攻防世界WEB進階之web2

攻防世界WEB進階之bugweb2

• 一、描述
• 二、實操
• 三、答案

一、描述

難度係數：2星
題目來源： NSCTF
題目描述：解密
題目場景： http://111.198.29.45:35597
題目附件： 暫無

二、實操

<?php 
$miwen="a1zLbgQsCESEIqRLwuQAyMwLyq2L5VwBxqGA3RQAyumZ0tmMvSGM2ZwB4tws"; 

function encode($str){ 
    $_o=strrev($str); 
    // echo $_o; 
         
    for($_0=0;$_0<strlen($_o);$_0++){ 
        
        $_c=substr($_o,$_0,1); 
        $__=ord($_c)+1; 
        $_c=chr($__); 
        $_=$_.$_c;    
    }  
    return str_rot13(strrev(base64_encode($_))); 
} 

highlight_file(__FILE__); 
/* 逆向加密算法，解密$miwen就是flag */ 
?>

source：a1zLbgQsCESEIqRLwuQAyMwLyq2L5VwBxqGA3RQAyumZ0tmMvSGM2ZwB4tws

rot13 : n1mYotDfPRFRVdEYjhDNlZjYld2Y5IjOkdTN3EDNlhzM0gzZiFTZ2MjO4gjf

def rot13(crypt_str):
    # coding:utf-8

    import string

    def decoder(crypt_str, shift):
        crypt_list = list(crypt_str)
        plain_str = ""
        num = int(shift)
        for ch in crypt_list:
            ch = ord(ch)
            if ord('a') <= ch and ch <= ord('z'):
                ch = ch + num
                if ch > ord('z'):
                    ch -= 26
            if ord('A') <= ch and ch <= ord('Z'):
                ch = ch + num
                if ch > ord('Z'):
                    ch -= 26
            a = chr(ch)
            plain_str += a

        print(plain_str)
    shift = 13
    decoder(crypt_str, shift)

strrev : fjg4OjM2ZTFiZzg0MzhlNDE3NTdkOjI5Y2dlYjZlNDhjYEdVRFRPfDtoYm1n

<?php
echo strrev("n1mYotDfPRFRVdEYjhDNlZjYld2Y5IjOkdTN3EDNlhzM0gzZiFTZ2MjO4gjf");
?>

base64 : ~88:36e1bg8438e41757d:29cgeb6e48c`GUDTO|;hbmg

直接在網址解碼fjg4OjM2ZTFiZzg0MzhlNDE3NTdkOjI5Y2dlYjZlNDhjYEdVRFRPfDtoYm1n便可
http://tool.oschina.net/encrypt?type=3

對編碼進行逆向操做，這裏使用python語言：

""" for($_0=0;$_0<strlen($_o);$_0++){ $_c=substr($_o,$_0,1); # 每次取一個字符，就是對應的遍歷的字符i $__=ord($_c)+1; # 轉化爲對應的10進制數 $_c=chr($__); # 10進制轉換爲ASCII碼 $_=$_.$_c; # 累加$_c } """

def reverse(strings):
    now = ''
    for i in range(len(strings)):
        temp = strings[i]
        temp_ord = ord(temp) - 1
        temp_chr = chr(temp_ord)
        now += temp_chr
    ans = now[::-1]
    return ans


if __name__ == '__main__':
    string = "~88:36e1bg8438e41757d:29cgeb6e48c`GUDTO|;hbmg"
    print(reverse(string))

三、答案

最終答案爲：

flag:{NSCTF_b73d5adfb819c64603d7237fa0d52977}