攻防世界 reverse 进阶 APK-逆向2

APK-逆向2 Hack-you-2014

（看名以为是安卓逆向呢0.0，搞错了吧）

程序是.net写的，直接祭出神器dnSpy

using System;
using System.Diagnostics;
using System.IO;
using System.Net.Sockets;
using System.Text;

namespace Rev_100
{
    // Token: 0x02000002 RID: 2
    internal class Program
    {
        // Token: 0x06000001 RID: 1 RVA: 0x00002050 File Offset: 0x00000250
        private static void Main(string[] args)
        {
            string hostname = "127.0.0.1";
            int port = 31337;
            TcpClient tcpClient = new TcpClient();
            try
            {
                Console.WriteLine("Connecting...");
                tcpClient.Connect(hostname, port);
            }
            catch (Exception)
            {
                Console.WriteLine("Cannot connect!
Fail!");
                return;
            }
            Socket client = tcpClient.Client;
            string text = "Super Secret Key";
            string text2 = Program.read();
            client.Send(Encoding.ASCII.GetBytes("CTF{"));
            foreach (char x in text)
            {
                client.Send(Encoding.ASCII.GetBytes(Program.search(x, text2)));
            }
            client.Send(Encoding.ASCII.GetBytes("}"));
            client.Close();
            tcpClient.Close();
            Console.WriteLine("Success!");
        }

        // Token: 0x06000002 RID: 2 RVA: 0x0000213C File Offset: 0x0000033C
        private static string read()
        {
            string fileName = Process.GetCurrentProcess().MainModule.FileName;
            string[] array = fileName.Split(new char[]
            {
                '\'
            });
            string path = array[array.Length - 1];
            string result = "";
            using (StreamReader streamReader = new StreamReader(path))
            {
                result = streamReader.ReadToEnd();
            }
            return result;
        }

        // Token: 0x06000003 RID: 3 RVA: 0x000021B0 File Offset: 0x000003B0
        private static string search(char x, string text)
        {
            int length = text.Length;
            for (int i = 0; i < length; i++)
            {
                if (x == text[i])
                {
                    int value = i * 1337 % 256;
                    return Convert.ToString(value, 16).PadLeft(2, '0');
                }
            }
            return "??";
        }
    }
}

直接相当于源码

最简单的方案就是用python开个服务：

import http.server

server_address = ('127.0.0.1', 31337)
handler_class = http.server.BaseHTTPRequestHandler
httpd = http.server.HTTPServer(server_address, handler_class)
httpd.serve_forever()

运行程序，直接得到flag

用python重写算法：

text='Super Secret Key'
f=open(r'D:UsersDesktop攻防世界
e进阶e669ad3bcd324237b73382a2bdc6e330.exe','r',encoding='unicode-escape')
text2=f.read()
f.close()
def serch(x,text):
    length=len(text)
    for i in range(length):
        if x==text[i]:
            v=i*1337%256
            return '%02x' % (v)
y=''
for t in text:
    y+=serch(t,text2)
print('CTF{'+y+'}')

CTF{7eb67b0bb4427e0b43b40b6042670b55}