XCTF攻防世界--(新手赛区)第2题快来围观学习!

发布者:极安御信
发布于:2022-05-20 15:31

解题方法写在代码注释里了
题目:

 

#include

#include

//大概阅读整体代码,通过最后几行代码我们得知我们需要的flag就是代码中的hash变量

//此时我们逆向推到hash变量的来源

//1.hash值由fist、second和argv[3]三个变量来决定,那我们就跟踪这三个变量

//2.fist变量在第二个if语句中,提示如果first不等于0xcafe的话就退出程序,那我们按照作者意思肯定要让程序执行到显示flag

//那就必须使first=0xcafe

//3.接下来我们再找着second变量,发现second在第三个if语句,提示如果second % 5 == 3 || second % 17 != 8的话就退出,我们目的

//就是执行到最后,那我们就直接用穷举法找到一个数满足second % 5 != 3 && second % 17 == 8

//函数:                unsigned int GetNum = 0;

//                                do{

//                                        if(GetNum % 5 != 3 && GetNum % 17 == 8)

//                                                        {

//                                                                printf("GetNum:%d",GetNum);

//                                                                break;

//                                                        }

//                                        GetNum++;

//                                        }while(1);

//最后得到GetNum = 25,也就是second是25

//4.最后argv[3]可从最后一个if得知argv[3]=h4cky0u

//5.那我们带进hash中去算

//unsigned int hash =0xcafe * 31337 + (25 % 17) * 11 + strlen("h4cky0u") - 1615810207;

//注意最后一行代码要以十六进制输出才能得到flag

//z最后flag为c0ffee

//6.提交显示正确了

int main(int argc, char *argv[]) {

        if (argc != 4) {

                printf("what?\n");

                exit(1);

        }

 

        unsigned int first = atoi(argv[1]);

        if (first != 0xcafe) {

                printf("you are wrong, sorry.\n");

                exit(2);

        }

 

        unsigned int second = atoi(argv[2]);

        if (second % 5 == 3 || second % 17 != 8) {

                printf("ha, you won't get it!\n");

                exit(3);

        }

 

        if (strcmp("h4cky0u", argv[3])) {

                printf("so close, dude!\n");

                exit(4);

        }

 

        printf("Brr wrrr grr\n");

 

        unsigned int hash = first * 31337 + (second % 17) * 11 + strlen(argv[3]) - 1615810207;

 

        printf("Get your key: ");

        printf("%x\n", hash);

        return 0;

}



声明:该文观点仅代表作者本人,转载请注明来自看雪