一、3-1

题目链接：https://adworld.xctf.org.cn/task/task_list?type=misc&number=1&grade=1&page=4

二、答题步骤

1.winhex

用winhex分析文件发现是rar文件

该后缀名为rar进行解压

2.流量包

扔进winhex发现是流量包
用wireshark打开

追踪TCP流，在第5个tcp流中发现flag.rar

导出对象

解压flag.rar
发现需要密码

解压要密码

3.python

在第6个TCP流中发现一些linux指令
一个base64
一段python

base64：19aaFYsQQKr+hVX6hl2smAUQ5a767TsULEUebWSajEo=
python代码

# coding:utf-8

__author__ = 'YFP'

from Crypto import Random
from Crypto.Cipher import AES
import sys
import base64

IV = 'QWERTYUIOPASDFGH'
def decrypt(encrypted):
    aes = AES.new(IV, AES.MODE_CBC, IV)
    return aes.decrypt(encrypted)

def encrypt(message):
    length = 16
    count = len(message)
    padding = length - (count % length)
    message = message + '\0' * padding
    aes = AES.new(IV, AES.MODE_CBC, IV)
    return aes.encrypt(message)

str = 'this is a test'
example = encrypt(str)
print(decrypt(example))

4.AES

进行解密

# coding:utf-8

__author__ = 'YFP'

from Crypto import Random
from Crypto.Cipher import AES
import sys
import base64

IV = 'QWERTYUIOPASDFGH'
def decrypt(encrypted):
    aes = AES.new(IV, AES.MODE_CBC, IV)
    return aes.decrypt(encrypted)

def encrypt(message):
    length = 16
    count = len(message)
    padding = length - (count % length)
    message = message + '\0' * padding
    aes = AES.new(IV, AES.MODE_CBC, IV)
    return aes.encrypt(message)

str = 'this is a test'
example = encrypt(str)
print(decrypt(example))
s='19aaFYsQQKr+hVX6hl2smAUQ5a767TsULEUebWSajEo='
flag=base64.b64decode(s)
print(decrypt(flag))

得到密码passwd={No_One_Can_Decrypt_Me}

4.解压

flag：WDCTF{Seclab_CTF_2017}

总结

• tcp
• base64
• python
• aes
• rar