[鹤城杯 2021]AreYouRich

MainActivity用于验证账号密码，验证成功进入UserActivity

如果this.b大于499999999则执行下面的异或逻辑

然后使用了标准RC4，密文为b.c.a.a.b，key为arr_b2

这里解题不需要账号密码正确，直接将输出flag代码逆向处理一下即可

先RC4解密

enc = [0x51, 0xF3, 0x54, 0x92, 0x48, 0x4D, 0xA0, 0x4D, 0x20, 0x8D, 0xB5, 0xDA, 0x9F, 0x45, 0xC0, 0x31, 8, 0xE5, 0x38, 0x72, 0xBC, 0xAE, 0x4C, 0x96, 0xDE]
key = b'secretsecretsecretsecretsecretsecret'

S = list(range(256))
j = 0

for i in range(256):
j = (j + S[i] + key[i % len(key)]) % 256
S[i], S[j] = S[j], S[i]
i = j = 0
for char in enc:
i = (i + 1) % 256
j = (j + S[i]) % 256
S[i], S[j] = S[j], S[i]
k = S[(S[i] + S[j]) % 256]
print(chr(char ^ k),end="")

但是结果是乱码

注意到MainActivity的末尾对key进行了修改

使用这个key值

enc = [0x51, 0xF3, 0x54, 0x92, 0x48, 0x4D, 0xA0, 0x4D, 0x20, 0x8D, 0xB5, 0xDA, 0x9F, 0x45, 0xC0, 0x31, 8, 0xE5, 0x38, 0x72, 0xBC, 0xAE, 0x4C, 0x96, 0xDE]
key = b'5FQ5AaBGbqLGfYwjaRAuWGdDvyjbX5nH'

S = list(range(256))
j = 0

for i in range(256):
j = (j + S[i] + key[i % len(key)]) % 256
S[i], S[j] = S[j], S[i]
i = j = 0
for char in enc:
i = (i + 1) % 256
j = (j + S[i]) % 256
S[i], S[j] = S[j], S[i]
k = S[(S[i] + S[j]) % 256]
print(chr(char ^ k),end="")

得到结果vvvvipuser_TTTTKRWQGP@001

再逆向异或的代码

a = [15, 70, 3, 41, 1, 48, 35, 64, 58, 50, 0, 101, 100, 99, 11, 123, 52, 8, 60, 119, 62, 115, 73, 17, 16]
b = b"vvvvipuser_TTTTKRWQGP@001"

print("".join(chr(i) for i in [102, 108, 97, 103, 123]),end="")
for i in range(len(a)):
print(chr(a[i] ^ b[i]),end="")
print(chr(125))

flag{y0u_h@V3_@_107_0f_m0n3y!!}

总结

程序验证账号密码后执行设定的RC4和XOR逻辑输出flag，直接逆向输出flag逻辑即可