Description
이 문제는 사용자에게 문자열 입력을 받아 입력값을 검증하고 플래그를 출력하는 프로그램이 주어집니다.
해당 바이너리를 분석하여 플래그를 찾으세요!
플래그 형식은 DH{…} 입니다.
Files
chall: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=8f6e0c1b173c41785a0221d32ab8dc81a63e1f13, for GNU/Linux 3.2.0, not stripped
64비트 리눅스용 실행 파일
Solution
result = [0x39, 0xFFFFFF9B, 0x2C, 0xC6, 0x59, 0x58, 0x39, 0xAB,\ 0xFFFFFFCE, 0xC6, 0x18c, 0x190, 0xFFFFFFDA, 0x73, 0x52, 0x66] result_2 = [0xFFFFFFAB, 0xFFFFFFAF, 0xFFFFFFD9, 0xFFFFFFAD, 0xFFFFFFAE, 0xFFFFFFB0, 0xFFFFFFB2, 0xFFFFFFE0,\ 0xFFFFFFE2, 0xFFFFFFE1] result_3 = [0x4F, 0x53, 0x4C, 0x53, 0x4F, 0x57, 0x83, 0x54, 0x59, 0x87] result_4 = [0xC, 0x13, 0x3E, 0x3B, 0x3E, 0x39, 0x3A, 0x38, 0xD, 0x34] result_5 = [0x958, 0x92e, 0xa20, 0x12f3, 0xaf0, 0x1452, 0xb94, 0x14b4, 0xa56, 0xb9a] result_6 = [0x63, 0x5f, 0x8f, 0x59, 0x8c, 0x89, 0x8c, 0x55, 0x24] flag = [] def solve_check(): flag.append(result[0] - 9) flag.append((result[1] - 0xffffffff) * -1) flag.append(result[2] + 4) flag.append(int(result[3]/2)) flag.append(result[4] - 34) flag.append(result[5] - 40) flag.append(result[6] + 40) flag.append(int(result[7]/3)) flag.append((result[8] - 0xffffffff) * -1) flag.append(int(result[9]/2)) flag.append(int(result[10]/4)) flag.append(int(result[11]/4)) flag.append(19 - result[12] + 0xffffffff + 1) flag.append(result[13]-17) flag.append(result[14]-30) flag.append(result[15]) def solve_check_not(): for i in range(len(result_2)): j = i + 16 flag.append((result_2[i] - j - 0xffffffff) * -1) def solve_check_add(): for i in range(len(result_3)): j = i + 26 flag.append(result_3[i] - j) def solve_check_dec(): for i in range(len(result_4)): j = i + 36 flag.append(result_4[i] + j) def solve_check_mul(): for i in range(len(result_5)): j = i + 46 flag.append(int(result_5[i] / j)) def solve_check_la(): for i in range(len(result_6)): j = i + 56 flag.append((result_6[i] + j - 100) ) solve_check() solve_check_not() solve_check_add() solve_check_dec() solve_check_mul() solve_check_la() for i in range(len(flag)): print(chr(flag[i]), end='') print("")
아주 쉽게 역산을 통해 플래그를 구할 수 있었다.
Flag
ubuntu@29c7cfc91700:~/CTF/dreamhack.io/mix-compare$ ./chall Input: 0d0c70a91ccd9b4fda8eedc657580618c37d08dbfbdc9a426c8f9d1674e0dbf0 Nice! Flag is DH{0d0c70a91ccd9b4fda8eedc657580618c37d08dbfbdc9a426c8f9d1674e0dbf0}
DH{0d0c70a91ccd9b4fda8eedc657580618c37d08dbfbdc9a426c8f9d1674e0dbf0}