分类 标签 存档 黑客派 订阅 搜索

一个查表置换的 CM

186 浏览

说实话,今天被自己蠢哭了

因为看多了一个字符,以为是输入字符变形后的 base64 编码,也怪自己没大致看过 base64 汇编形式,把 base64 跟完了用 py 实现完算法才意思到是 base64,这是题外话

本人初学者,两天或一天一个 cm 练练,大家可以与我交流 akkumans@qq.com,我博客

上面的题外话就是今天搞的一个 cm,被自己蠢哭了,不过也算是 base64 编码流程无比清晰了,不算是无用功

这个 cm 是一个控制台的,丢到 xp 无法运行,本机只装了 x64dbg(x32dbg),用这个调试软件来试试吧

C:\Users\Administrator\Desktop>reverse3.exe
Please enter the flag:97103012
wrong input

字符串搜索,找到判断的地方

01241269 | 85 C0                    | test eax,eax                             | zf=1 => eax=0
0124126B | 75 07                    | jne reverse3.1241274                     |
0124126D | 68 78 21 24 01           | push reverse3.1242178                    | 1242178:"this is the right flag"
01241272 | EB 05                    | jmp reverse3.1241279                     |
01241274 | 68 90 21 24 01           | push reverse3.1242190                    | 1242190:"wrong input"
01241279 | FF 15 B0 20 24 01        | call dword ptr ds:[<&puts>]              |
0124127F | 8B 4D FC                 | mov ecx,dword ptr ss:[ebp-4]             |
01241282 | 83 C4 04                 | add esp,4                                |
01241285 | 33 CD                    | xor ecx,ebp                              |
01241287 | 33 C0                    | xor eax,eax                              | eax:"OTacMDMzMTI="
01241289 | E8 92 00 00 00           | call reverse3.1241320                    |
0124128E | 8B E5                    | mov esp,ebp                              |
01241290 | 5D                       | pop ebp                                  |
01241291 | C3                       | ret                                      |

可以看到要得到 flag,jne 就不能跳,也就是test eax,eax后的 ZF=1,也就是 eax=0
那这个 eax=0 从何而来?我们接着往上看

012411A0 | 55                       | push ebp                                 |
012411A1 | 8B EC                    | mov ebp,esp                              |
012411A3 | 83 EC 44                 | sub esp,44                               |
012411A6 | A1 04 30 24 01           | mov eax,dword ptr ds:[1243004]           | eax:"OTacMDMzMTI="
012411AB | 33 C5                    | xor eax,ebp                              |
012411AD | 89 45 FC                 | mov dword ptr ss:[ebp-4],eax             |
012411B0 | 0F 57 C0                 | xorps xmm0,xmm0                          |
012411B3 | C7 45 F8 00 00 00 00     | mov dword ptr ss:[ebp-8],0               |
012411BA | 68 58 21 24 01           | push reverse3.1242158                    | 1242158:"Please enter the flag:"
012411BF | 0F 11 45 E8              | movups xmmword ptr ss:[ebp-18],xmm0      |
012411C3 | 0F 11 45 C0              | movups xmmword ptr ss:[ebp-40],xmm0      |
012411C7 | 0F 11 45 D0              | movups xmmword ptr ss:[ebp-30],xmm0      |
012411CB | 66 0F D6 45 E0           | movq qword ptr ss:[ebp-20],xmm0          |
012411D0 | E8 1B 01 00 00           | call reverse3.12412F0                    |
012411D5 | 8D 45 E8                 | lea eax,dword ptr ss:[ebp-18]            |
012411D8 | 50                       | push eax                                 | eax:"OTacMDMzMTI="
012411D9 | 68 70 21 24 01           | push reverse3.1242170                    | 1242170:"%20s"
012411DE | E8 CD 00 00 00           | call reverse3.12412B0                    |
012411E3 | 8D 4D E8                 | lea ecx,dword ptr ss:[ebp-18]            | 你的输入 -> ecx
012411E6 | 83 C4 0C                 | add esp,C                                |
012411E9 | 8D 51 01                 | lea edx,dword ptr ds:[ecx+1]             | 你的输入减第一个字节 -> edx
012411EC | 0F 1F 40 00              | nop dword ptr ds:[eax]                   | eax:"OTacMDMzMTI="
012411F0 | 8A 01                    | mov al,byte ptr ds:[ecx]                 |
012411F2 | 41                       | inc ecx                                  |
012411F3 | 84 C0                    | test al,al                               |
012411F5 | 75 F9                    | jne reverse3.12411F0                     |
012411F7 | 2B CA                    | sub ecx,edx                              | 你的输入的长度 -> ecx
012411F9 | 8D 55 E8                 | lea edx,dword ptr ss:[ebp-18]            | 输入 -> edx
012411FC | 56                       | push esi                                 | esi:"TacMDMzMTI="
012411FD | 51                       | push ecx                                 |
012411FE | 51                       | push ecx                                 |
012411FF | 8D 4D C0                 | lea ecx,dword ptr ss:[ebp-40]            |
01241202 | E8 F9 FD FF FF           | call reverse3.1241000                    | base64(你的输入) -> [ebp - 0x40]
01241207 | 8D 4D C0                 | lea ecx,dword ptr ss:[ebp-40]            |
0124120A | 83 C4 08                 | add esp,8                                |
0124120D | 33 D2                    | xor edx,edx                              |
0124120F | 8D 71 01                 | lea esi,dword ptr ds:[ecx+1]             | esi:"TacMDMzMTI="
01241212 | 8A 01                    | mov al,byte ptr ds:[ecx]                 |
01241214 | 41                       | inc ecx                                  |
01241215 | 84 C0                    | test al,al                               |
01241217 | 75 F9                    | jne reverse3.1241212                     |
01241219 | 2B CE                    | sub ecx,esi                              | 长度(base64你的输入) -> ecx
0124121B | 74 37                    | je reverse3.1241254                      |
0124121D | 0F 1F 00                 | nop dword ptr ds:[eax]                   | eax:"OTacMDMzMTI="
01241220 | 8A 4C 15 C0              | mov cl,byte ptr ss:[ebp+edx-40]          |
01241224 | 33 C0                    | xor eax,eax                              | eax:"OTacMDMzMTI="
01241226 | 3A 88 08 21 24 01        | cmp cl,byte ptr ds:[eax+1242108]         |
0124122C | 74 08                    | je reverse3.1241236                      |
0124122E | 40                       | inc eax                                  | eax:"OTacMDMzMTI="
0124122F | 83 F8 1A                 | cmp eax,1A                               | eax:"OTacMDMzMTI="
01241232 | 72 F2                    | jb reverse3.1241226                      |
01241234 | EB 0A                    | jmp reverse3.1241240                     |
01241236 | 8A 80 24 21 24 01        | mov al,byte ptr ds:[eax+1242124]         |
0124123C | 88 44 15 C0              | mov byte ptr ss:[ebp+edx-40],al          |
01241240 | 8D 4D C0                 | lea ecx,dword ptr ss:[ebp-40]            |
01241243 | 42                       | inc edx                                  |
01241244 | 8D 71 01                 | lea esi,dword ptr ds:[ecx+1]             | esi:"TacMDMzMTI="
01241247 | 8A 01                    | mov al,byte ptr ds:[ecx]                 |
01241249 | 41                       | inc ecx                                  |
0124124A | 84 C0                    | test al,al                               |
0124124C | 75 F9                    | jne reverse3.1241247                     |
0124124E | 2B CE                    | sub ecx,esi                              | esi:"TacMDMzMTI="
01241250 | 3B D1                    | cmp edx,ecx                              |
01241252 | 72 CC                    | jb reverse3.1241220                      |
01241254 | 6A 14                    | push 14                                  |
01241256 | 8D 45 C0                 | lea eax,dword ptr ss:[ebp-40]            |
01241259 | 68 40 21 24 01           | push reverse3.1242140                    | 1242140:"o2Ffx3V0OjJtYW5spQ=="
0124125E | 50                       | push eax                                 | eax:"OTacMDMzMTI="
0124125F | FF 15 C4 20 24 01        | call dword ptr ds:[<&strncmp>]           | 经过处理的base64与内置base64值比较,相等=>eax=0
01241265 | 83 C4 0C                 | add esp,C                                |
01241268 | 5E                       | pop esi                                  | esi:"TacMDMzMTI="
01241269 | 85 C0                    | test eax,eax                             | zf=1 => eax=0
0124126B | 75 07                    | jne reverse3.1241274                     |
0124126D | 68 78 21 24 01           | push reverse3.1242178                    | 1242178:"this is the right flag"
01241272 | EB 05                    | jmp reverse3.1241279                     |
01241274 | 68 90 21 24 01           | push reverse3.1242190                    | 1242190:"wrong input"
01241279 | FF 15 B0 20 24 01        | call dword ptr ds:[<&puts>]              |
0124127F | 8B 4D FC                 | mov ecx,dword ptr ss:[ebp-4]             |
01241282 | 83 C4 04                 | add esp,4                                |
01241285 | 33 CD                    | xor ecx,ebp                              |
01241287 | 33 C0                    | xor eax,eax                              | eax:"OTacMDMzMTI="
01241289 | E8 92 00 00 00           | call reverse3.1241320                    |
0124128E | 8B E5                    | mov esp,ebp                              |
01241290 | 5D                       | pop ebp                                  |
01241291 | C3                       | ret                                      |

看来是这几行做了手脚,压入了两个参数

01241259 | 68 40 21 24 01           | push reverse3.1242140                    | 1242140:"o2Ffx3V0OjJtYW5spQ=="
0124125E | 50                       | push eax                                 | eax:"OTacMDMzMTI="
0124125F | FF 15 C4 20 24 01        | call dword ptr ds:[<&strncmp>]           | 经过处理的base64与内置base64值比较,相等=>eax=0

我们跟这个 call 进去看看

6C2F8C30 | 53                       | push ebx                                 |
6C2F8C31 | 56                       | push esi                                 | esi:"TacMDMzMTI="
6C2F8C32 | 8B 4C 24 0C              | mov ecx,dword ptr ss:[esp+C]             | 我们输入的base64变形后的值
6C2F8C36 | 8B 54 24 10              | mov edx,dword ptr ss:[esp+10]            | 内置base64值
6C2F8C3A | 8B 5C 24 14              | mov ebx,dword ptr ss:[esp+14]            |
6C2F8C3E | F7 C3 FF FF FF FF        | test ebx,FFFFFFFF                        |
6C2F8C44 | 74 50                    | je ucrtbase.6C2F8C96                     |
6C2F8C46 | 2B CA                    | sub ecx,edx                              |
6C2F8C48 | F7 C2 03 00 00 00        | test edx,3                               |
6C2F8C4E | 74 17                    | je ucrtbase.6C2F8C67                     |
6C2F8C50 | 0F B6 04 0A              | movzx eax,byte ptr ds:[edx+ecx]          | edx+ecx*1:"OTacMDMzMTI="
6C2F8C54 | 3A 02                    | cmp al,byte ptr ds:[edx]                 |
6C2F8C56 | 75 48                    | jne ucrtbase.6C2F8CA0                    |
6C2F8C58 | 85 C0                    | test eax,eax                             | eax:"OTacMDMzMTI="
6C2F8C5A | 74 3A                    | je ucrtbase.6C2F8C96                     |
6C2F8C5C | 42                       | inc edx                                  |
6C2F8C5D | 83 EB 01                 | sub ebx,1                                |
6C2F8C60 | 76 34                    | jbe ucrtbase.6C2F8C96                    |
6C2F8C62 | F6 C2 03                 | test dl,3                                |
6C2F8C65 | 75 E9                    | jne ucrtbase.6C2F8C50                    |
6C2F8C67 | 8D 04 0A                 | lea eax,dword ptr ds:[edx+ecx]           | eax:"OTacMDMzMTI="
6C2F8C6A | 25 FF 0F 00 00           | and eax,FFF                              | eax:"OTacMDMzMTI="
6C2F8C6F | 3D FC 0F 00 00           | cmp eax,FFC                              | eax:"OTacMDMzMTI="
6C2F8C74 | 77 DA                    | ja ucrtbase.6C2F8C50                     |
6C2F8C76 | 8B 04 0A                 | mov eax,dword ptr ds:[edx+ecx]           | eax:"OTacMDMzMTI="
6C2F8C79 | 3B 02                    | cmp eax,dword ptr ds:[edx]               | eax:"OTacMDMzMTI="
6C2F8C7B | 75 D3                    | jne ucrtbase.6C2F8C50                    |
6C2F8C7D | 83 EB 04                 | sub ebx,4                                |
6C2F8C80 | 76 14                    | jbe ucrtbase.6C2F8C96                    |
6C2F8C82 | 8D B0 FF FE FE FE        | lea esi,dword ptr ds:[eax-1010101]       | esi:"TacMDMzMTI="
6C2F8C88 | 83 C2 04                 | add edx,4                                |
6C2F8C8B | F7 D0                    | not eax                                  | eax:"OTacMDMzMTI="
6C2F8C8D | 23 C6                    | and eax,esi                              | eax:"OTacMDMzMTI=", esi:"TacMDMzMTI="
6C2F8C8F | A9 80 80 80 80           | test eax,80808080                        | eax:"OTacMDMzMTI="
6C2F8C94 | 74 D1                    | je ucrtbase.6C2F8C67                     |
6C2F8C96 | 33 C0                    | xor eax,eax                              | eax:"OTacMDMzMTI="
6C2F8C98 | 5E                       | pop esi                                  | esi:"TacMDMzMTI="
6C2F8C99 | 5B                       | pop ebx                                  |
6C2F8C9A | C3                       | ret                                      |
6C2F8C9B | EB 03                    | jmp ucrtbase.6C2F8CA0                    |
6C2F8C9D | CC                       | int3                                     |
6C2F8C9E | CC                       | int3                                     |
6C2F8C9F | CC                       | int3                                     |
6C2F8CA0 | 1B C0                    | sbb eax,eax                              | eax:"OTacMDMzMTI="
6C2F8CA2 | 83 C8 01                 | or eax,1                                 | eax:"OTacMDMzMTI="
6C2F8CA5 | 5E                       | pop esi                                  | esi:"TacMDMzMTI="
6C2F8CA6 | 5B                       | pop ebx                                  |
6C2F8CA7 | C3                       | ret                                      |

这段代码的跳转比较复杂,我们主要看这段

6C2F8C50 | 0F B6 04 0A              | movzx eax,byte ptr ds:[edx+ecx]          | edx+ecx*1:"OTacMDMzMTI="
6C2F8C54 | 3A 02                    | cmp al,byte ptr ds:[edx]                 | edx:"o2Ffx3V0OjJtYW5spQ=="
6C2F8C56 | 75 48                    | jne ucrtbase.6C2F8CA0                    |
6C2F8C58 | 85 C0                    | test eax,eax                             |
6C2F8C5A | 74 3A                    | je ucrtbase.6C2F8C96                     |
6C2F8C5C | 42                       | inc edx                                  | edx:"o2Ffx3V0OjJtYW5spQ=="
6C2F8C5D | 83 EB 01                 | sub ebx,1                                |
6C2F8C60 | 76 34                    | jbe ucrtbase.6C2F8C96                    |
6C2F8C62 | F6 C2 03                 | test dl,3                                |
6C2F8C65 | 75 E9                    | jne ucrtbase.6C2F8C50                    |
6C2F8C67 | 8D 04 0A                 | lea eax,dword ptr ds:[edx+ecx]           | edx+ecx*1:"OTacMDMzMTI="
6C2F8C6A | 25 FF 0F 00 00           | and eax,FFF                              |
6C2F8C6F | 3D FC 0F 00 00           | cmp eax,FFC                              |
6C2F8C74 | 77 DA                    | ja ucrtbase.6C2F8C50                     |

通读可以发现就是把我们输入的 base64 变形后的值 (OTacMDMzMTI=) 按字节取出来一一和内置的o2Ffx3V0OjJtYW5spQ==做比较,只有当全部相等才跳到这把 eax 置零

6C2F8C96 | 33 C0                    | xor eax,eax

然后退出函数

那么这个OTacMDMzMTI=是个什么呢?看着是个 base64,但是我们解出来是96?3312,完全不是我们输入的97103012了,这个只怎么来的呢?我们继续看这段

012411FF | 8D 4D C0                 | lea ecx,dword ptr ss:[ebp-40]            |
01241202 | E8 F9 FD FF FF           | call reverse3.1241000                    |base64(你的输入) -> [ebp - 0x40]
01241207 | 8D 4D C0                 | lea ecx,dword ptr ss:[ebp-40]            |
0124120A | 83 C4 08                 | add esp,8                                |
0124120D | 33 D2                    | xor edx,edx                              | edx:"97103012"
0124120F | 8D 71 01                 | lea esi,dword ptr ds:[ecx+1]             |
01241212 | 8A 01                    | mov al,byte ptr ds:[ecx]                 |
01241214 | 41                       | inc ecx                                  |
01241215 | 84 C0                    | test al,al                               |
01241217 | 75 F9                    | jne reverse3.1241212                     |
01241219 | 2B CE                    | sub ecx,esi                              | 长度(base64你的输入) -> ecx
0124121B | 74 37                    | je reverse3.1241254                      |
0124121D | 0F 1F 00                 | nop dword ptr ds:[eax]                   |
01241220 | 8A 4C 15 C0              | mov cl,byte ptr ss:[ebp+edx-40]          |
01241224 | 33 C0                    | xor eax,eax                              |
01241226 | 3A 88 08 21 24 01        | cmp cl,byte ptr ds:[eax+1242108]         | eax+1242108:"abcdefghijklmnopqrstuvwxyz"
0124122C | 74 08                    | je reverse3.1241236                      |
0124122E | 40                       | inc eax                                  |
0124122F | 83 F8 1A                 | cmp eax,1A                               |
01241232 | 72 F2                    | jb reverse3.1241226                      |
01241234 | EB 0A                    | jmp reverse3.1241240                     |
01241236 | 8A 80 24 21 24 01        | mov al,byte ptr ds:[eax+1242124]         | eax+1242124:"wxabopdefghijklqrstuvyzcmn"
0124123C | 88 44 15 C0              | mov byte ptr ss:[ebp+edx-40],al          |
01241240 | 8D 4D C0                 | lea ecx,dword ptr ss:[ebp-40]            |
01241243 | 42                       | inc edx                                  | edx:"97103012"
01241244 | 8D 71 01                 | lea esi,dword ptr ds:[ecx+1]             |
01241247 | 8A 01                    | mov al,byte ptr ds:[ecx]                 |
01241249 | 41                       | inc ecx                                  |
0124124A | 84 C0                    | test al,al                               |
0124124C | 75 F9                    | jne reverse3.1241247                     |
0124124E | 2B CE                    | sub ecx,esi                              |
01241250 | 3B D1                    | cmp edx,ecx                              | edx:"97103012"
01241252 | 72 CC                    | jb reverse3.1241220                      |
01241254 | 6A 14                    | push 14                                  |

下面这行代码有兴趣的可以跟进去看看,其实就是 base64 编码,苦逼的我傻乎乎地跟完了

01241202 | E8 F9 FD FF FF           | call reverse3.1241000                    |base64(你的输入) -> [ebp - 0x40]

97103012的 base64 是OTcxMDMwMTI=呀,这个OTacMDMzMTI=是怎么来的呢?我们看着一段

01241220 | 8A 4C 15 C0              | mov cl,byte ptr ss:[ebp+edx-40]          |
01241224 | 33 C0                    | xor eax,eax                              |
01241226 | 3A 88 08 21 24 01        | cmp cl,byte ptr ds:[eax+1242108]         | eax+1242108:"abcdefghijklmnopqrstuvwxyz"
0124122C | 74 08                    | je reverse3.1241236                      |
0124122E | 40                       | inc eax                                  |
0124122F | 83 F8 1A                 | cmp eax,1A                               |
01241232 | 72 F2                    | jb reverse3.1241226                      |
01241234 | EB 0A                    | jmp reverse3.1241240                     |
01241236 | 8A 80 24 21 24 01        | mov al,byte ptr ds:[eax+1242124]         | eax+1242124:"wxabopdefghijklqrstuvyzcmn"
0124123C | 88 44 15 C0              | mov byte ptr ss:[ebp+edx-40],al          |
01241240 | 8D 4D C0                 | lea ecx,dword ptr ss:[ebp-40]            |
01241243 | 42                       | inc edx                                  | edx:"97103012"
01241244 | 8D 71 01                 | lea esi,dword ptr ds:[ecx+1]             |
01241247 | 8A 01                    | mov al,byte ptr ds:[ecx]                 |
01241249 | 41                       | inc ecx                                  |
0124124A | 84 C0                    | test al,al                               |
0124124C | 75 F9                    | jne reverse3.1241247                     |
0124124E | 2B CE                    | sub ecx,esi                              |
01241250 | 3B D1                    | cmp edx,ecx                              | edx:"97103012"
01241252 | 72 CC                    | jb reverse3.1241220                      |

这一段的工作大家跟跟就知道,就是通过一次次循环将OTcxMDMwMTI=中的值通过下面这个对应关系一一置换

abcdefghijklmnopqrstuvwxyz
wxabopdefghijklqrstuvyzcmn

所以OTcxMDMwMTI=变成了OTacMDMzMTI=

好的,我们看到了这里,相信已经知道密码是什么了,也就是我们变形后的 base64 值要等于o2Ffx3V0OjJtYW5spQ==
那就倒着置换呗,得出来正确的 base64 是e2Fib3V0OmJsYW5rfQ==,解码为{about:blank}

例子 CM

评论  
留下你的脚步
推荐阅读