hgame WP

Britney2025-02-262025-02-26

Misc

`Computer cleaner`

检材删掉了（呜呜呜，硬盘要被我塞满了

vmware打开虚拟机发现apache2服务，找到log，发现php得到第一段flag

直接访问攻击者ip得到第二段

log里面看到对一个文件进行操作，得到第三段flag

‍

WEB

`Level 24 Pacman`

js被混淆了，不过只看字符串发现几个base64加密后的字符串，尝试解密

RE

`尊嘟假嘟`

jadx打开，分析下

1个activity有两种Fragment

21e2cc4e89a61bd9a674ae45c392c34e

一个尊都一个假嘟

看下具体逻辑

按钮和ImageView注册了点击事件，还有个自定义toast，进去看下

发现关键check，跟进

动态加载dex

assets里面发现加密后的dex

这里其实方法有很多

1.frida hook loadDexFile通杀动态加载dex

2.修改smali，不让dex删除

3.分析so算法，进行解密

4.内存dump

一个base64算法

接下来分析check

jni_onload动态注册，init_array也没有骚操作

算法挺简单的，标准rc4

密码是这里的ZunduJiadu经过上面的base64算法编码的结果

密码不确定，只能爆破了

import java.util.Arrays;

public class Main {
    static String str1 = "0.o";
    static String str2 = "o.0";
    static String str3 = "The length is too large";
    public static void main(String[] args) {
        zundujiadu zundujiadu = new zundujiadu();
        generate("",0);
        generate(str3,9);
    }

    public static String generate(String str,int i) {
        if (i==12) {
            return str;
        }

        System.out.println(zundujiadu.encode(str+str1.toString()));
        System.out.println(zundujiadu.encode(str+str2.toString()));

        generate(str+str1,i+1);
        generate(str+str2,i+1);
        return str;
    }
}

获取所有可能的key，批量解密，得到flag

‍

`Turtle`

有个upx壳，修复了特征upx -d还是脱不下来，只好手脱了，参考upx手动脱壳及其UPX修改的特征.note

经过了两次rc4，直接解密即可

def rc4_decrypt(cipher, key):
    S = list(range(256))
    j = 0
    # KSA
    for i in range(256):
        j = (j + S[i] + key[i % len(key)]) % 256
        S[i], S[j] = S[j], S[i]
  
    # PRGA
    i = j = 0
    plain = []
    for byte in cipher:
        i = (i + 1) % 256
        j = (j + S[i]) % 256
        S[i], S[j] = S[j], S[i]
        k = S[(S[i] + S[j]) % 256]
        plain.append(byte ^ k)
    return bytes(plain)

# 解密Key
key1 = b"yekyek"
cipher_key = bytes([0xCD, 0x8F, 0x25, 0x3D, 0xE1, 0x51, 0x4A])
decrypted_key = rc4_decrypt(cipher_key, key1)
print(f"Decrypted Key: {decrypted_key}")

def rc4_decryp1(cipher, key):
    S = list(range(256))
    j = 0
    # KSA
    for i in range(256):
        j = (j + S[i] + key[i % len(key)]) % 256
        S[i], S[j] = S[j], S[i]
  
    # PRGA
    i = j = 0
    plain = []
    for byte in cipher:
        i = (i + 1) % 256
        j = (j + S[i]) % 256
        S[i], S[j] = S[j], S[i]
        k = S[(S[i] + S[j]) % 256]
        plain.append((byte + k)%256)
    return bytes(plain)
# 解密Flag
cipher_flag = bytes([
  0xF8, 0xD5, 0x62, 0xCF, 0x43, 0xBA, 0xC2, 0x23, 0x15, 0x4A, 
  0x51, 0x10, 0x27, 0x10, 0xB1, 0xCF, 0xC4, 0x09, 0xFE, 0xE3, 
  0x9F, 0x49, 0x87, 0xEA, 0x59, 0xC2, 0x07, 0x3B, 0xA9, 0x11, 
  0xC1, 0xBC, 0xFD, 0x4B, 0x57, 0xC4, 0x7E, 0xD0, 0xAA, 0x0A
])
decrypted_flag = rc4_decryp1(cipher_flag, decrypted_key)
print(f"Decrypted Flag: {decrypted_flag.decode()}")