Buuctf helloword 1

GzrAn_

已于 2025-04-15 15:22:16 修改

阅读量224

点赞数 3

CC 4.0 BY-SA版权

文章标签：网络安全 python c++

于 2025-04-15 15:21:29 首次发布

本文链接：https://blog.csdn.net/A3138246926/article/details/147250992

1 解包.apk文件

.\apktool.bat d .\6176cfc5-d473-4453-a000-29e480ace634.apk -o output_directory

PS E:\迅雷下载\ctf-zip\apktool> .\apktool.bat d .\6176cfc5-d473-4453-a000-29e480ace634.apk -o output_directory
I: Using Apktool 2.11.0 on 6176cfc5-d473-4453-a000-29e480ace634.apk with 8 threads
I: Baksmaling classes.dex...
I: Loading resource table...
I: Decoding file-resources...
I: Loading resource table from file: C:\Users\A3138\AppData\Local\apktool\framework\1.apk
I: Decoding values */* XMLs...
I: Decoding AndroidManifest.xml with resources...
I: Regular manifest package...
I: Copying original files...
I: Copying unknown files...
Press any key to continue . . .
PS E:\迅雷下载\ctf-zip\apktool> dir


    目录: E:\迅雷下载\ctf-zip\apktool


Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
d-----         2025/4/15     15:05                output_directory
-a----         2025/4/15     14:44         832292 6176cfc5-d473-4453-a000-29e480ace634.apk
-a----          2025/3/3     22:06           1156 apktool.bat
-a----          2025/3/3     22:09       24480507 apktool_2.11.0.jar

2 文件夹移到kali找flag(我喜欢使用scp 你也可以使用其他方法)

cscp 是我自己封装好的工具并且添加到环境变量

#include<iostream>
#include<string>

int main(){
    // std::string str1 = "scp -r"; //scp -r path kali:~
    // std::string str2="kali:~";
    std::string str3;
    std::cout<<"输入文件路径:";
    std::cin>>str3;
    std::string str4 = "scp -r " + str3 + " kali:~";
    system(str4.c_str());
    return 0;
}

scp -r <解包后的文件路径> kali@kali:~

PS C:\Users\A3138> cscp
杈撳叆鏂囦欢璺緞:"E:\迅雷下载\ctf-zip\apktool\output_directory"
.gitignore                                                                            100%   50    24.4KB/s   00:00
profiles_settings.xml                                                                 100%  174    85.0KB/s   00:00
misc.xml                                                                              100%  189     0.2KB/s   00:00
modules.xml                                                                           100%  291   142.1KB/s   00:00

3 grep “flag” /path/<解包后的文件>


┌──(kali㉿kali)-[~/output_directory]
└─$ grep -r "flag" .
./smali/android/support/v4/accessibilityservice/AccessibilityServiceInfoCompat.smali:.method public static flagToString(I)Ljava/lang/String;
./smali/android/support/v4/accessibilityservice/AccessibilityServiceInfoCompat.smali:    .param p0, "flag"    # I
./smali/android/support/v4/view/ViewPager$SavedState.smali:    .param p2, "flags"    # I
./smali/android/support/v4/text/BidiFormatter.smali:    .param p2, "flags"    # I
./smali/android/support/v4/widget/SlidingPaneLayout$SavedState.smali:    .param p2, "flags"    # I
./smali/android/support/v4/widget/ResourceCursorAdapter.smali:    .param p4, "flags"    # I
./smali/android/support/annotation/IntDef.smali:.method public abstract flag()Z
./smali/com/example/helloword/MainActivity.smali:    const-string v0, "flag{7631a988259a00816deda84afb29430a}"
./res/values/attrs.xml:        <flag name="useLogo" value="0x00000001" />
./res/values/attrs.xml:        <flag name="showHome" value="0x00000002" />