攻防世界-难度1- bad_python

Rainy-Day / 2024-04-28 / 原文

the .pyc is broken ,can you help me recover?

攻防世界难度1-bad_python

python头部

观察文件名pyre.cpython-36.pyc，说明是在python3.6环境下编译的，那么需要恢复正常pyc3.6对应的首部16字节。

uncompyle6

pip3 install uncompyle6
uncompyle6 --version
uncompyle6 pyre.cpython-36.pyc >main.py
pip install pycryptodome

对称加密-TEA变种算法

这里是对称加密，密钥、密文、加密算法已知，只要根据逆加密算法配合密钥就能将密文还原回去

from ctypes import *
from Crypto.Util.number import bytes_to_long
from Crypto.Util.number import long_to_bytes


def decrypt(v, k):
    v0 = c_uint32(v[0])
    v1 = c_uint32(v[1])
    sum1 = c_uint32(195935983 * 32)
    delta = 195935983
    for i in range(32):
        v1.value -= (v0.value << 4 ^ v0.value >> 7) + v0.value ^ sum1.value + k[sum1.value >> 9 & 3]
        sum1.value -= delta
        v0.value -= (v1.value << 4 ^ v1.value >> 7) + v1.value ^ sum1.value + k[sum1.value & 3]

    return (v0.value, v1.value)

if __name__ == '__main__':
    enc = [4006073346, 2582197823, 2235293281, 558171287, 2425328816, 1715140098, 986348143, 1948615354]
    k = [255, 187, 51, 68]
    decrypted = []
    for i in range(0, len(enc), 2):
        decrypted += decrypt([enc[i], enc[i + 1]], k)
    flag = ""
    for num in decrypted:
        flag += long_to_bytes(num).decode("ascii")
    print("flag is flag{%s}" % flag)

flag{Th1s_1s_A_Easy_Pyth0n__R3veRse_0}