BUUCTF 每日打卡 2021-5-20

引言

无

EasyProgram

题目给了一堆加密伪代码： get buf unsign s[256] get buf t[256] we have key:whoami we have flag:????????????????????????????????

for i:0 to 256 set s[i]:i

for i:0 to 256 set t[i]:key[(i)mod(key.lenth)]

for i:0 to 256 set j:(j+s[i]+t[i])mod(256) swap:s[i],s[j]

for m:0 to 38 set i:(i + 1)mod(256) set j:(j + S[i])mod(256) swap:s[i],s[j] set x:(s[i] + (s[j]mod(256))mod(256)) set flag[m]:flag[m]^s[x]

fprint flagx to file 可以发现，程序的前三个 for 循环都没有涉及到 flag，知识构造了两个数组 s, t，并且进行了一系列操作在最后一个 for 循环中将 flag 与数组 s 做异或运算得到密文所以只要按代码所述构造 s，然后与密文做异或运算即可得出密文代码如下：

with open("file.txt", 'rb') as f:
    c = f.read().hex()

flagx = [int(str(c)[i:i+2], 16) for i in range(0, len(c), 2)]
print(flagx)

s = []
t = []
key = 'whoami'
j = 0
for i in range(0, 256):
    s.append(i)

for i in range(0, 256):
    t.append(key[i % len(key)])

for i in range(0,256):
     j = (j+int(s[i]) + int(ord(t[i]))) % 256
     s[i], s[j] = s[j], s[i]

i = 0; j = 0; x = 0
for m in range(0, 38):
    i = (i + 1) % 256
    j = (j + s[i]) % 256
    s[i], s[j] = s[j], s[i]
    x = (s[i] + (s[j] % 256)) % 256
    flagx[m] = flagx[m] ^ s[x]

print(''.join(chr(flagx[i]) for i in range(0, 38)))