{"id":354,"date":"2017-12-05T16:50:08","date_gmt":"2017-12-05T08:50:08","guid":{"rendered":"http:\/\/120.76.142.240\/?p=354"},"modified":"2017-12-05T16:50:08","modified_gmt":"2017-12-05T08:50:08","slug":"%e5%93%88%e5%b8%8c%e6%89%a9%e5%b1%95%e9%95%bf%e5%ba%a6%e6%94%bb%e5%87%bb","status":"publish","type":"post","link":"http:\/\/ssynas.top\/?p=354","title":{"rendered":"\u54c8\u5e0c\u6269\u5c55\u957f\u5ea6\u653b\u51fb"},"content":{"rendered":"

\u5f04\u4e862\u5929\u624d\u5f04\u51fa\u6765<\/p>\n

0x00 \u8d77\u4e8e\u4e00\u9053CTF<\/span><\/strong><\/h1>\n

\u8fd9\u662f\u4e00\u9053\u597d\u9898\uff01\u5b66\u4e86\u4e00\u79cd\u65b0\u7684\u653b\u51fb\u65b9\u6cd5\uff0c\u987a\u5e26\u77e5\u9053\u4e86<\/span>hash<\/span>\u7684\u5b9e\u73b0\u3002\u53ea\u4e0d\u8fc7\u73b0\u5728\u8fd9\u79cd\u653b\u51fb\u65b9\u6cd5\u4e5f\u53ea\u6d3b\u5728<\/span>ctf<\/span>\u4e2d\u4e86<\/span><\/p>\n

\u9996\u5148\u662f\u6539\u5305\u80fd\u591f\u770b\u5230\u6e90\u7801<\/p>\n

 <\/p>\n

flag = “XXXXXXXXXXXXXXXXXXXXXXX”;<\/p>\n

$secret = “XXXXXXXXXXXXXXX”; \/\/ This secret is 15 characters long for security!<\/p>\n

$username = $_POST[“username”];<\/p>\n

$password = $_POST[“password”];<\/p>\n

if (!empty($_COOKIE[“getmein”])) {<\/p>\n

if (urldecode($username) === “admin” && urldecode($password) != “admin”) {<\/p>\n

if ($COOKIE[“getmein”] === md5($secret . urldecode($username . $password))) {echo “Congratulations! You are a registered user.\\n”;<\/p>\n

die (“The flag is “. $flag);}<\/p>\n

else {<\/p>\n

die (“Your cookies don’t match up! STOP HACKING THIS SITE.”);<\/p>\n

}}<\/p>\n

else {<\/p>\n

die (“You are not an admin! LEAVE.”);}}<\/p>\n

setcookie(“sample-hash”, md5($secret . urldecode(“admin” . “admin”)), time() + (60 * 60 * 24 * 7));<\/p>\n

if (empty($_COOKIE[“source”])) {<\/p>\n

setcookie(“source”, 0, time() + (60 * 60 * 24 * 7));}<\/p>\n

else {<\/p>\n

if ($_COOKIE[“source”] != 0) {<\/p>\n

echo “”; \/\/ This source code is outputted here}}<\/p>\n

\u8981\u663e\u793a\u51faflag\u5c31\u5f97\u8981\u901a\u8fc7\u8fd9\u4e2a\u903b\u8f91\uff1a$COOKIE[“getmein”] === md5($secret . urldecode($username . $password)<\/p>\n

\u95ee\u9898\u5728\u4e8e\u4e0d\u77e5\u9053secret\u7684\u503c\u662f\u591a\u5c11\uff0c\u7206\u7834\u51e0\u4e4e\u662f\u4e0d\u53ef\u80fd\u7684\uff0c\u8fd9\u91cc\u5c31\u8981\u7528\u5230\u54c8\u5e0c\u6269\u5c55\u957f\u5ea6\u653b\u51fb<\/p>\n

 <\/p>\n

0x01\u4ec0\u4e48\u662f\u54c8\u5e0c\u6269\u5c55\u957f\u5ea6\u653b\u51fb<\/strong><\/h1>\n

\u5df2\u77e5\uff1asalt\u7684MD5\u503c\uff0c\u4f46\u662f\u4e0d\u77e5\u9053str1\u672c\u8eab\u7684\u503c<\/p>\n

\u6211\u4eec\u53ef\u4ee5\u77e5\u9053salt+padding+\u4efb\u610f\u5b57\u7b26\u00a0\u00a0 \u7684md5\u503c<\/p>\n

\u56e0\u4e3amd5\u7684\u5b9e\u73b0\u4e2d64\u8f6e\u53d8\u6362\u6bcf\u6b21\u90fd\u662f\u7528\u7684\u4e0a\u6b21\u53d8\u6362\u7684\u7ed3\u679c\uff0c\u901a\u8fc7md5\u53ef\u4ee5\u53cd\u5411\u7b97\u51fa\u6700\u540e\u4e00\u6b21\u53d8\u6362\u7684\u56db\u4e2a\u503c\uff0c\u4e4b\u540e\u52a0\u5165\u5230\u53d8\u6362\u51fd\u6570\u4e2d\uff0c\u5728\u540e\u9762\u6dfb\u52a0\u4efb\u610f\u6570\u636e\u3002\u8fd9\u6837\u5728\u4e0d\u77e5\u9053salt\u672c\u8eab\u503c\u7684\u60c5\u51b5\u4e0b\u4e5f\u80fd\u7b97\u51fasalt+padding+\u4efb\u610f\u6570\u636e\u7684md5\u503c\u4e86<\/p>\n

\u6211\u4eec\u9700\u8981\u77e5\u9053md5\u7684\u5b9e\u73b0\u8fc7\u7a0b\u624d\u80fd\u7406\u89e3\u8fd9\u79cd\u653b\u51fb\u65b9\u5f0f<\/p>\n

hash\u7684\u5b9e\u73b0<\/strong><\/h2>\n
\n
\n
\n

\u9996\u5148\u5bf9\u6d88\u606f\u8fdb\u884c\u5206\u7ec4\uff0c\u6bcf\u7ec4<\/span>64<\/span>\u4e2a\u5b57\u8282\uff0c\u4e0d\u8db3<\/span>64<\/span>\u4e2a\u5b57\u8282\u7684\u90e8\u5206\u7528<\/span>padding<\/span>\u8865\u9f50\uff0c\u5176\u4e2d\uff0c\u7b2c\u4e00\u4e2a\u8865\u5145\u7684\u5b57\u8282\u662f<\/span>0x80<\/span>\uff0c\u4e4b\u540e\u7684\u90fd\u662f<\/span>0x00<\/span>\uff0c<\/span>padding<\/span>\u7684\u6700\u540e<\/span>8<\/span>\u4e2a\u5b57\u8282\u7528\u6765\u8868\u793a\u9700\u8981\u54c8\u5e0c\u7684\u6d88\u606f\u957f\u5ea6<\/span><\/p>\n

def<\/span>padding<\/span>(<\/span>self<\/span>,<\/span>n<\/span>,<\/span>sz<\/span>=<\/span>None<\/span>)<\/span>:<\/span><\/p>\n

if<\/span>sz<\/span>is<\/span>None<\/span>:<\/span><\/p>\n

sz<\/span>=<\/span>n<\/span><\/p>\n

pre<\/span>=<\/span>64<\/span>–<\/span>8<\/span><\/p>\n

sz<\/span>=<\/span>struct.pack(<\/span>“Q”<\/span>,<\/span>sz<\/span>*<\/span>8<\/span>)<\/span><\/p>\n

pad<\/span>=<\/span>‘<\/span>\\x80<\/span>‘<\/span><\/p>\n

n<\/span>+=<\/span>1<\/span><\/p>\n

if<\/span>n<\/span>%<\/span>64<\/span><=<\/span>pre<\/span>:<\/span><\/p>\n

pad<\/span>+=<\/span>‘<\/span>\\x00<\/span>‘<\/span>*<\/span>(pre<\/span>–<\/span>n<\/span>%<\/span>64<\/span>)<\/span><\/p>\n

pad<\/span>+=<\/span>sz<\/span><\/p>\n

else<\/span>:<\/span><\/p>\n

pad<\/span>+=<\/span>‘<\/span>\\x00<\/span>‘<\/span>*<\/span>(pre<\/span>+<\/span>64<\/span>–<\/span>n<\/span>%<\/span>64<\/span>)<\/span><\/p>\n

pad<\/span>+=<\/span>sz<\/span><\/p>\n

return<\/span>pad<\/span><\/p>\n

#<\/span>\u6700\u540e\u516b\u4e2a\u5b57\u8282\u4e3a\u6570\u636e\u957f\u5ea6<\/span><\/p>\n

def<\/span>pad<\/span>(<\/span>self<\/span>,<\/span>msg<\/span>)<\/span>:<\/span><\/p>\n

return<\/span>msg<\/span>+<\/span>self<\/span>.padding(<\/span>len<\/span>(<\/span>msg<\/span>))<\/span><\/p>\n

\u3002<\/p>\n

\u4e4b\u540e\u5f00\u59cb\u5bf9\u6bcf\u7ec4\u6d88\u606f\u8fdb\u884c\u538b\u7f29\uff0c\u7ecf\u8fc7<\/span>64<\/span>\u8f6e\u7684\u6570\u5b66\u53d8\u6362\uff08\u4f4d\u8fd0\u7b97\u7684\u4e0e\u6216\u975e\u5f02\u6216\u3001\u6309\u4f4d\u5de6\u79fb\u53f3\u79fb\u3001\u6309\u4f4d\u65e0\u7b26\u53f7\u5de6\u79fb\u53f3\u79fb\u3001\u8fdb\u5236\u8f6c\u6362\u3001<\/span>sin<\/span>\u3001\u548c<\/span>0xFF<\/span>\u3001<\/span>0xFFFFFFF<\/span>\u505a\u4e0e\u8fd0\u7b97\u4fdd\u8bc1\u4f4d\u6570\u4e0d\u53d8\u7b49\u7b49\uff09\u6bcf\u4e00\u6b21\u53d8\u6362\u538b\u7f29\u7684\u7ed3\u679c\u88ab\u5f53\u6210\u4e0b\u4e00\u8f6e\u53d8\u6362\u538b\u7f29\u7684\u521d\u59cb\u503c\u3002\u6700\u5f00\u59cb\u7684\u521d\u59cb\u503c\u662f\u7531\u6587\u6863\u89c4\u5b9a\u597d\u7684\u3002\u6700\u540e\u7684\u7ed3\u679c\u62fc\u5728\u4e00\u8d77\u5c31\u662f<\/span>128<\/span>\u4f4d\u7684<\/span>md5<\/span>\u503c<\/span><\/p>\n

\u56db\u4e2a\u5b9a\u4e49\u597d\u7684\u53d8\u6362\u51fd\u6570\uff1a<\/p>\n

F(X,Y,Z) =(X&Y)|((~X)&Z)<\/p>\n

G(X,Y,Z) =(X&Z)|(Y&(~Z))<\/p>\n

H(X,Y,Z) =X^Y^Z<\/p>\n

I(X,Y,Z)=Y^(X|(~Z))<\/p>\n

\uff08&\u662f\u4e0e\uff0c|\u662f\u6216\uff0c~\u662f\u975e\uff0c^\u662f\u5f02\u6216\uff09<\/p>\n

\u56db\u4e2a\u5b9a\u4e49\u597d\u7684\u521d\u59cb\u503c\uff1a<\/p>\n

A=0x01234567\uff0cB=0x89abcdef\uff0cC=0xfedcba98\uff0cD=0x76543210\u3002<\/p>\n

\u53d8\u6362\u51fd\u6570<\/p>\n

def<\/span>XX<\/span>(<\/span>func<\/span>,<\/span>a<\/span>,<\/span>b<\/span>,<\/span>c<\/span>,<\/span>d<\/span>,<\/span>x<\/span>,<\/span>s<\/span>,<\/span>ac<\/span>)<\/span>:<\/span><\/p>\n

res<\/span>=<\/span>0L<\/span><\/p>\n

res<\/span>=<\/span>res<\/span>+<\/span>a<\/span>+<\/span>func<\/span>(<\/span>b<\/span>,<\/span>c<\/span>,<\/span>d<\/span>)<\/span><\/p>\n

res<\/span>=<\/span>res<\/span>+<\/span>x<\/span><\/p>\n

res<\/span>=<\/span>res<\/span>+<\/span>ac<\/span><\/p>\n

res<\/span>=<\/span>res<\/span>&<\/span>0xffffffffL<\/span><\/p>\n

res<\/span>=<\/span>_rotateLeft(res<\/span>,<\/span>s<\/span>)<\/span><\/p>\n

res<\/span>=<\/span>res<\/span>&<\/span>0xffffffffL<\/span><\/p>\n

res<\/span>=<\/span>res<\/span>+<\/span>b<\/span><\/p>\n

r<\/span>e<\/span>turn<\/span>res<\/span>&<\/span>0xffffffffL<\/span><\/p>\n

def<\/span>md5_compress<\/span>(<\/span>self<\/span>,<\/span>buf<\/span>)<\/span>:<\/span><\/p>\n

if<\/span>len<\/span>(<\/span>buf<\/span>)<\/span>!=<\/span>64<\/span>:<\/span><\/p>\n

raise<\/span>ValueError<\/span>,<\/span>“Invalidbufferoflength%d:%s”<\/span>%<\/span>(<\/span>len<\/span>(<\/span>buf<\/span>)<\/span>,<\/span>repr<\/span>(<\/span>buf<\/span>))<\/span><\/p>\n

inp<\/span>=<\/span>struct.unpack(<\/span>“I”<\/span>*<\/span>16<\/span>,<\/span>buf<\/span>)<\/span><\/p>\n

a<\/span>,<\/span>b<\/span>,<\/span>c<\/span>,<\/span>d<\/span>=<\/span>self<\/span>.A<\/span>,<\/span>self<\/span>.B<\/span>,<\/span>self<\/span>.C<\/span>,<\/span>self<\/span>.D<\/span><\/p>\n

#<\/span>\u5f00\u59cb\u8fdb\u884c<\/span>64<\/span>\u8f6e\u6570\u5b66\u53d8\u6362<\/span>,<\/span>\u56db\u5927\u8f6e\uff0c\u6bcf\u8f6e<\/span>16<\/span>\u6b21<\/span><\/p>\n

#Round1.<\/span><\/p>\n

S11<\/span>,<\/span>S12<\/span>,<\/span>S13<\/span>,<\/span>S14<\/span>=<\/span>7<\/span>,<\/span>12<\/span>,<\/span>17<\/span>,<\/span>22<\/span><\/p>\n

a<\/span>=<\/span>XX(F<\/span>,<\/span>a<\/span>,<\/span>b<\/span>,<\/span>c<\/span>,<\/span>d<\/span>,<\/span>inp[<\/span>0<\/span>]<\/span>,<\/span>S11<\/span>,<\/span>0xD76AA478L<\/span>)<\/span>#1<\/span><\/p>\n

d<\/span>=<\/span>XX(F<\/span>,<\/span>d<\/span>,<\/span>a<\/span>,<\/span>b<\/span>,<\/span>c<\/span>,<\/span>inp[<\/span>1<\/span>]<\/span>,<\/span>S12<\/span>,<\/span>0xE8C7B756L<\/span>)<\/span>#2<\/span><\/p>\n

c<\/span>=<\/span>XX(F<\/span>,<\/span>c<\/span>,<\/span>d<\/span>,<\/span>a<\/span>,<\/span>b<\/span>,<\/span>inp[<\/span>2<\/span>]<\/span>,<\/span>S13<\/span>,<\/span>0x242070DBL<\/span>)<\/span>#3<\/span><\/p>\n

b<\/span>=<\/span>XX(F<\/span>,<\/span>b<\/span>,<\/span>c<\/span>,<\/span>d<\/span>,<\/span>a<\/span>,<\/span>inp[<\/span>3<\/span>]<\/span>,<\/span>S14<\/span>,<\/span>0xC1BDCEEEL<\/span>)<\/span>#4<\/span><\/p>\n

a<\/span>=<\/span>XX(F<\/span>,<\/span>a<\/span>,<\/span>b<\/span>,<\/span>c<\/span>,<\/span>d<\/span>,<\/span>inp[<\/span>4<\/span>]<\/span>,<\/span>S11<\/span>,<\/span>0xF57C0FAFL<\/span>)<\/span>#5<\/span><\/p>\n

d<\/span>=<\/span>XX(F<\/span>,<\/span>d<\/span>,<\/span>a<\/span>,<\/span>b<\/span>,<\/span>c<\/span>,<\/span>inp[<\/span>5<\/span>]<\/span>,<\/span>S12<\/span>,<\/span>0x4787C62AL<\/span>)<\/span>#6<\/span><\/p>\n

c<\/span>=<\/span>XX(F<\/span>,<\/span>c<\/span>,<\/span>d<\/span>,<\/span>a<\/span>,<\/span>b<\/span>,<\/span>inp[<\/span>6<\/span>]<\/span>,<\/span>S13<\/span>,<\/span>0xA8304613L<\/span>)<\/span>#7<\/span><\/p>\n

b<\/span>=<\/span>XX(F<\/span>,<\/span>b<\/span>,<\/span>c<\/span>,<\/span>d<\/span>,<\/span>a<\/span>,<\/span>inp[<\/span>7<\/span>]<\/span>,<\/span>S14<\/span>,<\/span>0xFD469501L<\/span>)<\/span>#8<\/span><\/p>\n

a<\/span>=<\/span>XX(F<\/span>,<\/span>a<\/span>,<\/span>b<\/span>,<\/span>c<\/span>,<\/span>d<\/span>,<\/span>inp[<\/span>8<\/span>]<\/span>,<\/span>S11<\/span>,<\/span>0x698098D8L<\/span>)<\/span>#9<\/span><\/p>\n

d<\/span>=<\/span>XX(F<\/span>,<\/span>d<\/span>,<\/span>a<\/span>,<\/span>b<\/span>,<\/span>c<\/span>,<\/span>inp[<\/span>9<\/span>]<\/span>,<\/span>S12<\/span>,<\/span>0x8B44F7AFL<\/span>)<\/span>#10<\/span><\/p>\n

c<\/span>=<\/span>XX(F<\/span>,<\/span>c<\/span>,<\/span>d<\/span>,<\/span>a<\/span>,<\/span>b<\/span>,<\/span>inp[<\/span>10<\/span>]<\/span>,<\/span>S13<\/span>,<\/span>0xFFFF5BB1L<\/span>)<\/span>#11<\/span><\/p>\n

b<\/span>=<\/span>XX(F<\/span>,<\/span>b<\/span>,<\/span>c<\/span>,<\/span>d<\/span>,<\/span>a<\/span>,<\/span>inp[<\/span>11<\/span>]<\/span>,<\/span>S14<\/span>,<\/span>0x895CD7BEL<\/span>)<\/span>#12<\/span><\/p>\n

a<\/span>=<\/span>XX(F<\/span>,<\/span>a<\/span>,<\/span>b<\/span>,<\/span>c<\/span>,<\/span>d<\/span>,<\/span>inp[<\/span>12<\/span>]<\/span>,<\/span>S11<\/span>,<\/span>0x6B901122L<\/span>)<\/span>#13<\/span><\/p>\n

d<\/span>=<\/span>XX(F<\/span>,<\/span>d<\/span>,<\/span>a<\/span>,<\/span>b<\/span>,<\/span>c<\/span>,<\/span>inp[<\/span>13<\/span>]<\/span>,<\/span>S12<\/span>,<\/span>0xFD987193L<\/span>)<\/span>#14<\/span><\/p>\n

c<\/span>=<\/span>XX(F<\/span>,<\/span>c<\/span>,<\/span>d<\/span>,<\/span>a<\/span>,<\/span>b<\/span>,<\/span>inp[<\/span>14<\/span>]<\/span>,<\/span>S13<\/span>,<\/span>0xA679438EL<\/span>)<\/span>#15<\/span><\/p>\n

b<\/span>=<\/span>XX(F<\/span>,<\/span>b<\/span>,<\/span>c<\/span>,<\/span>d<\/span>,<\/span>a<\/span>,<\/span>inp[<\/span>15<\/span>]<\/span>,<\/span>S14<\/span>,<\/span>0x49B40821L<\/span>)<\/span>#16<\/span><\/p>\n

#Round2.<\/span><\/p>\n

S21<\/span>,<\/span>S22<\/span>,<\/span>S23<\/span>,<\/span>S24<\/span>=<\/span>5<\/span>,<\/span>9<\/span>,<\/span>14<\/span>,<\/span>20<\/span><\/p>\n

a<\/span>=<\/span>XX(G<\/span>,<\/span>a<\/span>,<\/span>b<\/span>,<\/span>c<\/span>,<\/span>d<\/span>,<\/span>inp[<\/span>1<\/span>]<\/span>,<\/span>S21<\/span>,<\/span>0xF61E2562L<\/span>)<\/span>#17<\/span><\/p>\n

d<\/span>=<\/span>XX(G<\/span>,<\/span>d<\/span>,<\/span>a<\/span>,<\/span>b<\/span>,<\/span>c<\/span>,<\/span>inp[<\/span>6<\/span>]<\/span>,<\/span>S22<\/span>,<\/span>0xC040B340L<\/span>)<\/span>#18<\/span><\/p>\n

c<\/span>=<\/span>XX(G<\/span>,<\/span>c<\/span>,<\/span>d<\/span>,<\/span>a<\/span>,<\/span>b<\/span>,<\/span>inp[<\/span>11<\/span>]<\/span>,<\/span>S23<\/span>,<\/span>0x265E5A51L<\/span>)<\/span>#19<\/span><\/p>\n

b<\/span>=<\/span>XX(G<\/span>,<\/span>b<\/span>,<\/span>c<\/span>,<\/span>d<\/span>,<\/span>a<\/span>,<\/span>inp[<\/span>0<\/span>]<\/span>,<\/span>S24<\/span>,<\/span>0xE9B6C7AAL<\/span>)<\/span>#20<\/span><\/p>\n

a<\/span>=<\/span>XX(G<\/span>,<\/span>a<\/span>,<\/span>b<\/span>,<\/span>c<\/span>,<\/span>d<\/span>,<\/span>inp[<\/span>5<\/span>]<\/span>,<\/span>S21<\/span>,<\/span>0xD62F105DL<\/span>)<\/span>#21<\/span><\/p>\n

d<\/span>=<\/span>XX(G<\/span>,<\/span>d<\/span>,<\/span>a<\/span>,<\/span>b<\/span>,<\/span>c<\/span>,<\/span>inp[<\/span>10<\/span>]<\/span>,<\/span>S22<\/span>,<\/span>0x02441453L<\/span>)<\/span>#22<\/span><\/p>\n

c<\/span>=<\/span>XX(G<\/span>,<\/span>c<\/span>,<\/span>d<\/span>,<\/span>a<\/span>,<\/span>b<\/span>,<\/span>inp[<\/span>15<\/span>]<\/span>,<\/span>S23<\/span>,<\/span>0xD8A1E681L<\/span>)<\/span>#23<\/span><\/p>\n

b<\/span>=<\/span>XX(G<\/span>,<\/span>b<\/span>,<\/span>c<\/span>,<\/span>d<\/span>,<\/span>a<\/span>,<\/span>inp[<\/span>4<\/span>]<\/span>,<\/span>S24<\/span>,<\/span>0xE7D3FBC8L<\/span>)<\/span>#24<\/span><\/p>\n

a<\/span>=<\/span>XX(G<\/span>,<\/span>a<\/span>,<\/span>b<\/span>,<\/span>c<\/span>,<\/span>d<\/span>,<\/span>inp[<\/span>9<\/span>]<\/span>,<\/span>S21<\/span>,<\/span>0x21E1CDE6L<\/span>)<\/span>#25<\/span><\/p>\n

d<\/span>=<\/span>XX(G<\/span>,<\/span>d<\/span>,<\/span>a<\/span>,<\/span>b<\/span>,<\/span>c<\/span>,<\/span>inp[<\/span>14<\/span>]<\/span>,<\/span>S22<\/span>,<\/span>0xC33707D6L<\/span>)<\/span>#26<\/span><\/p>\n

c<\/span>=<\/span>XX(G<\/span>,<\/span>c<\/span>,<\/span>d<\/span>,<\/span>a<\/span>,<\/span>b<\/span>,<\/span>inp[<\/span>3<\/span>]<\/span>,<\/span>S23<\/span>,<\/span>0xF4D50D87L<\/span>)<\/span>#27<\/span><\/p>\n

b<\/span>=<\/span>XX(G<\/span>,<\/span>b<\/span>,<\/span>c<\/span>,<\/span>d<\/span>,<\/span>a<\/span>,<\/span>inp[<\/span>8<\/span>]<\/span>,<\/span>S24<\/span>,<\/span>0x455A14EDL<\/span>)<\/span>#28<\/span><\/p>\n

a<\/span>=<\/span>XX(G<\/span>,<\/span>a<\/span>,<\/span>b<\/span>,<\/span>c<\/span>,<\/span>d<\/span>,<\/span>inp[<\/span>13<\/span>]<\/span>,<\/span>S21<\/span>,<\/span>0xA9E3E905L<\/span>)<\/span>#29<\/span><\/p>\n

d<\/span>=<\/span>XX(G<\/span>,<\/span>d<\/span>,<\/span>a<\/span>,<\/span>b<\/span>,<\/span>c<\/span>,<\/span>inp[<\/span>2<\/span>]<\/span>,<\/span>S22<\/span>,<\/span>0xFCEFA3F8L<\/span>)<\/span>#30<\/span><\/p>\n

c<\/span>=<\/span>XX(G<\/span>,<\/span>c<\/span>,<\/span>d<\/span>,<\/span>a<\/span>,<\/span>b<\/span>,<\/span>inp[<\/span>7<\/span>]<\/span>,<\/span>S23<\/span>,<\/span>0x676F02D9L<\/span>)<\/span>#31<\/span><\/p>\n

b<\/span>=<\/span>XX(G<\/span>,<\/span>b<\/span>,<\/span>c<\/span>,<\/span>d<\/span>,<\/span>a<\/span>,<\/span>inp[<\/span>12<\/span>]<\/span>,<\/span>S24<\/span>,<\/span>0x8D2A4C8AL<\/span>)<\/span>#32<\/span><\/p>\n

#Round3.<\/span><\/p>\n

S31<\/span>,<\/span>S32<\/span>,<\/span>S33<\/span>,<\/span>S34<\/span>=<\/span>4<\/span>,<\/span>11<\/span>,<\/span>16<\/span>,<\/span>23<\/span><\/p>\n

a<\/span>=<\/span>XX(H<\/span>,<\/span>a<\/span>,<\/span>b<\/span>,<\/span>c<\/span>,<\/span>d<\/span>,<\/span>inp[<\/span>5<\/span>]<\/span>,<\/span>S31<\/span>,<\/span>0xFFFA3942L<\/span>)<\/span>#33<\/span><\/p>\n

d<\/span>=<\/span>XX(H<\/span>,<\/span>d<\/span>,<\/span>a<\/span>,<\/span>b<\/span>,<\/span>c<\/span>,<\/span>inp[<\/span>8<\/span>]<\/span>,<\/span>S32<\/span>,<\/span>0x8771F681L<\/span>)<\/span>#34<\/span><\/p>\n

c<\/span>=<\/span>XX(H<\/span>,<\/span>c<\/span>,<\/span>d<\/span>,<\/span>a<\/span>,<\/span>b<\/span>,<\/span>inp[<\/span>11<\/span>]<\/span>,<\/span>S33<\/span>,<\/span>0x6D9D6122L<\/span>)<\/span>#35<\/span><\/p>\n

b<\/span>=<\/span>XX(H<\/span>,<\/span>b<\/span>,<\/span>c<\/span>,<\/span>d<\/span>,<\/span>a<\/span>,<\/span>inp[<\/span>14<\/span>]<\/span>,<\/span>S34<\/span>,<\/span>0xFDE5380CL<\/span>)<\/span>#36<\/span><\/p>\n

a<\/span>=<\/span>XX(H<\/span>,<\/span>a<\/span>,<\/span>b<\/span>,<\/span>c<\/span>,<\/span>d<\/span>,<\/span>inp[<\/span>1<\/span>]<\/span>,<\/span>S31<\/span>,<\/span>0xA4BEEA44L<\/span>)<\/span>#37<\/span><\/p>\n

d<\/span>=<\/span>XX(H<\/span>,<\/span>d<\/span>,<\/span>a<\/span>,<\/span>b<\/span>,<\/span>c<\/span>,<\/span>inp[<\/span>4<\/span>]<\/span>,<\/span>S32<\/span>,<\/span>0x4BDECFA9L<\/span>)<\/span>#38<\/span><\/p>\n

c<\/span>=<\/span>XX(H<\/span>,<\/span>c<\/span>,<\/span>d<\/span>,<\/span>a<\/span>,<\/span>b<\/span>,<\/span>inp[<\/span>7<\/span>]<\/span>,<\/span>S33<\/span>,<\/span>0xF6BB4B60L<\/span>)<\/span>#39<\/span><\/p>\n

b<\/span>=<\/span>XX(H<\/span>,<\/span>b<\/span>,<\/span>c<\/span>,<\/span>d<\/span>,<\/span>a<\/span>,<\/span>inp[<\/span>10<\/span>]<\/span>,<\/span>S34<\/span>,<\/span>0xBEBFBC70L<\/span>)<\/span>#40<\/span><\/p>\n

a<\/span>=<\/span>XX(H<\/span>,<\/span>a<\/span>,<\/span>b<\/span>,<\/span>c<\/span>,<\/span>d<\/span>,<\/span>inp[<\/span>13<\/span>]<\/span>,<\/span>S31<\/span>,<\/span>0x289B7EC6L<\/span>)<\/span>#41<\/span><\/p>\n

d<\/span>=<\/span>XX(H<\/span>,<\/span>d<\/span>,<\/span>a<\/span>,<\/span>b<\/span>,<\/span>c<\/span>,<\/span>inp[<\/span>0<\/span>]<\/span>,<\/span>S32<\/span>,<\/span>0xEAA127FAL<\/span>)<\/span>#42<\/span><\/p>\n

c<\/span>=<\/span>XX(H<\/span>,<\/span>c<\/span>,<\/span>d<\/span>,<\/span>a<\/span>,<\/span>b<\/span>,<\/span>inp[<\/span>3<\/span>]<\/span>,<\/span>S33<\/span>,<\/span>0xD4EF3085L<\/span>)<\/span>#43<\/span><\/p>\n

b<\/span>=<\/span>XX(H<\/span>,<\/span>b<\/span>,<\/span>c<\/span>,<\/span>d<\/span>,<\/span>a<\/span>,<\/span>inp[<\/span>6<\/span>]<\/span>,<\/span>S34<\/span>,<\/span>0x04881D05L<\/span>)<\/span>#44<\/span><\/p>\n

a<\/span>=<\/span>XX(H<\/span>,<\/span>a<\/span>,<\/span>b<\/span>,<\/span>c<\/span>,<\/span>d<\/span>,<\/span>inp[<\/span>9<\/span>]<\/span>,<\/span>S31<\/span>,<\/span>0xD9D4D039L<\/span>)<\/span>#45<\/span><\/p>\n

d<\/span>=<\/span>XX(H<\/span>,<\/span>d<\/span>,<\/span>a<\/span>,<\/span>b<\/span>,<\/span>c<\/span>,<\/span>inp[<\/span>12<\/span>]<\/span>,<\/span>S32<\/span>,<\/span>0xE6DB99E5L<\/span>)<\/span>#46<\/span><\/p>\n

c<\/span>=<\/span>XX(H<\/span>,<\/span>c<\/span>,<\/span>d<\/span>,<\/span>a<\/span>,<\/span>b<\/span>,<\/span>inp[<\/span>15<\/span>]<\/span>,<\/span>S33<\/span>,<\/span>0x1FA27CF8L<\/span>)<\/span>#47<\/span><\/p>\n

b<\/span>=<\/span>XX(H<\/span>,<\/span>b<\/span>,<\/span>c<\/span>,<\/span>d<\/span>,<\/span>a<\/span>,<\/span>inp[<\/span>2<\/span>]<\/span>,<\/span>S34<\/span>,<\/span>0xC4AC5665L<\/span>)<\/span>#48<\/span><\/p>\n

#Round4.<\/span><\/p>\n

S41<\/span>,<\/span>S42<\/span>,<\/span>S43<\/span>,<\/span>S44<\/span>=<\/span>6<\/span>,<\/span>10<\/span>,<\/span>15<\/span>,<\/span>21<\/span><\/p>\n

a<\/span>=<\/span>XX(I<\/span>,<\/span>a<\/span>,<\/span>b<\/span>,<\/span>c<\/span>,<\/span>d<\/span>,<\/span>inp[<\/span>0<\/span>]<\/span>,<\/span>S41<\/span>,<\/span>0xF4292244L<\/span>)<\/span>#49<\/span><\/p>\n

d<\/span>=<\/span>XX(I<\/span>,<\/span>d<\/span>,<\/span>a<\/span>,<\/span>b<\/span>,<\/span>c<\/span>,<\/span>inp[<\/span>7<\/span>]<\/span>,<\/span>S42<\/span>,<\/span>0x432AFF97L<\/span>)<\/span>#50<\/span><\/p>\n

c<\/span>=<\/span>XX(I<\/span>,<\/span>c<\/span>,<\/span>d<\/span>,<\/span>a<\/span>,<\/span>b<\/span>,<\/span>inp[<\/span>14<\/span>]<\/span>,<\/span>S43<\/span>,<\/span>0xAB9423A7L<\/span>)<\/span>#51<\/span><\/p>\n

b<\/span>=<\/span>XX(I<\/span>,<\/span>b<\/span>,<\/span>c<\/span>,<\/span>d<\/span>,<\/span>a<\/span>,<\/span>inp[<\/span>5<\/span>]<\/span>,<\/span>S44<\/span>,<\/span>0xFC93A039L<\/span>)<\/span>#52<\/span><\/p>\n

a<\/span>=<\/span>XX(I<\/span>,<\/span>a<\/span>,<\/span>b<\/span>,<\/span>c<\/span>,<\/span>d<\/span>,<\/span>inp[<\/span>12<\/span>]<\/span>,<\/span>S41<\/span>,<\/span>0x655B59C3L<\/span>)<\/span>#53<\/span><\/p>\n

d<\/span>=<\/span>XX(I<\/span>,<\/span>d<\/span>,<\/span>a<\/span>,<\/span>b<\/span>,<\/span>c<\/span>,<\/span>inp[<\/span>3<\/span>]<\/span>,<\/span>S42<\/span>,<\/span>0x8F0CCC92L<\/span>)<\/span>#54<\/span><\/p>\n

c<\/span>=<\/span>XX(I<\/span>,<\/span>c<\/span>,<\/span>d<\/span>,<\/span>a<\/span>,<\/span>b<\/span>,<\/span>inp[<\/span>10<\/span>]<\/span>,<\/span>S43<\/span>,<\/span>0xFFEFF47DL<\/span>)<\/span>#55<\/span><\/p>\n

b<\/span>=<\/span>XX(I<\/span>,<\/span>b<\/span>,<\/span>c<\/span>,<\/span>d<\/span>,<\/span>a<\/span>,<\/span>inp[<\/span>1<\/span>]<\/span>,<\/span>S44<\/span>,<\/span>0x85845DD1L<\/span>)<\/span>#56<\/span><\/p>\n

a<\/span>=<\/span>XX(I<\/span>,<\/span>a<\/span>,<\/span>b<\/span>,<\/span>c<\/span>,<\/span>d<\/span>,<\/span>inp[<\/span>8<\/span>]<\/span>,<\/span>S41<\/span>,<\/span>0x6FA87E4FL<\/span>)<\/span>#57<\/span><\/p>\n

d<\/span>=<\/span>XX(I<\/span>,<\/span>d<\/span>,<\/span>a<\/span>,<\/span>b<\/span>,<\/span>c<\/span>,<\/span>inp[<\/span>15<\/span>]<\/span>,<\/span>S42<\/span>,<\/span>0xFE2CE6E0L<\/span>)<\/span>#58<\/span><\/p>\n

c<\/span>=<\/span>XX(I<\/span>,<\/span>c<\/span>,<\/span>d<\/span>,<\/span>a<\/span>,<\/span>b<\/span>,<\/span>inp[<\/span>6<\/span>]<\/span>,<\/span>S43<\/span>,<\/span>0xA3014314L<\/span>)<\/span>#59<\/span><\/p>\n

b<\/span>=<\/span>XX(I<\/span>,<\/span>b<\/span>,<\/span>c<\/span>,<\/span>d<\/span>,<\/span>a<\/span>,<\/span>inp[<\/span>13<\/span>]<\/span>,<\/span>S44<\/span>,<\/span>0x4E0811A1L<\/span>)<\/span>#60<\/span><\/p>\n

a<\/span>=<\/span>XX(I<\/span>,<\/span>a<\/span>,<\/span>b<\/span>,<\/span>c<\/span>,<\/span>d<\/span>,<\/span>inp[<\/span>4<\/span>]<\/span>,<\/span>S41<\/span>,<\/span>0xF7537E82L<\/span>)<\/span>#61<\/span><\/p>\n

d<\/span>=<\/span>XX(I<\/span>,<\/span>d<\/span>,<\/span>a<\/span>,<\/span>b<\/span>,<\/span>c<\/span>,<\/span>inp[<\/span>11<\/span>]<\/span>,<\/span>S42<\/span>,<\/span>0xBD3AF235L<\/span>)<\/span>#62<\/span><\/p>\n

c<\/span>=<\/span>XX(I<\/span>,<\/span>c<\/span>,<\/span>d<\/span>,<\/span>a<\/span>,<\/span>b<\/span>,<\/span>inp[<\/span>2<\/span>]<\/span>,<\/span>S43<\/span>,<\/span>0x2AD7D2BBL<\/span>)<\/span>#63<\/span><\/p>\n

b<\/span>=<\/span>XX(I<\/span>,<\/span>b<\/span>,<\/span>c<\/span>,<\/span>d<\/span>,<\/span>a<\/span>,<\/span>inp[<\/span>9<\/span>]<\/span>,<\/span>S44<\/span>,<\/span>0xEB86D391L<\/span>)<\/span>#64<\/span><\/p>\n

self<\/span>.A<\/span>=<\/span>(<\/span>self<\/span>.A<\/span>+<\/span>a)<\/span>&<\/span>0xffffffffL<\/span><\/p>\n

self<\/span>.B<\/span>=<\/span>(<\/span>self<\/span>.B<\/span>+<\/span>b)<\/span>&<\/span>0xffffffffL<\/span><\/p>\n

self<\/span>.C<\/span>=<\/span>(<\/span>self<\/span>.C<\/span>+<\/span>c)<\/span>&<\/span>0xffffffffL<\/span><\/p>\n

self<\/span>.D<\/span>=<\/span>(<\/span>self<\/span>.D<\/span>+<\/span>d)<\/span>&<\/span>0xffffffffL<\/span><\/p>\n

\n<\/div>\n<\/div>\n<\/div>\n

\u00a0<\/u><\/p>\n

0x02\u56de\u5230\u9898\u76ee<\/strong><\/h1>\n

\u8fd9\u4e2a\u65f6\u5019\u6211\u4eec\u901a\u8fc7\u811a\u672c\u6784\u9020payload\uff0cpadding\u7684\u503c\u5f97\u662f64\u4f4d<\/p>\n

\u811a\u672c\u5982\u4e0b<\/p>\n

# coding:utf-8\n#\u8fd9\u662f\u4e2a\u54c8\u5e0c\u6269\u5c55\u653b\u51fb\u7684payload\u751f\u6210\u811a\u672c\n#python \u672c\u6587\u4ef6\u540d\u5b57.py salt\u7684md5 \u9644\u52a0\u7684\u503c salt\u7684\u957f\u5ea6\n\nimport sys\nimport struct\nimport hashlib\nimport binascii\n\n#\u6bcf\u8f6e\u4e2d\u7528\u5230\u7684\u6570\u5b66\u53d8\u6362\u51fd\u6570\u3002L\u4e3a\u5faa\u73af\u5de6\u79fb\uff0c\ndef F(x, y, z):\n    return (x & y) | ((~x) & z)\ndef G(x, y, z):\n    return (x & z) | (y & (~z))\ndef H(x, y, z):\n    return x ^ y ^ z\ndef I(x, y, z):\n    return y ^ (x | (~z))\n\n#\u6ce8\u610f\u5de6\u79fb\u4e4b\u540e\u53ef\u80fd\u4f1a\u8d85\u8fc732\u4f4d\uff0c\u6240\u4ee5\u8981\u548c0xffffffff\u505a\u4e0e\u8fd0\u7b97\uff0c\u786e\u4fdd\u7ed3\u679c\u4e3a32\u4f4d\u3002\ndef _rotateLeft(x, n):\n    return (x << n) | (x >> (32 - n))\n#\u53d8\u6362\u51fd\u6570\ndef XX(func, a, b, c, d, x, s, ac):\n    res = 0L\n    res = res + a + func(b, c, d)\n    res = res + x\n    res = res + ac\n    res = res & 0xffffffffL\n    res = _rotateLeft(res, s)\n    res = res & 0xffffffffL\n    res = res + b\n\n    return res & 0xffffffffL\n\n# \u4e3b\u7c7b\nclass md5():\n    #\u521d\u59cb\u5316\u5411\u91cf\uff0c\u8fd9\u662f\u6807\u51c6\u91cc\u5b9a\u6b7b\u7684\n    def __init__(self):\n        self.A, self.B, self.C, self.D = (0x67452301L, 0xefcdab89L, 0x98badcfeL, 0x10325476L)\n\n    def md5_compress(self, buf):\n        if len(buf) != 64:\n            raise ValueError, \"Invalid buffer of length %d: %s\" % (len(buf), repr(buf))\n        inp = struct.unpack(\"I\" * 16, buf)\n        a, b, c, d = self.A, self.B, self.C, self.D\n\n        #\u5f00\u59cb\u8fdb\u884c64\u8f6e\u6570\u5b66\u53d8\u6362,\u56db\u5927\u8f6e\uff0c\u6bcf\u8f6e16\u6b21\n        # Round 1.\n        S11, S12, S13, S14 = 7, 12, 17, 22\n\n        a = XX(F, a, b, c, d, inp[0], S11, 0xD76AA478L)  # 1\n        d = XX(F, d, a, b, c, inp[1], S12, 0xE8C7B756L)  # 2\n        c = XX(F, c, d, a, b, inp[2], S13, 0x242070DBL)  # 3\n        b = XX(F, b, c, d, a, inp[3], S14, 0xC1BDCEEEL)  # 4\n        a = XX(F, a, b, c, d, inp[4], S11, 0xF57C0FAFL)  # 5\n        d = XX(F, d, a, b, c, inp[5], S12, 0x4787C62AL)  # 6\n        c = XX(F, c, d, a, b, inp[6], S13, 0xA8304613L)  # 7\n        b = XX(F, b, c, d, a, inp[7], S14, 0xFD469501L)  # 8\n        a = XX(F, a, b, c, d, inp[8], S11, 0x698098D8L)  # 9\n        d = XX(F, d, a, b, c, inp[9], S12, 0x8B44F7AFL)  # 10\n        c = XX(F, c, d, a, b, inp[10], S13, 0xFFFF5BB1L)  # 11\n        b = XX(F, b, c, d, a, inp[11], S14, 0x895CD7BEL)  # 12\n        a = XX(F, a, b, c, d, inp[12], S11, 0x6B901122L)  # 13\n        d = XX(F, d, a, b, c, inp[13], S12, 0xFD987193L)  # 14\n        c = XX(F, c, d, a, b, inp[14], S13, 0xA679438EL)  # 15\n        b = XX(F, b, c, d, a, inp[15], S14, 0x49B40821L)  # 16\n\n        # Round 2.\n        S21, S22, S23, S24 = 5, 9, 14, 20\n\n        a = XX(G, a, b, c, d, inp[1], S21, 0xF61E2562L)  # 17\n        d = XX(G, d, a, b, c, inp[6], S22, 0xC040B340L)  # 18\n        c = XX(G, c, d, a, b, inp[11], S23, 0x265E5A51L)  # 19\n        b = XX(G, b, c, d, a, inp[0], S24, 0xE9B6C7AAL)  # 20\n        a = XX(G, a, b, c, d, inp[5], S21, 0xD62F105DL)  # 21\n        d = XX(G, d, a, b, c, inp[10], S22, 0x02441453L)  # 22\n        c = XX(G, c, d, a, b, inp[15], S23, 0xD8A1E681L)  # 23\n        b = XX(G, b, c, d, a, inp[4], S24, 0xE7D3FBC8L)  # 24\n        a = XX(G, a, b, c, d, inp[9], S21, 0x21E1CDE6L)  # 25\n        d = XX(G, d, a, b, c, inp[14], S22, 0xC33707D6L)  # 26\n        c = XX(G, c, d, a, b, inp[3], S23, 0xF4D50D87L)  # 27\n        b = XX(G, b, c, d, a, inp[8], S24, 0x455A14EDL)  # 28\n        a = XX(G, a, b, c, d, inp[13], S21, 0xA9E3E905L)  # 29\n        d = XX(G, d, a, b, c, inp[2], S22, 0xFCEFA3F8L)  # 30\n        c = XX(G, c, d, a, b, inp[7], S23, 0x676F02D9L)  # 31\n        b = XX(G, b, c, d, a, inp[12], S24, 0x8D2A4C8AL)  # 32\n\n        # Round 3.\n        S31, S32, S33, S34 = 4, 11, 16, 23\n\n        a = XX(H, a, b, c, d, inp[5], S31, 0xFFFA3942L)  # 33\n        d = XX(H, d, a, b, c, inp[8], S32, 0x8771F681L)  # 34\n        c = XX(H, c, d, a, b, inp[11], S33, 0x6D9D6122L)  # 35\n        b = XX(H, b, c, d, a, inp[14], S34, 0xFDE5380CL)  # 36\n        a = XX(H, a, b, c, d, inp[1], S31, 0xA4BEEA44L)  # 37\n        d = XX(H, d, a, b, c, inp[4], S32, 0x4BDECFA9L)  # 38\n        c = XX(H, c, d, a, b, inp[7], S33, 0xF6BB4B60L)  # 39\n        b = XX(H, b, c, d, a, inp[10], S34, 0xBEBFBC70L)  # 40\n        a = XX(H, a, b, c, d, inp[13], S31, 0x289B7EC6L)  # 41\n        d = XX(H, d, a, b, c, inp[0], S32, 0xEAA127FAL)  # 42\n        c = XX(H, c, d, a, b, inp[3], S33, 0xD4EF3085L)  # 43\n        b = XX(H, b, c, d, a, inp[6], S34, 0x04881D05L)  # 44\n        a = XX(H, a, b, c, d, inp[9], S31, 0xD9D4D039L)  # 45\n        d = XX(H, d, a, b, c, inp[12], S32, 0xE6DB99E5L)  # 46\n        c = XX(H, c, d, a, b, inp[15], S33, 0x1FA27CF8L)  # 47\n        b = XX(H, b, c, d, a, inp[2], S34, 0xC4AC5665L)  # 48\n\n        # Round 4.\n        S41, S42, S43, S44 = 6, 10, 15, 21\n\n        a = XX(I, a, b, c, d, inp[0], S41, 0xF4292244L)  # 49\n        d = XX(I, d, a, b, c, inp[7], S42, 0x432AFF97L)  # 50\n        c = XX(I, c, d, a, b, inp[14], S43, 0xAB9423A7L)  # 51\n        b = XX(I, b, c, d, a, inp[5], S44, 0xFC93A039L)  # 52\n        a = XX(I, a, b, c, d, inp[12], S41, 0x655B59C3L)  # 53\n        d = XX(I, d, a, b, c, inp[3], S42, 0x8F0CCC92L)  # 54\n        c = XX(I, c, d, a, b, inp[10], S43, 0xFFEFF47DL)  # 55\n        b = XX(I, b, c, d, a, inp[1], S44, 0x85845DD1L)  # 56\n        a = XX(I, a, b, c, d, inp[8], S41, 0x6FA87E4FL)  # 57\n        d = XX(I, d, a, b, c, inp[15], S42, 0xFE2CE6E0L)  # 58\n        c = XX(I, c, d, a, b, inp[6], S43, 0xA3014314L)  # 59\n        b = XX(I, b, c, d, a, inp[13], S44, 0x4E0811A1L)  # 60\n        a = XX(I, a, b, c, d, inp[4], S41, 0xF7537E82L)  # 61\n        d = XX(I, d, a, b, c, inp[11], S42, 0xBD3AF235L)  # 62\n        c = XX(I, c, d, a, b, inp[2], S43, 0x2AD7D2BBL)  # 63\n        b = XX(I, b, c, d, a, inp[9], S44, 0xEB86D391L)  # 64\n\n        self.A = (self.A + a) & 0xffffffffL\n        self.B = (self.B + b) & 0xffffffffL\n        self.C = (self.C + c) & 0xffffffffL\n        self.D = (self.D + d) & 0xffffffffL\n        # print 'A=%s\\nB=%s\\nC=%s\\nD=%s\\n' % (hex(self.A), hex(self.B), hex(self.C), hex(self.D))\n\n    #padding\uff0c\u5373\u8865\u4f4d:\u9996\u5b57\u8282\u4e3a\\x80\n    def padding(self, n, sz = None):\n        if sz is None:\n            sz = n\n        pre = 64 - 8\n        sz = struct.pack(\"Q\", sz * 8)\n        pad = '\\x80'\n        n += 1\n        if n % 64 <= pre:\n            pad += '\\x00' * (pre - n % 64)\n            pad += sz\n        else:\n            pad += '\\x00' * (pre + 64 - n % 64)\n            pad += sz\n        return pad\n    #\u6700\u540e\u516b\u4e2a\u5b57\u8282\u4e3a\u6570\u636e\u957f\u5ea6\n    def pad(self, msg):\n        return msg + self.padding(len(msg))\n\n    def md5_iter(self, padding_msg):\n        assert len(padding_msg) % 64 == 0\n        for i in range(0, len(padding_msg), 64):\n            block = padding_msg[i:i + 64]\n            self.md5_compress(padding_msg[i:i + 64])\n\n    def digest(self):\n        return struct.pack('<IIII', self.A, self.B, self.C, self.D)\n\n    def hexdigest(self):\n        return binascii.hexlify(self.digest()).decode()\n\n    def my_md5(self, msg):\n        padding_msg = self.pad(msg)\n        self.md5_iter(padding_msg)\n        return self.hexdigest()  # \u901a\u8fc7md5\u503c\uff0c\u9006\u5411\u7b97\u51fa\u6700\u540e\u4e00\u8f6e\u7684magic number\n\n    def compute_magic_number(self, md5str):\n        self.A = struct.unpack(\"I\", md5str[0:8].decode('hex'))[0]\n        self.B = struct.unpack(\"I\", md5str[8:16].decode('hex'))[0]\n        self.C = struct.unpack(\"I\", md5str[16:24].decode('hex'))[0]\n        self.D = struct.unpack(\"I\", md5str[24:32].decode('hex'))[0]\n        # print '\\nA=%s\\nB=%s\\nC=%s\\nD=%s\\n' % (hex(self.A), hex(self.B), hex(self.C), hex(self.D))\n\n    def extension_attack(self, md5str, str_append, lenth):\n        self.compute_magic_number(md5str)\n        p = self.padding(lenth)\n        padding_msg = self.padding( len(str_append), lenth + len(p) + len(str_append) )\n        # url = repr(padding_msg.replace(' ', ''))\n        # print 'padding:%r' % (padding_msg)\n        self.md5_iter(str_append + padding_msg)\n        return self.hexdigest()\n\nif __name__ == \"__main__\":\n    m = md5()\n    if 1:\n        lenth = int(raw_input(u'salt\u7684hash\u957f\u5ea6\uff1a'))\n        md5 = raw_input(u'salt\u7684hash\u503c\uff1a')\n        value = raw_input(u'\u9644\u52a0\u503c\uff1a')\n        print u'md5(salt + padding + \u9644\u52a0\u503c):' + m.extension_attack(md5, value, lenth)\n        #\u8fd9\u4e2a\u662fpadding\u7684\u503c\uff0c\u5f97\u770b\u60c5\u51b5\uff0c\u5b9e\u5728\u4e0d\u884c\u5c31\u624b\u52a8\u7b97\u3002salt\u957f\u5ea6 + padding = 64\n        print ur'padding+\u9644\u52a0\u503c:' + r'%08' + r'%00' * (64 - 1 - lenth - 8) + r'%' + str(hex(lenth * 8)).replace(r'0x','') + r'%00' * 7 + value\n\n    else:\n        print m.my_md5(\"123456\")\n        src = m.pad(sys.argv[1]) + sys.argv[2]\n        print 'md5 padding ->', m.my_md5(src)\n\u8fd8\u6709\u4e00\u4e2apython\u6269\u5c55hashpumpy\uff0c\u4f46\u662f\u6211\u6298\u817e\u597d\u4e00\u9635\u90fd\u5b89\u88c5\u4e0d\u4e0a\uff0c\u90a3\u4e2a\u66f4\u597d\u7528\uff0c\u81ea\u5df1\u5199\u4e5f\u662f\u65e0\u5948\u4e4b\u4e3e<\/pre>\n
\u6839\u636e\u6e90\u4ee3\u7801\uff0cusername\u5fc5\u987b\u662fadmin\uff0c\u8fd9\u6837\u7684\u8bddpassword\u5fc5\u987b\u662fadmin+padding+\u9644\u52a0\u503c<\/p>\n
\u8fd9\u6837\u7684\u8bddpost\u4e0a\u53bb\u7684\u5c31\u662f<\/p>\n
username=admin&password=admin%80%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%c8%00%00%00%00%00%00%00asd<\/p>\n
\u5728\u6570\u636e\u5305\u91cc\u8bbe\u7f6ecookies:getmein=bf3b234ff0410ee4ec09b470e314d8c9<\/p>\n
\u5c31\u6210\u529f\u7ed5\u8fc7\u9a8c\u8bc1\u4e86<\/p>\n
\u8fd9\u91cc\u9762\u76f4\u63a5\u7ed9\u51fa\u7684salt\u7684MD5\u503c\u5176\u5b9e\u662fsecret+adminadmin\u7684MD5\uff0c\u6240\u4ee5salt\u7684\u957f\u5ea6\u5f97\u662f25\uff0c\u6700\u540e\u8865\u4f4d\u7684\u65f6\u5019\u8981\u6ce8\u610f\uff0c\u5b9e\u5728\u4e0d\u884c\u81ea\u5df1\u624b\u52a8\u6784\u9020padding\u3002\u4f46\u662fsalt+padding+\u9644\u52a0\u503c\u7684MD5\u6ca1\u95ee\u9898<\/p>\n
0x03\u540e\u8bb0<\/strong><\/h1>\n
\u4e2d\u9014\u4e5f\u662f\u8e29\u4e86\u597d\u591a\u5751<\/p>\n
\u9996\u5148\u662fMD5\u7684\u5b9e\u73b0\u8fc7\u7a0b\u548c\u6f0f\u6d1e\u539f\u7406\uff0c\u770b\u4e86\u597d\u4e00\u9635\u624d\u660e\u767d\uff0c\u8fd8\u597d<\/p>\n
\u4e4b\u540e\u5c31\u662f\u811a\u672c\u7684\u5b9e\u73b0\uff0chashpumpy\u5230\u6700\u540e\u90fd\u6ca1\u88c5\u4e0a\uff0c\u53ea\u80fd\u81ea\u5df1\u5199\u3002MD5\u7684python\u5b9e\u73b0\u662f\u4ece\u7f51\u4e0a\u627e\u7684\uff0c\u4e5f\u82b1\u4e86\u4e0d\u5c11\u65f6\u95f4\u6539\u3002<\/p>\n
\u6700\u540e\u662fpayload\u7684\u95ee\u9898\uff0c\u5fd8\u4e86\u9898\u76ee\u7ed9\u7684MD5\u662fsecret+adminadmin\u7684md5\uff0c\u7ed3\u679c\u811a\u672c\u8dd1\u7684\u662fsecret\u672c\u8eab\uff0c\u548c\u5b83\u7684\u4e0d\u4e00\u81f4\uff0c\u6709\u6b67\u4e49\u3002\u5f53\u65f6\u592a\u665a\u4e86\u795e\u5fd7\u4e0d\u592a\u6e05\u9192\u8fd8\u4ee5\u4e3a\u662f\u811a\u672c\u5199\u9519\u4e86\uff0c\u5361\u4e86\u597d\u957f\u65f6\u95f4\uff0c\u6700\u540e\u624b\u52a8padding\u624d\u77e5\u9053\u4e0d\u662f\u81ea\u5df1\u7684\u95ee\u9898<\/p>\n
 <\/p>\n","protected":false},"excerpt":{"rendered":"
\u5f04\u4e862\u5929\u624d\u5f04\u51fa\u6765 0x00 \u8d77\u4e8e\u4e00\u9053CTF \u8fd9\u662f\u4e00\u9053\u597d\u9898\uff01\u5b66\u4e86\u4e00\u79cd…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-354","post","type-post","status-publish","format-standard","hentry","category-3"],"_links":{"self":[{"href":"http:\/\/ssynas.top\/index.php?rest_route=\/wp\/v2\/posts\/354","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/ssynas.top\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/ssynas.top\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/ssynas.top\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/ssynas.top\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=354"}],"version-history":[{"count":0,"href":"http:\/\/ssynas.top\/index.php?rest_route=\/wp\/v2\/posts\/354\/revisions"}],"wp:attachment":[{"href":"http:\/\/ssynas.top\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=354"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/ssynas.top\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=354"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/ssynas.top\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=354"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}