HZNUCTF MISC Snake题解——python程序逆向,hashcat爆破sha256
目录
一.Dump得到pyc文件
二.pyc反编译得到py源码
三.分析程序逻辑
四.hashcat爆破
题目附件链接：https://pan.baidu.com/s/1CcS8BPGx8fKnsJgRvEi0bA?pwd=t2yj
提取码：t2yj
一.Dump得到pyc文件
使用命令:python pyinstxtractor.py snake.exe
二.pyc反编译得到py源码
在线反编译工具python反编译 - 在线工具 (tool.lu)
这里%e8%b4%aa...是url编码,可以用url编码在线解密修复
三.分析程序逻辑
代码:
#!/usr/bin/env python
# visit https://tool.lu/pyc/ for more information
# Version: Python 3.8
''' 贪吃蛇小游戏 '''
import random
import sys
import time
import pygame
from pygame.locals import *
from collections import deque
FLAG_IS_ME = "import hashlib \nimport string \nsalt_1 = 'xxxxxxxxxxx' \nsalt_2 = 'xxxxxxxxxxx' \nsalt_3 = 'xxxxxxxxxxx' \nsalt = salt_1 + salt_2 + salt_3 \ndata = 'HZNUCTF{xxxxx}' #5位 ascii+digits+_ \nsalt_data = salt + data \ndata_sha = hashlib.sha256(salt_data.encode('utf-8')).hexdigest() \nprint(data_sha) #c08521f3c380906d05ee8afbc7fa2943afb3788d9cec94c1b86771ee35ca4738"
SCREEN_WIDTH = 600
SCREEN_HEIGHT = 480
SIZE = 20
def print_text(screen, font, x, y, text, fcolor=((255, 255, 255),)):
imgText = font.render(text, True, fcolor)
screen.blit(imgText, (x, y))
def main():
pygame.init()
screen = pygame.display.set_mode((SCREEN_WIDTH, SCREEN_HEIGHT))
pygame.display.set_caption('贪吃蛇')
light = (100, 100, 100)
dark = (200, 200, 200)
font1 = pygame.font.SysFont('SimHei', 24)
font2 = pygame.font.Font(None, 72)
red = (200, 30, 30)
(fwidth, fheight) = font2.size('GAME OVER')
line_width = 1
black = (0, 0, 0)
bgcolor = (40, 40, 60)
pos_x = 1
pos_y = 0
b = True
scope_x = (0, SCREEN_WIDTH // SIZE - 1)
scope_y = (2, SCREEN_HEIGHT // SIZE - 1)
snake = deque()
food_x = 0
food_y = 0
def _init_snake():
snake.clear()
snake.append((2, scope_y[0]))
snake.append((1, scope_y[0]))
snake.append((0, scope_y[0]))
def _create_food():
food_x = random.randint(scope_x[0], scope_x[1])
food_y = random.randint(scope_y[0], scope_y[1])
if (food_x, food_y) in snake:
food_x = random.randint(scope_x[0], scope_x[1])
food_y = random.randint(scope_y[0], scope_y[1])
continue
_init_snake()
_create_food()
game_over = True
start = False
score = 0
orispeed = 0.5
speed = orispeed
last_move_time = None
pause = False
for event in pygame.event.get():
if event.type == QUIT:
sys.exit()
continue
if event.type == KEYDOWN or event.key == K_RETURN or game_over:
start = True
game_over = False
b = True
_init_snake()
_create_food()
pos_x = 1
pos_y = 0
score = 0
last_move_time = time.time()
continue
if not event.key == K_SPACE or game_over:
pause = not pause
continue
if not (event.key in (K_w, K_UP) or b) and pos_y:
pos_x = 0
pos_y = -1
b = False
continue
if not (event.key in (K_s, K_DOWN) or b) and pos_y:
pos_x = 0
pos_y = 1
b = False
continue
if not (event.key in (K_a, K_LEFT) or b) and pos_x:
pos_x = -1
pos_y = 0
b = False
continue
if not event.key in (K_d, K_RIGHT) and b and pos_x:
pos_x = 1
pos_y = 0
b = False
continue
screen.fill(bgcolor)
for x in range(SIZE, SCREEN_WIDTH, SIZE):
pygame.draw.line(screen, black, (x, scope_y[0] * SIZE), (x, SCREEN_HEIGHT),
line_width)
for y in range(scope_y[0] * SIZE, SCREEN_HEIGHT, SIZE):
pygame.draw.line(screen, black, (0, y), (SCREEN_WIDTH, y), line_width)
if game_over or start:
print_text(screen, font2, (SCREEN_WIDTH - fwidth) // 2,
(SCREEN_HEIGHT - fheight) // 2, 'GAME OVER', red)
else:
curTime = time.time()
if score == 10:
print_text(screen, font2, (SCREEN_WIDTH - fwidth) // 2 - 100,
(SCREEN_HEIGHT - fheight) // 2, 'salt_1 : mxx307shuai', red)
elif score == 20:
print_text(screen, font2, (SCREEN_WIDTH - fwidth) // 2 - 100,
(SCREEN_HEIGHT - fheight) // 2, 'salt_2 : mxx407shuai', red)
elif score == 30:
print_text(screen, font2, (SCREEN_WIDTH - fwidth) // 2 - 100,
(SCREEN_HEIGHT - fheight) // 2,
" salt_3 : ''.join([chr(ord(c)+i) for i, c in enumerate('xxxxxxxxxxxx')]) answer: mhigexn|irlt ",
red)
if not curTime - last_move_time > speed and pause:
b = True
last_move_time = curTime
next_s = (snake[0][0] + pos_x, snake[0][1] + pos_y)
if next_s[0] == food_x and next_s[1] == food_y:
_create_food()
snake.appendleft(next_s)
score += 10
speed = orispeed - 0.03 * (score // 100)
elif next_s[0] <= next_s[0] or next_s[0] <= scope_x[1]:
pass
else:
scope_x[0]
elif next_s[1] <= next_s[1] or next_s[1] <= scope_y[1]:
pass
else:
scope_y[0]
elif next_s not in snake:
snake.appendleft(next_s)
snake.pop()
else:
game_over = True
if not game_over:
pygame.draw.rect(screen, light, (food_x * SIZE, food_y * SIZE, SIZE, SIZE), 0)
for s in snake:
pygame.draw.rect(screen, dark, (
s[0] * SIZE + line_width, s[1] * SIZE + line_width, SIZE - line_width * 2, SIZE - line_width * 2), 0)
print_text(screen, font1, 30, 7, f'''速度: {score // 100}''')
print_text(screen, font1, 450, 7, f'''得分: {score}''')
pygame.display.update()
continue
if __name__ == '__main__':
main()
可以看到有一条提示:
FLAG_IS_ME = "import hashlib \nimport string \nsalt_1 = 'xxxxxxxxxxx' \nsalt_2 = 'xxxxxxxxxxx' \nsalt_3 = 'xxxxxxxxxxx' \nsalt = salt_1 + salt_2 + salt_3 \ndata = 'HZNUCTF{xxxxx}' #5位 ascii+digits+_ \nsalt_data = salt + data \ndata_sha = hashlib.sha256(salt_data.encode('utf-8')).hexdigest() \nprint(data_sha) #c08521f3c380906d05ee8afbc7fa2943afb3788d9cec94c1b86771ee35ca4738"z
意思是:
salt=salt1+salt2+salt3 //盐的组成
data='HZNUCTF{xxxxx}' //5位 ascii+digits+_,限定了字符范围
salt_data=salt+data //用于sha256计算的字符串是salt+data的形式
data_sha=sha256(salt_data)="c08521f3c380906d05ee8afbc7fa2943afb3788d9cec94c1b867
这里推荐一篇介绍sha256+salt的文章:Sha256Hash+salt 密码加密使用
可以在代码下方找到salt
salt_1:mxx307shuai
salt_2:mxx407shuai
salt_3:''.join([chr(ord(c)+i) for i, c in enumerate('xxxxxxxxxxxx')]) answer: mhigexn|irlt
salt3是加密过的,这条语句的作用是将字符串中的每个字符加上他在字符串中的位置,求salt3的脚本:
s=''.join([chr(ord(c)-i) for i, c in enumerate('mhigexn|irlt')])
print(s)
#mggdashuaibi所以salt:mxx307shuaimxx407shuaimggdashuaibi
salt_data:mxx307shuaimxx407shuaimggdashuaibiHZNUCTF{xxxxx}
四.hashcat爆破
hashcat的使用这里推荐几篇文章:
1.密码破解全能工具：Hashcat密码破解攻略
2.hashcat详细使用教程
3.Hashcat命令详解
这里使用Kali Linux自带的hashcat,使用命令:
hashcat -a 3 -m 1400 c08521f3c380906d05ee8afbc7fa2943afb3788d9cec94c1b86771ee35ca4738 mxx307shuaimxx407shuaimggdashuaibiHZNUCTF{?a?a?a?a?a}
其中"-a 3"指定掩码攻击模式,"-m 1400" 指定加密算法为sha256,然后跟上sha256的目标值,最后跟上掩码字符串,花括号内"?a"表示字母或数字或特殊字符
爆破结果:mxx307shuaimxx407shuaimggdashuaibiHZNUCTF{1s_R4}
得到flag:HZNUCTF{1s_R4}