHR5')
assert(keys.count(None) == 1) # destination
dst_node = keys.index(None)
src_node = -1
src_edges = [287, 96, 8, 777, 496, 822, 914, 550, 273, 259, 334, 966, 331, 680, 374, 717, 965, 952, 222]
G = nx.DiGraph()
G.add_node(-1)
for i in range(len(encs)):
G.add_node(i)
for i in src_edges:
G.add_edge(-1, i)
for i in range(len(edges)):
for j in edges[i]:
G.add_edge(i, j)
path = nx.shortest_path(G, source = src_node, target = dst_node)
print(path)
s = chr(ord('a') + src_edges.index(path[1]))
for i in range(2, len(path)):
s += chr(ord('a') + edges[path[i - 1]].index(path[i]))
print(s)
print('L3HCTF{%s}' % md5(s.encode()).hexdigest())
执行结果：
[-1, 331, 578, 255, 875, 765, 687, 209, 119, 963, 939, 443, 250, 366, 65, 504, 920, 849, 720, 893, 728, 580, 114, 665, 72, 51, 241, 519, 473, 970, 984, 557, 90, 793, 487, 67, 428, 236, 263, 24, 39, 104, 505, 491, 95, 223, 486, 798, 873, 872, 64, 229, 37, 274, 329, 601, 372, 750, 446, 3, 332, 698, 277, 740, 816, 845, 570, 828, 21, 36, 839, 770, 343, 451, 151, 994, 937, 760, 644, 9, 614, 302, 454, 153, 840, 76, 424, 352, 950, 238, 613, 497, 898, 858, 415, 205, 393, 927, 522, 705, 426]
mcaebacedaabfacacabgagbbaaeacabcbacebagaaabcdbgbdbcbdacgabfbbebababbbbbcaabdababafaccacdagdaababaaaa
L3HCTF{6584ed9fd9497981117f22a6c572caee}
double-joy
主函数里初始化了两个vm，添加到一个deque中，然后执行第一个，当返回值为1时将刚执行的vm再加到deque末尾，返回值为0时不再添加，并重复上面的过程。所以是两个vm交替执行。
sub_1D90即为vm执行程序，将switch结构恢复出来，写idc脚本反汇编：
static disasm(addr) {
auto ins;
auto pc = 0;
auto tmp0, tmp1, tmp2, tmp3;
Message("Disasm 0x%x:\n", addr);
while (1) {
/*
origin stack after operation
top:
num1 ===> top:
num2 num1 op num2
... ...
/**/
ins = Byte(addr + pc);
if (ins == 0) {
Message("0x%04X: add\n", pc);
pc++;
} else if (ins == 1) {
Message("0x%04X: sub\n", pc);
pc++;
} else if (ins == 2) {
Message("0x%04X: mul\n", pc);
pc++;
} else if (ins == 3) {
Message("0x%04X: div\n", pc);
pc++;
} else if (ins == 4) {
Message("0x%04X: mod\n", pc);
pc++;
} else if (ins == 5) {
Message("0x%04X: and\n", pc);
pc++;
} else if (ins == 6) {
Message("0x%04X: or\n", pc);
pc++;
} else if (ins == 7) {
Message("0x%04X: xor\n", pc);
pc++;
} else if (ins == 8) {
Message("0x%04X: store\n", pc);
pc++;
} else if (ins == 9) {
Message("0x%04X: load\n", pc);
pc++;
} else if (ins == 10) {
Message("0x%04X: neq\n", pc);
pc++;
} else if (ins == 11) {
Message("0x%04X: lt\n", pc);
pc++;
} else if (ins == 12) {
Message("0x%04X: exch\n", pc);
pc++;
} else if (ins == 13) {
Message("0x%04X: pop\n", pc);
pc++;
} else if (ins == 14) {
Message("0x%04X: push 0x%x\n", pc, Dword(addr + pc + 1));
pc = pc + 5;
} else if (ins == 15) {
Message("0x%04X: jmp 0x%04X\n", pc, (pc + 5 + Dword(addr + pc + 1)) & 0xffffffff);
pc = pc + 5;
} else if (ins == 16) {
Message("0x%04X: jnz 0x%04X\n", pc, (pc + 5 + Dword(addr + pc + 1)) & 0xffffffff);
pc = pc + 5;
} else if (ins == 17) {
Message("0x%04X: int %d\n", pc, Dword(addr + pc + 1));
pc = pc + 5;
} else if (ins == 18) {
Message("0x%04X: ret %d\n", pc, Dword(addr + pc + 1));
pc = pc + 5;
if (Dword(addr + pc + 1) == 0) return ;
}
}
}
static main() {
disasm(0x5280);
disasm(0x5020);
Message("All done!\n");
}
然后读汇编，恢复出C程序：
#define CONTINUE 1
#define FINISH 0
int func1(int* buffer) {
// unsigned int buffer[10]; // stack[0] ~ stack[9]
int delta; // stack[0xa]
int sum; // stack[0xb]
int v0; // stack[0xc]
int v1; // stack[0xd]
int k[4]; // stack[0xe] ~ stack[0x11]
// stack[0x12] = 0; // ??
int i; // stack[0x13]
int j; // stack[0x14]
// unsigned int stack[21];
delta = 0x75bcd15;
sum = 0x3ade68b1;
for (i = 0; i < 10; i++) {
buffer[i] ^= ((i + 1) * 0x01010101);
}
k[0x0] = 0x494c;
k[0x1] = 0x6f76;
k[0x2] = 0x6520;
k[0x3] = 0x4355;
for (i = 0; i < 10; i += 2) {
for (j = 0; j < 20; j++) {
v0 = buffer[i];
v1 = buffer[i + 1];
v0 += (((v1 * 16) ^ (v1 / 32) + v1) ^ (sum + k[sum & 3]));
sum += delta;
v1 += (((v0 * 16) ^ (v0 / 32)) + v0) ^ (sum + k[(sum / 0x800) & 3]);
buffer[i] = v0;
buffer[i + 1] = v1;
return CONTINUE;
}
}
return FINISH;
}
int func2(int* buffer) {
// int buffer[10]; // stack[0] ~ stack[9]
int delta; // stack[0xa]
int sum; // stack[0xb]
int v0; // stack[0xc]
int v1; // stack[0xd]
int k[4]; // stack[0xe] ~ stack[0x11]
// stack[0x12] = 0; // ??
int i; // stack[0x13]
int j; // stack[0x14]
delta = 0x154cbf7;
sum = 0x5eeddead;
for (i = 0; i < 10; i++) {
buffer[i] ^= ((i + 1) * 0x01010101);
}
for (i = 0; i < 10; i += 2) {
for (j = 0; j < 20; j++) {
v0 = buffer[i];
v1 = buffer[i + 1];
sum += delta;
v0 += (v1 * 16 + k[0]) ^ (v1 + sum) ^ (v1 / 32 + k[1]);
v1 += (v0 * 16 + k[2]) ^ (v0 + sum) ^ (v0 / 32 + k[3]);
buffer[i] = v0;
buffer[i + 1] = v1;
return CONTINUE;
}
}
return FINISH;
}
发现是xtea和tea，编写逆向程序：
#include <stdio.h>
int main() {
int buffer[11] = {
0xAEE0FAE8, 0xFC3E4101, 0x167CAD92, 0x51EA6CBE,
0x242A0100, 0x01511A1B, 0x514D6694, 0x2F5FBFEB,
0x46D36398, 0x79EEE3F0, 0
};
int delta_1 = 0x75bcd15, delta_2 = 0x154cbf7;
int sum_1 = 0x3ade68b1, sum_2 = 0x5eeddead;
int v0;
int v1;
int k_1[4] = {0x494c, 0x6f76, 0x6520, 0x4355};
int k_2[4] = {0x5354, 0x4f4d, 0x2074, 0x6561};
int i;
int j;
// init
for (i = 0; i < 10; i += 2) {
for (j = 0; j < 20; j++) {
sum_1 += delta_1;
sum_2 += delta_2;
}
}
// func1 and func2
for (i = 8; i >= 2; i -= 2) {
for (j = 0; j < 20; j++) {
v0 = buffer[i];
v1 = buffer[i + 1];
v1 -= (v0 * 16 + k_2[2]) ^ (v0 + sum_2) ^ (v0 / 32 + k_2[3]);
v0 -= (v1 * 16 + k_2[0]) ^ (v1 + sum_2) ^ (v1 / 32 + k_2[1]);
sum_2 -= delta_2;
buffer[i] = v0;
buffer[i + 1] = v1;
v0 = buffer[i];
v1 = buffer[i + 1];
v1 -= (((v0 * 16) ^ (v0 / 32)) + v0) ^ (sum_1 + k_1[(sum_1 / 0x800) & 3]);
sum_1 -= delta_1;
v0 -= (((v1 * 16) ^ (v1 / 32)) + v1) ^ (sum_1 + k_1[sum_1 & 3]);
buffer[i] = v0;
buffer[i + 1] = v1;
}
}
i = 0;
// func1 and func2
for (j = 1; j < 20; j++) {
v0 = buffer[i];
v1 = buffer[i + 1];
v1 -= (v0 * 16 + k_2[2]) ^ (v0 + sum_2) ^ (v0 / 32 + k_2[3]);
v0 -= (v1 * 16 + k_2[0]) ^ (v1 + sum_2) ^ (v1 / 32 + k_2[1]);
sum_2 -= delta_2;
buffer[i] = v0;
buffer[i + 1] = v1;
v0 = buffer[i];
v1 = buffer[i + 1];
v1 -= (((v0 * 16) ^ (v0 / 32)) + v0) ^ (sum_1 + k_1[(sum_1 / 0x800) & 3]);
sum_1 -= delta_1;
v0 -= (((v1 * 16) ^ (v1 / 32)) + v1) ^ (sum_1 + k_1[sum_1 & 3]);
buffer[i] = v0;
buffer[i + 1] = v1;
}
// func2
v0 = buffer[0];
v1 = buffer[1];
v1 -= (v0 * 16 + k_2[2]) ^ (v0 + sum_2) ^ (v0 / 32 + k_2[3]);
v0 -= (v1 * 16 + k_2[0]) ^ (v1 + sum_2) ^ (v1 / 32 + k_2[1]);
sum_2 -= delta_2;
buffer[0] = v0;
buffer[1] = v1;
for (i = 0; i < 10; i++) {
buffer[i] ^= ((i + 1) * 0x01010101);
}
// func1
v0 = buffer[0];
v1 = buffer[1];
v1 -= (((v0 * 16) ^ (v0 / 32)) + v0) ^ (sum_1 + k_1[(sum_1 / 0x800) & 3]);
sum_1 -= delta_1;
v0 -= (((v1 * 16) ^ (v1 / 32)) + v1) ^ (sum_1 + k_1[sum_1 & 3]);
buffer[0] = v0;
buffer[1] = v1;
for (i = 0; i < 10; i++) {
buffer[i] ^= ((i + 1) * 0x01010101);
}
puts((char*) buffer);
}
得到flag：L3HCTF{D0uBle_vM_W1th_dOubIe_TEA}
Load
拖入ida，sub_401000计算了一些值，与输入无关，然后输入被映射到名为l3hsec的 MapViewOfFile上，进入sub_401290，做了一些操作后判断一个值是否为0x4550，转为char[]为PE\x00\x00，正是exe文件的一个头，而sub_4017F0中将byte_404020数组解密，总共长度为10752，很大，很可疑，于是x86dbg动态调试，下断点在上面的比较位置，内存转到byte_404020，正是熟悉的MZ...PE...头，于是dump出来，在010中将MZ前面的所有字节去掉，拖入ida，判断逻辑有了。
先通过MapViewOfFile重新得到输入的flag，将flag{…}中间的字节提取，每两个16进制转为一个新的字节值（长度26 / 2 = 13），保存到一个长为9和另一个长为4的数组中，然后进入函数sub_401370变换，没完全分析这个函数，只认真看了调用的sub_4012A0函数，在草稿纸上画一下维度为2时的结果就可以知道这是det，求矩阵行列式的函数，sub_401370没仔细看了，跟delta相关的操作应该就是求逆了。
用软件求出目标矩阵的逆矩阵，再写脚本获得flag：
#!/usr/bin/python
part1 = [-8, 18, -9, 6, -13, 6, -1, 2, -1]
part2 = [13, -3, -30, 7]
flag = 'flag{'
for i in part1:
flag += '%02x' % (i & 0xff)
for i in part2:
flag += '%02x' % (i & 0xff)
print(flag + '}')
luuuuua
真机下安装apk并运行，点按钮后会闪退。
题目说是lua脚本，在assets中查找，两个文件，一个logo.jpg，另一个test.lua， test.lua中的判断只有base64，解码后提交不正确，显然test.lua跟本题无关。
logo.jpg拖入010，尾部有一些多余的数据，这可能是加密的脚本。jadx中搜索logo.jpg，除了onCreate中设置ImageView外，lua的解析部分也有一处：
调用了getExternalFilesDir函数，但是运行程序后到/sdcard/Android/data/com.l3hsec.luuuuua/files目录下查看并没有文件，猜测这就是运行时闪退的原因，尝试将文件复制到此目录，再运行，正常了。
jadx跟入LdoFile，调用了native函数_LdoFile，ida中打开armeabi-v7a下的 libluajava.so，找到jni_LdoFile，进入sub_9BA4，看到如下代码：
010中可以看到，jpg的有效大小刚好是0x3AFA1，那么后面的部分就是加密的lua脚本。
继续分析，sub_9D80读入了一个字节，判断该字节的值；sub_9DFC中执行解密：
解密方式就是异或0x3C，尝试发现第一个字节不用异或，只有后面的字节需要，这样得到文件头部：\x1bLuaS，luac脚本。尝试luadec反编译，失败，应该是改变了字节码的对应关系。
为了恢复出改变后的字节码与原字节码的对应关系，将一个编译好的lua可执行文件拖入ida（带符号信息，下载编译lua参考 https://www.lua.org/download.html#building ，改成5.3版本即可），找到luaV_execute函数；同时将apk中x86-64的libluajava.so拖入ida，通过字符串'for' limit must be a number的交叉引用定位到luaV_execute函数，再在两个函数的switch块找对应的opcode。
这里找对应关系有一些小技巧，比如我先找出两个switch中的没有if判断的case块，各有5个，再比较这几个的代码，对应关系就容易找到；还有相同字符串常量出现的case块有对应关系；还有根据带符号的程序恢复出另一个程序的一些函数名，再在luaV_execute函数中找调用了相同函数的case块等等。
找了一些对应关系后就可以发现规律，再在解密出来的luac脚本中找到几个函数的位置，使用010 script修复opcode：
char table[47];
int i;
for (i = 0; i < 16; i++) table[i] = i + 13;
table[16] = 0;
for (i = 17; i < 34; i++) table[i] = i + 12;
table[34] = 0x3f;
for (i = 35; i < 47; i++) table[i] = i - 34;
int filesize = FileSize();
int poses[20] = {
0x0037, 0x02C1, 0x0392, 0x04E4,
0x0928, 0x0A7C, 0x10C0, 0x19EF,
0x1B15, 0x1CF8, 0x1DF8, 0x1F3E,
0x2200, 0x2419, 0x288A
};
int pos = 0x37;
int size;
int j;
char ins;
char type;
for (i = 0; i < 15; i++) {
pos = poses[i];
size = ReadInt(pos);
pos += 4;
Printf("Start patching codes at 0x%x, size: %d, stack size: %d.\n", pos, size, ReadByte(pos - 5));
for (j = 0; j < size; j++) {
ins = ReadByte(pos + 4 * j);
WriteByte(pos + 4 * j, table[ins & 0x3f] | (ins & 0xC0));
}
}
修复后就能使用luadec反编译了：
~/luadec/luadec/luadec ./test.luac > test.lua
得到lua脚本：
-- Decompiled using luadec 2.2 rev: 895d923 for Lua 5.3 from https://github.com/viruscamp/luadec
-- Command line: ./sth.luac
-- params : ...
-- function num : 0 , upvalues : _ENV
local base64 = {}
if _G.bit32 then
local extract = (_G.bit32).extract
end
if not extract then
if _G.bit then
local shl, shr, band = (_G.bit).lshift, (_G.bit).rshift, (_G.bit).band
do
extract = function(v, from, width)
-- function num : 0_0 , upvalues : band, shr, shl
return band(shr(v, from), shl(1, width) - 1)
end
end
else
do
if _G._VERSION == "Lua 5.1" then
extract = function(v, from, width)
-- function num : 0_1
local w = 0
local flag = 2 ^ from
for i = 0, width - 1 do
local flag2 = flag + flag
if flag <= v % flag2 then
w = w + 2 ^ i
end
flag = flag2
end
return w
end
else
extract = (load("return function( v, from, width )\n\t\t\treturn ( v >> from ) & ((1 << width) - 1)\n\t\tend"))()
end
base64.makeencoder = function(s62, s63, spad)
-- function num : 0_2 , upvalues : _ENV
local encoder = {}
for b64code,char in pairs({"B", "C", "D", "E", "F", "G", "H", "I", "J", "K", "L", "M", "N", "O", "P", "Q", "R", "S", "T", "U", "V", "W", "X", "Y", "Z", "a", "b", "c", "d", "e", "f", "g", "h", "i", "j", "k", "l", "m", "n", "o", "p", "q", "r", "s", "t", "u", "v", "w", "x", "y", "z", "0", "1", "2", "3", "4", "5", "6", "7", "8", "9", s62 or "+", s63 or "/", spad or "="; [0] = "A"}) do
encoder[b64code] = char:byte()
end
return encoder
end
base64.makedecoder = function(s62, s63, spad)
-- function num : 0_3 , upvalues : _ENV, base64
local decoder = {}
for b64code,charcode in pairs((base64.makeencoder)(s62, s63, spad)) do
decoder[charcode] = b64code
end
return decoder
end
local DEFAULT_ENCODER = (base64.makeencoder)()
local DEFAULT_DECODER = (base64.makedecoder)()
local char, concat = string.char, table.concat
base64.encode = function(str, encoder, usecaching)
-- function num : 0_4 , upvalues : DEFAULT_ENCODER, char, extract, concat
if not encoder then
encoder = DEFAULT_ENCODER
end
local t, k, n = {}, 1, #str
local lastn = n % 3
local cache = {}
for i = 1, n - lastn, 3 do
local a, b, c = str:byte(i, i + 2)
local v = a * 65536 + b * 256 + c
local s = nil
if usecaching then
s = cache[v]
if not s then
s = char(encoder[extract(v, 18, 6)], encoder[extract(v, 12, 6)], encoder[extract(v, 6, 6)], encoder[extract(v, 0, 6)])
cache[v] = s
end
else
s = char(encoder[extract(v, 18, 6)], encoder[extract(v, 12, 6)], encoder[extract(v, 6, 6)], encoder[extract(v, 0, 6)])
end
t[k] = s
k = k + 1
end
if lastn == 2 then
local a, b = str:byte(n - 1, n)
local v = a * 65536 + b * 256
t[k] = char(encoder[extract(v, 18, 6)], encoder[extract(v, 12, 6)], encoder[extract(v, 6, 6)], encoder[64])
else
do
do
if lastn == 1 then
local v = str:byte(n) * 65536
t[k] = char(encoder[extract(v, 18, 6)], encoder[extract(v, 12, 6)], encoder[64], encoder[64])
end
return concat(t)
end
end
end
end
base64.decode = function(b64, decoder, usecaching)
-- function num : 0_5 , upvalues : DEFAULT_DECODER, _ENV, char, extract, concat
if not decoder then
decoder = DEFAULT_DECODER
end
local pattern = "[^%w%+%/%=]"
do
if decoder then
local s62, s63 = nil, nil
for charcode,b64code in pairs(decoder) do
if b64code == 62 then
s62 = charcode
else
if b64code == 63 then
s63 = charcode
end
end
end
pattern = ("[^%%w%%%s%%%s%%=]"):format(char(s62), char(s63))
end
b64 = b64:gsub(pattern, "")
if usecaching then
local cache = {}
end
local t, k = {}, 1
local n = #b64
local padding = (b64:sub(-2) == "==" and 2) or (b64:sub(-1) == "=" and 1) or 0
for i = 1, padding > 0 and n - 4 or n, 4 do
local a, b, c, d = b64:byte(i, i + 3)
local s = nil
if usecaching then
local v0 = a * 16777216 + b * 65536 + c * 256 + d
s = cache[v0]
if not s then
local v = decoder[a] * 262144 + decoder[b] * 4096 + decoder[c] * 64 + decoder[d]
s = char(extract(v, 16, 8), extract(v, 8, 8), extract(v, 0, 8))
cache[v0] = s
end
else
do
do
do
local v = decoder[a] * 262144 + decoder[b] * 4096 + decoder[c] * 64 + decoder[d]
s = char(extract(v, 16, 8), extract(v, 8, 8), extract(v, 0, 8))
t[k] = s
k = k + 1
-- DECOMPILER ERROR at PC143: LeaveBlock: unexpected jumping out DO_STMT
-- DECOMPILER ERROR at PC143: LeaveBlock: unexpected jumping out DO_STMT
-- DECOMPILER ERROR at PC143: LeaveBlock: unexpected jumping out IF_ELSE_STMT
-- DECOMPILER ERROR at PC143: LeaveBlock: unexpected jumping out IF_STMT
end
end
end
end
end
if padding == 1 then
local a, b, c = b64:byte(n - 3, n - 1)
local v = decoder[a] * 262144 + decoder[b] * 4096 + decoder[c] * 64
t[k] = char(extract(v, 16, 8), extract(v, 8, 8))
else
do
if padding == 2 then
local a, b = b64:byte(n - 3, n - 2)
local v = decoder[a] * 262144 + decoder[b] * 4096
t[k] = char(extract(v, 16, 8))
end
do
return concat(t)
end
end
end
end
end
local strf = string.format
local byte, char = string.byte, string.char
local spack, sunpack = string.pack, string.unpack
local app, concat = table.insert, table.concat
local stohex = function(s, ln, sep)
-- function num : 0_6 , upvalues : strf, byte, concat
if #s == 0 then
return ""
end
if not ln then
return s:gsub(".", function(c)
-- function num : 0_6_0 , upvalues : strf, byte
return strf("%02x", byte(c))
end
)
end
if not sep then
sep = ""
end
local t = {}
for i = 1, #s - 1 do
t[#t + 1] = strf("%02x%s", s:byte(i), i % ln == 0 and "\n" or sep)
end
t[#t + 1] = strf("%02x", s:byte(#s))
return concat(t)
end
local hextos = function(hs, unsafe)
-- function num : 0_7 , upvalues : _ENV, char
local tonumber = tonumber
if not unsafe then
hs = (string.gsub)(hs, "%s+", "")
if (string.find)(hs, "[^0-9A-Za-z]") or #hs % 2 ~= 0 then
error("invalid hex string")
end
end
return hs:gsub("(%x%x)", function(c)
-- function num : 0_7_0 , upvalues : char, tonumber
return char(tonumber(c, 16))
end
)
end
local stx = stohex
local xts = hextos
local ROUNDS = 64
local keysetup = function(key)
-- function num : 0_8 , upvalues : _ENV, sunpack, ROUNDS
assert(#key == 16)
local kt = {0, 0, 0, 0}
kt[1] = sunpack(">I4I4I4I4", key)
local skt0 = {}
local skt1 = {}
local sum, delta = 0, 2654435769
for i = 1, ROUNDS do
skt0[i] = sum + kt[(sum & 3) + 1]
sum = sum + delta & 4294967295
skt1[i] = (sum) + kt[((sum) >> 11 & 3) + 1]
end
do return {skt0 = skt0, skt1 = skt1} end
-- DECOMPILER ERROR: 1 unprocessed JMP targets
end
local encrypt_u64 = function(st, bu)
-- function num : 0_9 , upvalues : ROUNDS
local skt0, skt1 = st.skt0, st.skt1
local v0, v1 = bu >> 32, bu & 4294967295
local sum, delta = 0, 2654435769
for i = 1, ROUNDS do
v0 = v0 + ((v1 << 4 ~ v1 >> 5) + v1 ~ skt0[i]) & 4294967295
v1 = v1 + (((v0) << 4 ~ (v0) >> 5) + (v0) ~ skt1[i]) & 4294967295
end
bu = (v0) << 32 | v1
return bu
end
local enc = function(key, iv, itxt)
-- function num : 0_10 , upvalues : _ENV, sunpack, keysetup, encrypt_u64, spack, app, concat
assert(#key == 16, "bad key length")
assert(#iv == 8, "bad IV length")
if #itxt == 0 then
return ""
end
local ivu = sunpack("<I8", iv)
local ot = {}
local rbn = #itxt
local ksu, ibu, ob = nil, nil, nil
local st = keysetup(key)
for i = 1, #itxt, 8 do
ksu = encrypt_u64(st, ivu ~ i)
if rbn < 8 then
local buffer = (string.sub)(itxt, i) .. (string.rep)("\000", 8 - rbn)
ibu = sunpack("<I8", buffer)
ob = (string.sub)(spack("<I8", ibu ~ ksu), 1, rbn)
else
ibu = sunpack("<I8", itxt, i)
ob = spack("<I8", ibu ~ ksu)
rbn = rbn - 8
end
app(ot, ob)
end
do return concat(ot) end
-- DECOMPILER ERROR: 5 unprocessed JMP targets
end
check_login = function(username, password)
-- function num : 0_11 , upvalues : base64, enc
local encoded = (base64.encode)(username)
if encoded ~= "TDNIX1NlYw==" then
return false
end
username = username .. "!@#$%^&*("
local x = (base64.encode)(enc(username, "1qazxsw2", password))
if x == "LKq2dSc30DKJo99bsFgTkQM9dor1gLl2rejdnkw2MBpOud+38vFkCCF13qY=" then
return true
end
return false
end
end
end
end
读代码发现enc函数只是固定值异或明文，所以将密文加密一次即可解密。将enc前的local去掉，最后添加一行：
print(enc("L3H_Sec!@#$%^&*(", "1qazxsw2", ",\xaa\xb6u'7\xd02\x89\xa3\xdf[\xb0X\x13\x91\x03=v\x8a\xf5\x80\xb9v\xad\xe8\xdd\x9eL60\x1aN\xb9\xdf\xb7\xf2\xf1d\x08!u\xde\xa6"))
运行后输出乱码，读代码时就觉得有个地方很奇怪，是keysetup中的这行：
kt[1] = sunpack(">I4I4I4I4", key)
应该是luadec反编译出错了，将其改为：
kt[1], kt[2], kt[3], kt[4] = sunpack(">I4I4I4I4", key)
运行脚本，得到flag：L3HCTF{20807a82-fcd7-4947-841e-db4dfe95be3e}
总结
题目总体较难，中途不止一次被卡住，还要多学习。