2024春秋杯冬季赛Day2

8 Misc Weevil’s Whisper

分析发现写了一个混淆马，编写脚本解密出flag

import base64
import zlib


def xor_decrypt(data, key):
    """实现与PHP代码相同的异或解密"""
    key_len = len(key)
    data_len = len(data)
    result = bytearray()

    for i in range(data_len):
        result.append(data[i] ^ ord(key[i % key_len]))

    return bytes(result)


# 定义密钥和标记
k = "161ebd7d"
kh = "45089b3446ee"
kf = "4e0d86dbcf92"
p = "lFDu8RwONqmag5ex"


def decrypt_data(encrypted_data):
    """解密数据"""
    try:
        # 提取有效载荷（去除头尾标记）
        start = encrypted_data.index(kh) + len(kh)
        end = encrypted_data.index(kf)
        payload = encrypted_data[start:end]

        # Base64解码
        decoded = base64.b64decode(payload)

        # XOR解密
        decrypted = xor_decrypt(decoded, k)

        try:
            # 尝试zlib解压缩
            decompressed = zlib.decompress(decrypted)
            return decompressed.decode('utf-8', errors='ignore')
        except:
            # 如果解压缩失败，直接返回解密后的数据
            return decrypted.decode('utf-8', errors='ignore')

    except Exception as e:
        return f"解密失败: {str(e)}"


response_data = "lFDu8RwONqmag5ex45089b3446eeSap6risomCodHP/PqrQaqvueeU+wURkueAeGLStP+bQE+HqsLq39zTQ2L1hsAA==4e0d86dbcf92"

print("解密后的响应数据:")
print(decrypt_data(response_data))