rev - g0Re - elfUPX/AES/base64

查壳，发现是upx打包的elf文件

upx -d 脱壳脱不掉，010中发现魔改的特征码

将OKXX –> UPX! 即可

脱壳后拖入ida64分析

main函数审计代码

动调提取密文

1	E6CE89C8CFC5F5C9D2D9C091CE7FACCCE9CFB7C096D4EA92E2D7DF84CBA5AE93A6CABE97DFCEF0C9B7E1AE6BC4B165DBCEED9293D68CEDC3A3DA94A5AAB2B5A755

然后提取aes的密钥 - 按a键转化为字符串 – > wvgitbygwbk2b46d

发现base64换表了，提取表

1	456789}#IJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123ABCDEFGH

最后动调sub，找出sub的key –> key还是这个

cyberchef—-!!!

flag{g0_1s_th3_b3st_1anguage_1n_the_wOrld!_xxx}

exp

from Crypto.Cipher import AES
import base64
enc = [0xE6, 0xCE, 0x89, 0xC8, 0xCF, 0xC5, 0xF5, 0xC9, 0xD2, 0xD9,
       0xC0, 0x91, 0xCE, 0x7F, 0xAC, 0xCC, 0xE9, 0xCF, 0xB7, 0xC0,
       0x96, 0xD4, 0xEA, 0x92, 0xE2, 0xD7, 0xDF, 0x84, 0xCB, 0xA5,
       0xAE, 0x93, 0xA6, 0xCA, 0xBE, 0x97, 0xDF, 0xCE, 0xF0, 0xC9,
       0xB7, 0xE1, 0xAE, 0x6B, 0xC4, 0xB1, 0x65, 0xDB, 0xCE, 0xED,
       0x92, 0x93, 0xD6, 0x8C, 0xED, 0xC3, 0xA3, 0xDA, 0x94, 0xA5,
       0xAA, 0xB2, 0xB5, 0xA7]
key = b"wvgitbygwbk2b46d"

base = ""
for i in range(len(enc)):
    base += chr(((enc[i] - key[i % 16]) ^ 0x1a) & 0xff)
print(base)
tableB = "456789}#IJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123ABCDEFGH"
tableA = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
aes_enc = base64.b64decode(base.translate(str.maketrans(tableB, tableA)))
aes = AES.new(key=b"wvgitbygwbk2b46d", mode=AES.MODE_ECB)
print(aes.decrypt(aes_enc))
# b'flag{g0_1s_th3_b3st_1anguage_1n_the_wOrld!_xxx}\x01'