{"id":347,"date":"2025-12-07T19:30:45","date_gmt":"2025-12-07T11:30:45","guid":{"rendered":"https:\/\/www.hurkin.top\/?p=347"},"modified":"2025-12-07T19:47:26","modified_gmt":"2025-12-07T11:47:26","slug":"d-u-know-pyc%ef%bc%9f%e5%ae%98%e6%96%b9write-up","status":"publish","type":"post","link":"https:\/\/www.hurkin.top\/index.php\/2025\/d-u-know-pyc%ef%bc%9f%e5%ae%98%e6%96%b9write-up\/","title":{"rendered":"D u know Pyc\uff1f\u5b98\u65b9Write Up"},"content":{"rendered":"

\u8fd9\u9898\u7684\u7075\u611f\u6765\u81eaC3ngH<\/em><\/strong>\u5e08\u5085\u7684\u201c\u4f60\u77e5\u9053pyc\u7684\u6587\u4ef6\u5934\u53ef\u4ee5\u63a8\u51fa\u6765\u5417\u201d\uff0c\u4e8e\u662f\u5c31\u6709\u4e86\u8fd9\u9898<\/p>\n

\u524d\u540e\u7684\u90e8\u5206\u4f30\u8ba1\u4e0d\u662f\u5f88\u96be\uff0c\u90a3\u5c31\u4e3b\u8981\u6765\u8bb2\u8bb2\u6784\u5efapyc\u6253\u660e\u6587\u653b\u51fb\u8fd9\u4e00\u6b65<\/p>\n

\u5173\u4e8ePYC<\/h2>\n

https:\/\/ctf-wiki.org\/misc\/other\/pyc\/<\/a><\/p>\n

\u53ef\u4ee5\u53c2\u8003\u8fd9\u4e2a\u6587\u6863<\/p>\n

\"\"<\/p>\n

ok\u56de\u5934\u770b\u6211\u7ed9\u7684\u538b\u7f29\u5305\uff0c\u7ed9\u4e86\u4fe1\u606f<\/p>\n

python 3.12.12\r\nBit Field\u4e3a00 00 00 00\r\nhash \u5b57\u6bb5\u975e\u7f6e\u7a7a<\/code><\/pre>\n
Magic Number<\/h3>\n
\u90a3\u5df2\u77e5python\u7248\u672c\u53f7\u5c31\u53ef\u4ee5\u63a8\u51fa\u524d\u56db\u5b57\u8282<\/p>\n
conda create -n ctf-test python=3.12.12\r\nconda activate ctf-test\r\npython\r\n>>>import importlib.util\r\n>>>importlib.util.MAGIC_NUMBER\r\nb'xcbrrn'importlib.util.MAGIC_NUMBER.hex()\r\n'cb0d0d0a'<\/code><\/pre>\n
\u53ef\u4ee5\u5f97\u5230\u524d\u56db\u5b57\u8282\"cb0d0d0a\"<\/p>\n
Bit Field<\/h3>\n
\u5728python 3.12.12\u4e2d\uff0cBit Field\u53ea\u6709\u4e24\u79cd\u72b6\u6001<\/p>\n
00 00 00 00 ------->\u540e\u9762\u8ddf\u7740\u7684\u662fTimestamp\u548cSource Size\uff0c\u7136\u540e16\u4f4d\u540ehash<\/p>\n
\u503c\u7f6e\u7a7a(\u5c31\u662f\u51680\uff0c\u4f1a\u88ab\u975e\u9884\u671f\uff0c\u6240\u4ee5\u6211\u624b\u52a8\u5c06\u5176\u6539\u6389\u4e86\uff0c\u4f46\u662f\u4e0d\u4f1a\u5f71\u54cdpyc\u7684\u6b63\u5e38\u529f\u80fd\uff0c\u5bf9\u6b64\u611f\u5174\u8da3\u5e08\u5085\u53ef\u4ee5\u81ea\u5df1\u53bb\u6784\u5efa\u4e00\u4e0b)<\/p>\n
01 00 00 00------->\u540e\u9762\u8ddf\u7740\u7684\u662fhash\u503c<\/p>\n
\u81f3\u4e8eBit Field<\/strong>\u4e3a00 00 00 00\uff0c\u51b3\u5b9a\u4e868-12\u4f4d\u662fTIMESTAMP or HASH<\/p>\n
Timestamp\u548cSource Size<\/h3>\n
\u6709\u4e00\u4e2a\u70b9\u5728ctf-wiki\u91cc\u6ca1\u5199\u6e05\u695a\uff0c\u4ed6\u8bf4\u7684\u662f.pyc\u4ea7\u751f\u7684\u65f6\u95f4\uff0c\u4e8b\u5b9e\u4e0a\u662fpy\u6587\u4ef6\u6700\u540e\u4fee\u6539\u7684\u65f6\u95f4\uff0c\u5927\u5c0f\u4e5f\u662f\u6307py\u6587\u4ef6\u7684\u5927\u5c0f\uff0c\u6211\u5728\u538b\u7f29\u5305\u91cc\u7ed9\u4e86flag.py\uff0c\u53ef\u4ee5\u770b\u5230\u5927\u5c0f\uff0c\u4e0d\u8fc7\u53ea\u80fd\u770b\u5230 ZIP entry \u7684 mtime\uff0c\u800c\u4e0d\u80fd\u770b\u5230\u6587\u4ef6\u4ea7\u751f\u7684\u65f6\u95f4\u3002<\/p>\n
\u6240\u4ee5\u53ea\u80fd\u83b7\u53d6Source Size<\/p>\n
\"\"<\/p>\n
flag.py\u539f\u59cb\u5927\u5c0f\u662f1411\u5b57\u8282\uff0c\u8f6c\u4e3a4\u5b57\u8282\u768416\u8fdb\u5236\u8868\u793a\u4e3a\uff1a83050000<\/code><\/p>\n
\u660e\u6587\u653b\u51fb<\/h3>\n
\u7efc\u4e0a\u5df2\u77e5CB 0D 0D 0A 00 00 00 00 ?? ?? ?? ?? 83 05 00 00<\/p>\n
8+4\u5b57\u8282\uff0c\u4e14\u504f\u79fb\u91cf\u4e3a12\u3002\u53ef\u4ee5\u8fdb\u884c\u660e\u6587\u653b\u51fb<\/p>\n
\"\"\"\"<\/p>\n
\u540e\u9762\u5206\u6790flag.py\u5c31\u53ef\u4ee5\u4e86<\/p>\n
exp<\/p>\n
from base64 import b64decode\r\ndef rc4_bytes(key: bytes, data: bytes) -> bytes:\r\n    S = list(range(256))\r\n    j = 0\r\n    for i in range(256):\r\n        j = (j + S[i] + key[i % len(key)]) & 0xFF\r\n        S[i], S[j] = S[j], S[i]\r\n    i = j = 0\r\n    out = bytearray()\r\n    for byte in data:\r\n        i = (i + 1) & 0xFF\r\n        j = (j + S[i]) & 0xFF\r\n        S[i], S[j] = S[j], S[i]\r\n        K = S[(S[i] + S[j]) & 0xFF]\r\n        out.append(byte ^ K)\r\n    return bytes(out)\r\nCIPHER_B64 = \"adJts2ab4DvAn9Zu60bNyGrOAWj72B1\/kg==\" \r\ndef step2_unxor(data: bytes, k: int = 0x37) -> bytes:\r\n    return bytes(b ^ k for b in data)\r\ndef step1_unreverse(s: str) -> str:\r\n    return s[::-1]\r\ndef solve():\r\n    cipher = b64decode(CIPHER_B64)\r\n    with open(\"S3ct3t\", \"rb\") as f:\r\n        key = f.read().strip()\r\n    inter = rc4_bytes(key, cipher)\r\n    b_plain_reversed = step2_unxor(inter, 0x37)\r\n    s_plain_reversed = b_plain_reversed.decode(\"utf-8\", errors=\"ignore\")\r\n    flag = step1_unreverse(s_plain_reversed)\r\n    print(\"flag:\", flag)\r\nif __name__ == \"__main__\":\r\n    solve()\r\n<\/code><\/pre>\n
S3ct3t\u6587\u4ef6\u5728\u56fe\u7247\u5c3e\u90e8\u7684\u538b\u7f29\u5305\u4e2d\uff0c\u89e3\u538b\u83b7\u5f97<\/p>\n
\"\"<\/p>\n
 <\/p>\n
S3ct3t\uff1ayour-secret-key-here<\/p>\n
\u968f\u540e\u83b7\u5f97flag\uff1aVNCTF{W3lc0me_T0_V&N2025}<\/strong><\/p>\n
\u5982\u679c\u672c\u9898\u6709\u54ea\u91cc\u6709\u95ee\u9898\uff0c\u8fd8\u8bf7\u5e08\u5085\u4eec\u591a\u591a\u5305\u6db5\uff0c\u6b22\u8fce\u627e\u6211\u53cd\u9988<\/p>\n","protected":false},"excerpt":{"rendered":"
\u8fd9\u9898\u7684\u7075\u611f\u6765\u81eaC3ngH\u5e08\u5085\u7684\u201c\u4f60\u77e5\u9053pyc\u7684\u6587\u4ef6\u5934\u53ef\u4ee5\u63a8\u51fa\u6765\u5417\u201d\uff0c\u4e8e\u662f\u5c31\u6709\u4e86\u8fd9\u9898 \u524d\u540e\u7684\u90e8\u5206\u4f30\u8ba1\u4e0d\u662f\u5f88\u96be\uff0c\u90a3\u5c31\u4e3b\u8981\u6765\u8bb2\u8bb2\u6784\u5efapy …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"emotion":"","emotion_color":"","title_style":"","license":"","_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-347","post","type-post","status-publish","format-standard","hentry","category-some-competition"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/www.hurkin.top\/index.php\/wp-json\/wp\/v2\/posts\/347","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.hurkin.top\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hurkin.top\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hurkin.top\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hurkin.top\/index.php\/wp-json\/wp\/v2\/comments?post=347"}],"version-history":[{"count":4,"href":"https:\/\/www.hurkin.top\/index.php\/wp-json\/wp\/v2\/posts\/347\/revisions"}],"predecessor-version":[{"id":355,"href":"https:\/\/www.hurkin.top\/index.php\/wp-json\/wp\/v2\/posts\/347\/revisions\/355"}],"wp:attachment":[{"href":"https:\/\/www.hurkin.top\/index.php\/wp-json\/wp\/v2\/media?parent=347"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hurkin.top\/index.php\/wp-json\/wp\/v2\/categories?post=347"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hurkin.top\/index.php\/wp-json\/wp\/v2\/tags?post=347"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}