Scribd
Upload
32 views11 pages

Reverse Engineering Flags Guide

The document outlines a series of flags obtained through various methods, including file extraction, data parsing, debugging, and input validation. Each flag is associated with specific techniques or tools used to retrieve it, such as AmcacheParser and x64dbg. The flags include flag1, flag2, flag3, flag4, flag5, flag6, flag7, and flag8, with detailed descriptions of the processes involved in obtaining each one.

Uploaded by

fadouse666
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
32 views11 pages

Reverse Engineering Flags Guide

The document outlines a series of flags obtained through various methods, including file extraction, data parsing, debugging, and input validation. Each flag is associated with specific techniques or tools used to retrieve it, such as AmcacheParser and x64dbg. The flags include flag1, flag2, flag3, flag4, flag5, flag6, flag7, and flag8, with detailed descriptions of the processes involved in obtaining each one.

Uploaded by

fadouse666
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 11

flag1

打开文件提取zip，修复magic头

解压密码根据提示（Pay attention to the FileName.），输入Congratulations，获得flag1.png 二维码图片，扫描得到flag1


flag1{dX3$aK2$}

flag2
利用https://github.com/EricZimmerman/AmcacheParser

解析数据，查找flag2.exe

sha1 279446fe308f25cf1b3b84746b5a68bbb3e1445d

2024/11/9 2024/11/9
Unassociated 0006abdbc9d7fa5379ddaaf9477b7af75a770000ffff 279446fe308f25cf1b3b84746b5a68bbb3e1445d FALSE c:\flag2\flag2.exe flag2.exe .exe 124262 flag2.exe|b20d0ab4a00579aa pe64_amd64 FALSE 295852712 0
9:02 1:20

flag3

flag3{qJ2sO7sC}

x64dbg 调试直接修改cmp_1400112D5 返回值可得

__int64 main_140018B50()
{
// [COLLAPSED LOCAL DECLARATIONS. PRESS KEYPAD CTRL-"+" TO EXPAND]

v0 = &v11;
for ( i = 0x4Ai64; i; --i )
{
*(_DWORD *)v0 = 0xCCCCCCCC;
v0 += 4;
}
sub_14001170D((__int64)&unk_14002E072);
str_140011316((__int64)v12, (__int64)"guest");
if ( (unsigned __int8)cmp_1400112D5((__int64)v12, (__int64)"guest") )
{
// 您当前的身份为: guest，没有权限查看flag
v2 = sub_1400110E1(std::cout, (__int64)"您当前的身份为: guest，没有权限查看flag");
std::ostream::operator<<(v2, sub_140011055);
}
else if ( (unsigned __int8)cmp_1400112D5((__int64)v12, (__int64)"admin") )
{
str_140011316((__int64)a2, (__int64)"fXrbf083f0P=");
// 凯撒？？
dec_140011122((__int64)a1, (__int64)a2, -3u);
base64_dec_14001119A(v15, a1);
v3 = sub_1400110E1(std::cout, (__int64)"flag3{");
v4 = sub_140011654(v3, v15);
v5 = sub_1400110E1(v4, (__int64)"}");
std::ostream::operator<<(v5, sub_140011055);
sub_14001115E((__int64)v15);
sub_14001115E((__int64)a1);
sub_14001115E((__int64)a2);
}
else
{
v6 = sub_1400110E1(std::cout, (__int64)"未知用户身份");
std::ostream::operator<<(v6, sub_140011055);
}
v7 = sub_1400110E1(std::cout, (__int64)"按任意键退出...");
std::ostream::operator<<(v7, sub_140011055);
getch();
v16 = 0;
sub_14001115E((__int64)v12);
v8 = v16;
sub_1400115CD((__int64)v10, (__int64)&unk_140025070);
return v8;
}

py

def get_flag3():
# qJ2sO7sC
input_str='fXrbf083f0P='
offset=-3
result = []
for char in input_str:
if char.isalpha(): # 检查是否为字母
if char.islower(): # 小写字母
base = ord('a')
else: # 大写字母
base = ord('A')
# 计算偏移后的字符
new_char = chr(base + (ord(char) - base + offset) % 26)
result.append(new_char)
else:
# 非字母字符直接保留
result.append(char)
ret=''.join(result)
ret=base64.b64decode(ret.encode()).decode()
ret='flag3{'+ret+'}'
print(ret)
return ret

flag4
zig程序
>backpack.exe
Enter flag: iidd~hq^spd`n\lpb^b_d`nmd`nz
Congratulations! You got the correct flag~

__int16 __fastcall sub_401000(__int64 *a1)


{
// [COLLAPSED LOCAL DECLARATIONS. PRESS KEYPAD CTRL-"+" TO EXPAND]

sub_401400(&v8);
v9 = v8;
sub_401430(&v10, &v9);
v11 = v10;
memset(v12, 0xAA, sizeof(v12));
p_Enter_flag_401440();
v13 = v11;
v14 = v12;
v15 = 0x100i64;
v16 = 0xA;
v17[0] = v11;
v17[1] = (__int64)v17;
v19 = v17;
*(_QWORD *)&v18 = v17;
*((_QWORD *)&v18 + 1) = sub_401650;
v20 = v18;
v6 = *a1;
sub_401730(&v21, a1, &v20, (__int64)v12, 0x100ui64, 0xA);
*a1 = v6;
if ( v23 != 0 && (unsigned __int16)(v23 - 1) > 0xCu )
sub_4019A0("invalid error code", 0x12i64, 0i64, &unk_480698);
if ( v23 )
{
v5 = v23;
sub_401A20(a1);
return v5;
}
else
{
if ( !v21 )
{
p_Invalid_input_402850();
return 0;
}
v24 = v21;
v25 = v22;
v27 = v22;
v26 = v21;
input = x_read_401B00(v21, v22, (__int64)"\r\n", 2i64);
v29 = v2; // 输入的长度
v28 = input;
if ( v2 == 28 )
{
sub_47E1E0(v30, byte_4806B0, 216ui64);
// 27*8=216
sub_401ED0(input, 28ui64, (__int64)table_480788, 0x10ui64, (__int64)v30, 27ui64);
v31 = 1;
for ( i = 0i64; i < 27; ++i )
{
v33 = i;
v3 = target_4805A8;
if ( v30[i] != target_4805A8[i] )
{
// 失败
v31 = 0;
break;
}
}
if ( (v31 & 1) != 0 )
// Congratulations! You got the correct flag~\n
p_Congratulations_402430((const char *)v3);
else
// Try again
p_Try_again_402640();
return 0;
}
// Flag must be 28 characters long\n
p_Flag_must_be_28_characters_long_401CC0();
return 0;
}
}

unsigned __int64 __fastcall sub_401ED0(


__int64 a1,
unsigned __int64 a2,
__int64 *a3,
unsigned __int64 a4,
__int64 *a5,
unsigned __int64 a6)
{
// [COLLAPSED LOCAL DECLARATIONS. PRESS KEYPAD CTRL-"+" TO EXPAND]

sub_47D7F0(v22, 0xAAi64, 0x1CBi64);


for ( i = 0i64; ; i = v17 + 1 )
{
v17 = i;
if ( i >= 0x1B )
break;
v24 = i;
sub_47D7F0(v22[i], 0i64, 0x11i64);
}
for ( j = 0i64; ; j = v16 + 1 )
{
// 2个字符1组，相加转成bit字符串
// 每次移动1位，所以会产生27项
v16 = j;
if ( j >= 27 )
break;
v26 = j;
if ( j >= a2 )
sub_4023F0(j, a2);
v14 = *(_BYTE *)(a1 + j);
v15 = j + 1;
if ( j + 1 >= a2 )
sub_4023F0(v15, a2);
v6 = *(_BYTE *)(a1 + v15);
v27 = *(_BYTE *)(a1 + j);
v28 = v6;
if ( __CFADD__(v6, v14) )
sub_4019A0("integer overflow", 0x10i64, 0i64, &unk_4808C8);
v29 = v6 + v14;
for ( k = 0i64; ; k = v13 + 1 )
{
v13 = k;
if ( k >= 0x10 )
break;
v31 = k;
if ( v16 >= 0x1B )
sub_4023F0(v16, 0x1Bi64);
v12 = 0xF - k;
if ( 0xF - k >= 0x11 )
sub_4023F0(v12, 0x11i64);
if ( (v29 & 1) == 1 )
v11 = '1';
else
v11 = '0';
v22[v16][v12] = v11;
v29 >>= 1;
}
}
for ( m = 0i64; ; m = v10 + 1 )
{
result = m;
v10 = m;
if ( m >= 0x1B )
break;
v33 = m;
v34 = 0i64;
for ( n = 0i64; n < 0x10; ++n )
{
v36 = n;
if ( v22[m][n] == '1' )
{
// bit 为1的位，对照a3 table 进行求和
// 注意字节序
v9 = v34;
v37 = v34;
if ( n >= a4 )
sub_4023F0(n, a4);
v8 = a3[n] + v34;
if ( __CFADD__(a3[n], v34) )
sub_4019A0("integer overflow", 0x10i64, 0i64, &unk_4808C8);
v34 += a3[n];
if ( v8 < v9 )
{
sub_403F30();
sub_404140(1i64);
}
}
}
v38 = a5;
v39 = a6;
if ( m >= a6 )
sub_4023F0(m, a6);
// 结果保存到a5
a5[m] = v34;
}
return result;
}

py

def get_flag4():
flag4 = r"iidd~hq^spd`n\lpb^b_d`nmd`nz" # 输入字符串，长度为 28

table_480788 = [
391141429, 3478124220, 3336047727, 3527421942, 1597786510,
2019990264, 2744862007, 3898825252, 486177504, 184886860,
781690097, 63429722, 1180618910, 1947105626, 1555881410, 2578824499
] # 权重数组

target_4805A8 = [
2290375496, 6377613399, 1851683274, 3008635871, 4955741497,
4493937495, 7933494809, 3313318585, 5587460370, 2681599712,
2618169990, 5354670310, 3407564684, 1851683274, 3862218622,
2290375496, 671064364, 671064364, 3249888863, 4805770273,
2618169990, 5354670310, 6049818905, 3313318585, 2618169990,
5354670310, 2633373371
]

recovered_flag4 = decode_flag4(target_4805A8, table_480788[::-1])


# print("Recovered a1:", recovered_a1)
re_flag4=recover(recovered_flag4)
re_flag4=bytes(re_flag4)
#print('re success?:',re_flag4==flag4.encode())
print('flag4:',re_flag4)

flag5
ce 搜 flag{ 一步到位

flag5{jA0fS5}

05.exe
Please enter the flag: flag{jA0fS5}
flag正确

py

def caesar_decrypt(text, shift):


"""加密函数：将文本加密，移动 shift 个位置"""
encrypted_text = ""
for char in text:
if char.isalpha(): # 仅处理字母
start = ord('A') if char.isupper() else ord('a')
# 计算新的字符
encrypted_text += chr((ord(char) - start -shift) % 26 + start)
else:
# 非字母字符不加密
encrypted_text += char
return encrypted_text
def get_flag5():
# flag5=b'jA0fS5'
str1 = 'dnHzCoP1'
shift = 3
str2 = caesar_decrypt(str1, shift).encode()
# print(str2)
decoded_bytes = base64.b64decode(str2)
str2 = decoded_bytes.decode('utf-8')
print('flag5{'+str2+'}')

flag6
flag6{GgACfF}

请输入flag:
GgACfF
flag正确
按任意键退出...
flag7
"flag{aR6tB7}" "flag7{aR6tB7}"

请输入flag：flag7{aR6tB7}
flag正确
按任意键退出...
flag8
{7660277C-49A9-4F1C-85B1-EFD388F79A42}

logon

action：rundll32.exe "C:\Program Files (x86)\Windows NT\Update.png",DllRegisterServer

情境: 今天下午，正在办公室里对账的小张收到了陌生人发送的"软件包下载.msi"，并在无意间打开了该程序包。小张发现该程序包运行之
后，在 "C:\Program Files (x86)\Windows NT" 下释放了大量未知文件，小明将这些文件清理掉之后发现每次启动计算机后总会弹出报错提
示称“某某dll启动失败：找不到模块”。请你帮助小张找到该启动项。
提交内容: 该计划任务启动项的 Id .
本题flag示例: flag8{XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}

taskcache v.20200427
(Software) Checks TaskCache\Tree root keys (not subkeys)

Corpo
LastWrite: 2024-11-10 06:42:01Z
Id: {7660277C-49A9-4F1C-85B1-EFD388F79A42}
Task Reg Time: 2024-11-10 06:42:01Z
Task Last Run: 2024-11-10 06:50:46Z
Task Completed: 2024-11-10 06:51:01Z
flag9 密码学，todo

flag10
Kbkwgebk

Command Line: EHLO Kbkwgebk\r\n


Command: EHLO
Request parameter: Kbkwgebk

流量

情境: 今天下午，小红发现自己的计算机被感染了AgentTesla恶意软件，以下是从小红计算机中抓包得到的pcapng网络流量包，该网络流量
包中包含了AgentTesla恶意软件在这段时间内发送的网络流量。
提交内容: 小红计算机的 Computer Name (计算机名).
MIME-Version: 1.0
From: biz@ctdi.com.ph
To: ctdi.employees@ctdi.com.ph
Date: 8 Nov 2024 21:07:12 +0000
Subject: Contacts_Admin/KBKWGEBK
Content-Type: text/html; charset=us-ascii
Content-Transfer-Encoding: quoted-printable

Time: 11/08/2024 21:07:06<br>User Name: Admin<br>Computer Name: K=


BKWGEBK<br>OSFullName: Microsoft Windows 10 Pro<br>CPU: 12th Gen =
Intel(R) Core(TM) i5-12400<br>RAM: 8192 MB<br><hr>

You might also like