题目来源: XCTF 4th-WHCTF-2017

pyc文件,直接用工具逆向一下。
root@ubuntu:/home/ctf/misc/uncompyle# ./go.sh
# uncompyle6 version 3.8.0
# Python bytecode 3.6 (3379)
# Decompiled from: Python 3.7.5 (default, Feb 23 2021, 13:22:40)
# [GCC 8.4.0]
# Embedded file name: pystego.py
# Compiled at: 2017-07-31 09:44:47
# Size of source mod 2**32: 1961 bytes
import sys, os, hashlib, time, base64
fllag = '9474yeUMWODKruX7OFzD9oekO28+EqYCZHrUjWNm92NSU+eYXOPsRPEFrNMs7J+4qautoqOrvq28pLU='
def crypto(string, op='encode', public_key='ddd', expirytime=0):
ckey_lenth = 4
public_key = public_key and public_key or ''
key = hashlib.md5(public_key).hexdigest()
keya = hashlib.md5(key[0:16]).hexdigest()
keyb = hashlib.md5(key[16:32]).hexdigest()
keyc = ckey_lenth and (op == 'decode' and string[0:ckey_lenth] or hashlib.md5(str(time.time())).hexdigest()[32 - ckey_lenth:32]) or ''
cryptkey = keya + hashlib.md5(keya + keyc).hexdigest()
key_lenth = len(cryptkey)
string = op == 'decode' and base64.b64decode(string[4:]) or '0000000000' + hashlib.md5(string + keyb).hexdigest()[0:16] + string
string_lenth = len(string)
result = ''
box = list(range(256))
randkey = []
for i in xrange(255):
randkey.append(ord(cryptkey[(i % key_lenth)]))
for i in xrange(255):
j = 0
j = (j + box[i] + randkey[i]) % 256
tmp = box[i]
box[i] = box[j]
box[j] = tmp
for i in xrange(string_lenth):
a = j = 0
a = (a + 1) % 256
j = (j + box[a]) % 256
tmp = box[a]
box[a] = box[j]
box[j] = tmp
result += chr(ord(string[i]) ^ box[((box[a] + box[j]) % 256)])
if op == 'decode':
if result[0:10] == '0000000000' or int(result[0:10]) - int(time.time()) > 0:
if result[10:26] == hashlib.md5(result[26:] + keyb).hexdigest()[0:16]:
return result[26:]
return
else:
return keyc + base64.b64encode(result)
if __name__ == '__main__':
while True:
flag = raw_input('Please input your flag:')
if flag == crypto(fllag, 'decode'):
print('Success')
break
else:
continue
# okay decompiling 58cadd8d8269455ebc94690fd777c34a.pyc
root@ubuntu:/home/ctf/misc/uncompyle# cat go.sh
uncompyle6 58cadd8d8269455ebc94690fd777c34a.pyc
改下代码,运行得到:
The challenge is Steganography 被坑了。。。

提示是隐写,于是用py的专用隐写处理下:
root@ubuntu:/home/ctf/misc/stegosaurus# ./go.sh
Extracted payload: Flag{HiD3_Pal0ad_1n_Python}
root@ubuntu:/home/ctf/misc/stegosaurus# cat go.sh
python3 stegosaurus.py -x 58cadd8d8269455ebc94690fd777c34a.pyc 搞定。

Flag{HiD3_Pal0ad_1n_Python}