[Yoire] [base64] transform/4_chall_hard.php

내용을 번역하면, "Turn this base64 into something useful if you want to solve this challenge."이 된다.

Base64 문제이므로, 일단 변환해보자.

ELF로 시작하는 것을 보니, Linux ELF 실행 파일이다.

복사하고 붙여넣으면 깨질 것이기 때문에, 아래처럼 간단하게 코딩하여 파일을 생성했다.

#-*- coding: utf-8 -*-
import os
import base64
 
encoded = "f0VMRgIBAQAAAAAAAAAAAAIAPgABAAAAAARAAAAAAABAAAAAAAAAACAKAAAAAAAAAAAAAEAAOAAIAEAAHQAcAAYAAAAFAAAAQAAAAAAAAABAAEAAAAAAAEAAQAAAAAAAwAEAAAAAAADAAQAAAAAAAAgAAAAAAAAAAwAAAAQAAAAAAgAAAAAAAAACQAAAAAAAAAJAAAAAAAAcAAAAAAAAABwAAAAAAAAAAQAAAAAAAAABAAAABQAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAALQGAAAAAAAAtAYAAAAAAAAAACAAAAAAAAEAAAAGAAAAuAYAAAAAAAC4BmAAAAAAALgGYAAAAAAAOAIAAAAAAABAAgAAAAAAAAAAIAAAAAAAAgAAAAYAAADQBgAAAAAAANAGYAAAAAAA0AZgAAAAAADgAQAAAAAAAOABAAAAAAAACAAAAAAAAAAEAAAABAAAABwCAAAAAAAAHAJAAAAAAAAcAkAAAAAAAEQAAAAAAAAARAAAAAAAAAAEAAAAAAAAAFDldGQEAAAA5AUAAAAAAADkBUAAAAAAAOQFQAAAAAAALAAAAAAAAAAsAAAAAAAAAAQAAAAAAAAAUeV0ZAYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAvbGliNjQvbGQtbGludXgteDg2LTY0LnNvLjIABAAAABAAAAABAAAAR05VAAAAAAACAAAABgAAABoAAAAEAAAAFAAAAAMAAABHTlUAWKPFrB99ZGZoq3BIMMBOQQrGkUsDAAAABAAAAAMAAAACAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAEAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAaAAAAEgAAAAAAAAAAAAAAAAAAAAAAAAAhAAAAEgAAAAAAAAAAAAAAAAAAAAAAAAABAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAAX19nbW9uX3N0YXJ0X18AbGliYy5zby42AHByaW50ZgBfX2xpYmNfc3RhcnRfbWFpbgBHTElCQ18yLjIuNQAAAAACAAIAAAABAAEAEAAAABAAAAAAAAAAdRppCQAAAgAzAAAAAAAAALAIYAAAAAAABgAAAAMAAAAAAAAAAAAAANAIYAAAAAAABwAAAAEAAAAAAAAAAAAAANgIYAAAAAAABwAAAAIAAAAAAAAAAAAAAEiD7AjoawAAAEiDxAjDAAAAAAAAAAAAAP816gQgAP8l7AQgAA8fQAD/JeoEIABoAAAAAOng/////yXiBCAAaAEAAADp0P///zHtSYnRXkiJ4kiD5PBQVEnHwDAFQABIx8FABUAASMfHDAVAAOjH////9JCQSIPsCEiLBXkEIABIhcB0Av/QSIPECMOQkJCQkJCQkJCQkJCQuPcIYABVSC3wCGAASIP4DkiJ5XcCXcO4AAAAAEiFwHT0Xb/wCGAA/+APH4AAAAAAuPAIYABVSC3wCGAASMH4A0iJ5UiJwkjB6j9IAdBIicZI0f51Al3DugAAAABIhdJ09F2/8AhgAP/iDx+AAAAAAIA9KQQgAAB1EVVIieXofv///13GBRYEIAAB88MPH0AASIM94AEgAAB0G7gAAAAASIXAdBFVv8gGYABIieX/0F3pe////+l2////kJBVSInlv9wFQAC4AAAAAOjB/v//XcOQkJCQkJCQkJCQkJCQkJDzw2ZmZmZmLg8fhAAAAAAASIlsJNhMiWQk4EiNLW8BIABMjSVgASAATIlsJOhMiXQk8EyJfCT4SIlcJNBIg+w4TCnlQYn9SYn2SMH9A0mJ1+gz/v//SIXtdBwx2w8fQABMifpMifZEie9B/xTcSIPDAUg563LqSItcJAhIi2wkEEyLZCQYTItsJCBMi3QkKEyLfCQwSIPEOMOQkJBIg+wISIPECMMAAAABAAIAZXhpdAAAAAABGwM7KAAAAAQAAADs/f//RAAAACj///9sAAAATP///4wAAABc////pAAAABQAAAAAAAAAAXpSAAF4EAEbDAcIkAEAACQAAAAcAAAAoP3//zAAAAAADhBGDhhKDwt3CIAAPxo7KjMkIgAAAAAcAAAARAAAALT+//8VAAAAAEEOEIYCQw0GUAwHCAAAABQAAABkAAAAuP7//wIAAAAAAAAAAAAAACQAAAB8AAAAsP7//4kAAAAAUYwFhgZfDkBGgwePAo4DjQQAAAAAAAAAAAAAAAAAAOAEQAAAAAAAwARAAAAAAAAAAAAAAAAAAAEAAAAAAAAAEAAAAAAAAAAMAAAAAAAAALgDQAAAAAAADQAAAAAAAADMBUAAAAAAABkAAAAAAAAAuAZgAAAAAAAbAAAAAAAAAAgAAAAAAAAAGgAAAAAAAADABmAAAAAAABwAAAAAAAAACAAAAAAAAAAEAAAAAAAAAGACQAAAAAAA9f7/bwAAAACIAkAAAAAAAAUAAAAAAAAACANAAAAAAAAGAAAAAAAAAKgCQAAAAAAACgAAAAAAAAA/AAAAAAAAAAsAAAAAAAAAGAAAAAAAAAAVAAAAAAAAAAAAAAAAAAAAAwAAAAAAAAC4CGAAAAAAAAIAAAAAAAAAMAAAAAAAAAAUAAAAAAAAAAcAAAAAAAAAFwAAAAAAAACIA0AAAAAAAAcAAAAAAAAAcANAAAAAAAAIAAAAAAAAABgAAAAAAAAACQAAAAAAAAAYAAAAAAAAAP7//28AAAAAUANAAAAAAAD///9vAAAAAAEAAAAAAAAA8P//bwAAAABIA0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0AZgAAAAAAAAAAAAAAAAAAAAAAAAAAAA5gNAAAAAAAD2A0AAAAAAAAAAAAAAAAAAAAAAAAAAAABHQ0M6IChEZWJpYW4gNC43LjItNSkgNC43LjIAR0NDOiAoRGViaWFuIDQuNC43LTIpIDQuNC43AAAuc2hzdHJ0YWIALmludGVycAAubm90ZS5BQkktdGFnAC5ub3RlLmdudS5idWlsZC1pZAAuZ251Lmhhc2gALmR5bnN5bQAuZHluc3RyAC5nbnUudmVyc2lvbgAuZ251LnZlcnNpb25fcgAucmVsYS5keW4ALnJlbGEucGx0AC5pbml0AC50ZXh0AC5maW5pAC5yb2RhdGEALmVoX2ZyYW1lX2hkcgAuZWhfZnJhbWUALmluaXRfYXJyYXkALmZpbmlfYXJyYXkALmpjcgAuZHluYW1pYwAuZ290AC5nb3QucGx0AC5kYXRhAC5ic3MALmNvbW1lbnQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsAAAABAAAAAgAAAAAAAAAAAkAAAAAAAAACAAAAAAAAHAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAATAAAABwAAAAIAAAAAAAAAHAJAAAAAAAAcAgAAAAAAACAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAIQAAAAcAAAACAAAAAAAAADwCQAAAAAAAPAIAAAAAAAAkAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAADgAAAAFAAAAAgAAAAAAAABgAkAAAAAAAGACAAAAAAAAJAAAAAAAAAAGAAAAAAAAAAgAAAAAAAAABAAAAAAAAAA0AAAA9v//bwIAAAAAAAAAiAJAAAAAAACIAgAAAAAAABwAAAAAAAAABgAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAPgAAAAsAAAACAAAAAAAAAKgCQAAAAAAAqAIAAAAAAABgAAAAAAAAAAcAAAABAAAACAAAAAAAAAAYAAAAAAAAAEYAAAADAAAAAgAAAAAAAAAIA0AAAAAAAAgDAAAAAAAAPwAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAABOAAAA////bwIAAAAAAAAASANAAAAAAABIAwAAAAAAAAgAAAAAAAAABgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAWwAAAP7//28CAAAAAAAAAFADQAAAAAAAUAMAAAAAAAAgAAAAAAAAAAcAAAABAAAACAAAAAAAAAAAAAAAAAAAAGoAAAAEAAAAAgAAAAAAAABwA0AAAAAAAHADAAAAAAAAGAAAAAAAAAAGAAAAAAAAAAgAAAAAAAAAGAAAAAAAAAB0AAAABAAAAAIAAAAAAAAAiANAAAAAAACIAwAAAAAAADAAAAAAAAAABgAAAA0AAAAIAAAAAAAAABgAAAAAAAAAfgAAAAEAAAAGAAAAAAAAALgDQAAAAAAAuAMAAAAAAAAOAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAHkAAAABAAAABgAAAAAAAADQA0AAAAAAANADAAAAAAAAMAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAACEAAAAAQAAAAYAAAAAAAAAAARAAAAAAAAABAAAAAAAAMwBAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAigAAAAEAAAAGAAAAAAAAAMwFQAAAAAAAzAUAAAAAAAAJAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAJAAAAABAAAAAgAAAAAAAADYBUAAAAAAANgFAAAAAAAACQAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAACYAAAAAQAAAAIAAAAAAAAA5AVAAAAAAADkBQAAAAAAACwAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAApgAAAAEAAAACAAAAAAAAABAGQAAAAAAAEAYAAAAAAACkAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAALAAAAAOAAAAAwAAAAAAAAC4BmAAAAAAALgGAAAAAAAACAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAAC8AAAADwAAAAMAAAAAAAAAwAZgAAAAAADABgAAAAAAAAgAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAyAAAAAEAAAADAAAAAAAAAMgGYAAAAAAAyAYAAAAAAAAIAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAM0AAAAGAAAAAwAAAAAAAADQBmAAAAAAANAGAAAAAAAA4AEAAAAAAAAHAAAAAAAAAAgAAAAAAAAAEAAAAAAAAADWAAAAAQAAAAMAAAAAAAAAsAhgAAAAAACwCAAAAAAAAAgAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA2wAAAAEAAAADAAAAAAAAALgIYAAAAAAAuAgAAAAAAAAoAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAOQAAAABAAAAAwAAAAAAAADgCGAAAAAAAOAIAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAADqAAAACAAAAAMAAAAAAAAA8AhgAAAAAADwCAAAAAAAAAgAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAA7wAAAAEAAAAwAAAAAAAAAAAAAAAAAAAA8AgAAAAAAAA4AAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAEAAAADAAAAAAAAAAAAAAAAAAAAAAAAACgJAAAAAAAA+AAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAA="
 
print(len(base64.b64decode(encoded)))
 
with open("D:" + os.sep + "aaaa", 'wb') as file:
    file.write(base64.b64decode(encoded))
 

Linux를 켜기 귀찮으므로, IDA를 이용해 분석했다.

main 함수를 찾아보자.

함수 중 main이 보인다!

어떠한 문자열을 출력하는 것을 볼 수 있다.

그 문자열을 입력하면,

Clear~