以*CTF2018的misc題xp3為例子
image.png
附件下載地址
https://github.com/aye-whitehat/CTF-Collect/blob/master/StarCTF2018/xp3(misc)/challenge/xp3.zip
xp3文件提取器
在CSDN下載的柏肪，我也放到了github這個(gè)項(xiàng)目中
提取結(jié)果如圖：
image.png
隱寫(xiě)1
g01.ks發(fā)現(xiàn)注釋?zhuān)莦ip的頭部的hex信息
image.png
然后將g01.ks~g56.ks的最后一行的hex提取出來(lái)剿配，并寫(xiě)入bin文件中
image.png
cat.py
#!coding:utf-8
import os
#提取hex
a = ''
for i in range(1,57):
i = str(i)
i = i.zfill(2)
a += os.popen("cat g%s.ks | tail -n 1"%i).read()[6:]
#cat的原文是unicode編碼 ;// 共占了6個(gè)字節(jié)
print a
hex2bin.py
#!coding:utf-8
hexString1 = '504B0304140009000800736B704CE5C121E6330000002700000008000000666C61672E747874C340D528ED5CC1EDD15C038FA53F28ADA8B44B201EF019F5EA25549804EAED5802B78AFCDC00AE8186BDAC0F35C811814133F1504B01021400140009000800736B704CE5C121E63300000027000000080024000000000000002000000000000000666C61672E7478740A002000000000000100180018E8397EE7BCD30100A58FCFDEBAD30111508455DEBAD301504B050600000000010001005A00000059000000000000000000000000000000000000000000000000'
hexList1 = []
intList1 = []
asciiString1 =''
while True:
intString1 = hexString1[0:2]
hexString1 = hexString1[2:]
hexList1.append(intString1)
if (hexString1 == ''):
break
for i in hexList1:
intList1.append(int(i,16))
for j in intList1:
asciiString1 += chr(int(j))
f = open('flag.bin','w')
f.write(asciiString1)
f.close()
隱寫(xiě)2
打開(kāi)zip發(fā)現(xiàn)加密了搀捷，不是偽加密蔑滓，爆破8位數(shù)字也沒(méi)用，而且提取的圖片信息也還沒(méi)用到
將文件夾中的圖片全部哈希囱挑，發(fā)現(xiàn)pic25.bmp跟別的圖片表面上一樣酱床，實(shí)際上哈希不同
image.png
image.png
這里考察盲水印
github有個(gè)處理盲水印的項(xiàng)目
https://github.com/chishaxie/BlindWaterMark
wget https://raw.githubusercontent.com/chishaxie/BlindWaterMark/master/bwm.py
cp pic0.bmp hui.png #原圖
cp pic25.bmp hui_with_wm.png #原圖+盲水印
python bwm.py decode hui.png hui_with_wm.png wm_from_hui.png #盲水印圖
image.png
image.png
得到密碼
NoGalgameNoLife
得到flag
*ctf{Hope_Every0ne_Has_A_Happy_End2333}
image.png
