suctf-2016：dmd-50

浅浅的花香味﹌ 2021-10-26 14:36 180阅读 0赞

下载附件，在Linux中运行观察。

![1718292-20190617170949441-1057361255.png][]

发现需要输入Key，猜测Key即为Flag。

将文件拖入IDA64反汇编观察代码

std::operator<<<std::char_traits<char>>(&std::cout, "Enter the valid key!\n", envp);
      std::operator>><char,std::char_traits<char>>(&edata, &v42);
      std::allocator<char>::allocator(&v38);
      std::string::string(&v39, &v42, &v38);
      md5(&v40, &v39);
      v41 = (_BYTE *)std::string::c_str((std::string *)&v40);
      std::string::~string((std::string *)&v40);
      std::string::~string((std::string *)&v39);
      std::allocator<char>::~allocator(&v38);

判断为MD5加密

结合上端代码，接着看如下代码

if ( *v41 != 55
        || v41[1] != 56
        || v41[2] != 48
        || v41[3] != 52
        || v41[4] != 51
        || v41[5] != 56
        || v41[6] != 100
        || v41[7] != 53
        || v41[8] != 98
        || v41[9] != 54
        || v41[10] != 101
        || v41[11] != 50
        || v41[12] != 57
        || v41[13] != 100
        || v41[14] != 98
        || v41[15] != 48
        || v41[16] != 56
        || v41[17] != 57
        || v41[18] != 56
        || v41[19] != 98
        || v41[20] != 99
        || v41[21] != 52
        || v41[22] != 102
        || v41[23] != 48
        || v41[24] != 50
        || v41[25] != 50
        || v41[26] != 53
        || v41[27] != 57
        || v41[28] != 51
        || v41[29] != 53
        || v41[30] != 99
        || v41[31] != 48 )

从if判断条件中，可以得知加密后的密文为 55，56，48...........

编写python获取密文字符串

md5 = [55, 56, 48, 52, 51, 56, 100, 53, 98, 54, 101, 50, 57, 100, 98,
           48, 56, 57, 56, 98, 99, 52, 102, 48, 50, 50, 53, 57, 51, 53, 99, 48]
    
    flag = ''
    
    for i in md5:
        flag += chr(i)
    
    print(flag)

输出：780438d5b6e29db0898bc4f0225935c0

打开MD5在线解密网站解密

![1718292-20190617172557323-1440963693.png][]

在Linux输入grape发现密钥错误

![1718292-20190617172747330-6938417.png][]

至此一度以为自己思路错误或者原始密文输入有误，后来了解 md5(md5($pass)) 的具体含义找出正确答案

md5(md5($pass)) ：第一次加密后，结果转换成小写，对结果再加密一次

则解密为：解密一次后，再解密一次

具体加密流程为：grape→b781cbb29054db12f88f08c6e161c199→780438d5b6e29db0898bc4f0225935c0

在线解密网站直接实现了两次解密，省略了中间值，而我们的程序只进行了一次MD5加密，所以当Key为b781cbb29054db12f88f08c6e161c199加密一次后，与780438d5b6e29db0898bc4f0225935c0相匹配，即可通过验证。

![1718292-20190617173955545-1891785368.png][]

提交flag，正确！

解题完毕。

收获：了解更多的加密算法细节

[https://www.cmd5.com/password.aspx\#type][https_www.cmd5.com_password.aspx_type]

转载于:https://www.cnblogs.com/MuZiShiYe/p/11041174.html

[1718292-20190617170949441-1057361255.png]: /images/20211026/48acf01b2a2b4958b0e99a1631a4f7bc.png
[1718292-20190617172557323-1440963693.png]: /images/20211026/a4b13f9632034ff688df897c3d06eea8.png
[1718292-20190617172747330-6938417.png]: /images/20211026/e7e414f12f684fdd9678ab6af9732def.png
[1718292-20190617173955545-1891785368.png]: /images/20211026/cc26fc528127465097d6099eedf348f1.png
[https_www.cmd5.com_password.aspx_type]: https://www.cmd5.com/password.aspx#type