JCTF 2014 小菜一碟

测试文件：https://static2.ichunqiu.com/icq/resources/fileupload//CTF/JCTF2014/re100

1.准备

获得信息

• ZIP文件
• Java文件

用解压文件打开

获得信息

• APK文件

2.Smali2JavaUI打开

 /**
   * Generated by smali2java 1.0.0.558
   * Copyright (C) 2013 Hensence.com
   */

 package com.example.encoding;

 import android.app.Activity;
 import android.widget.Button;
 import android.widget.EditText;
 import java.security.NoSuchAlgorithmException;
 import java.security.MessageDigest;
 import android.util.Base64;
 import android.os.Bundle;
 import android.view.View;
 import android.view.Menu;
 import android.view.MenuInflater;

 public class MainActivity extends Activity {
     private Button button;
     private MyDialog dialog1;
     private MyDialog dialog2;
     private MyDialog dialog3;
     private EditText edittext;
     private StringBuffer str;

     protected void onCreate(Bundle savedInstanceState) {
         super.onCreate(savedInstanceState);
         setContentView(0x7f030000);
         dialog1 = new MyDialog(this, "try again");
         dialog2 = new MyDialog(this, "congratulations, you success!!!");
         dialog3 = new MyDialog(this, "sorry,please try again");
         edittext = (EditText)findViewById(0x7f080000);
         button = (Button)findViewById(0x7f080001);
         button.setOnClickListener(new View.OnClickListener(this) {

             1(MainActivity p1) {
             }

             public void onClick(View v) {
                 MyDialog dialog3 = this$0new StringBuffer(edittext.getText().toString());
                 str = localString1;
                 if(str.length() < 0x5) {
                     edittext.setText("");
                     dialog1.showDialog();
                     return;
                 }
                 str.reverse();
                 Log.i("ClownQiang", localString1.append(new String(str)).toString());
                 String md5_string = encode(new String(str));
                 Log.i("ClownQiang", str);
                 String base64 = getBASE64(md5_string).trim();
                 Log.i("ClownQiang", md5_string);
                 if(base64.equalsIgnoreCase("NzU2ZDJmYzg0ZDA3YTM1NmM4ZjY4ZjcxZmU3NmUxODk=")) {
                     dialog2.showDialog();
                     return;
                 }
                 edittext.setText("");
                 dialog3.showDialog();
             }
         });
     }

     public static String getBASE64(String s) {
         if(s == null) {
             return null;
         }
         return Base64.encodeToString(getBytes(), 0x0);
     }

     public static final String encode(String s) {
         // :( Parsing error. Please contact me.
     }

     public boolean onCreateOptionsMenu(Menu menu) {
         getMenuInflater().inflate(0x7f070000, menu);
         return true;
     }
 }

3.代码分析

提取出主要的代码

str.reverse();//字符串反向
Log.i("ClownQiang", localString1.append(new String(str)).toString());
String md5_string = encode(new String(str));//md5加密
Log.i("ClownQiang", str);
String base64 = getBASE64(md5_string).trim();//base64加密
Log.i("ClownQiang", md5_string);
if(base64.equalsIgnoreCase("NzU2ZDJmYzg0ZDA3YTM1NmM4ZjY4ZjcxZmU3NmUxODk=")) {
    dialog2.showDialog();
    return;
}    

根据代码，我们只需要将经过md5和base64加密后的字符串"NzU2ZDJmYzg0ZDA3YTM1NmM4ZjY4ZjcxZmU3NmUxODk="解密后反向即可。

base64解密：756d2fc84d07a356c8f68f71fe76e189

md5解密：}321nimda{galflj

反向输出：jlflag{admin123}

 

4.get flag！

flag{admin123}