{"id":309,"date":"2021-11-12T20:07:01","date_gmt":"2021-11-12T12:07:01","guid":{"rendered":"http:\/\/101.34.19.194\/?p=309"},"modified":"2021-11-12T20:07:03","modified_gmt":"2021-11-12T12:07:03","slug":"%e5%bc%ba%e7%bd%91%e6%8b%9f%e6%80%81%e6%8c%91%e6%88%98%e8%b5%9bmisc","status":"publish","type":"post","link":"http:\/\/101.34.19.194\/?p=309","title":{"rendered":"\u201c\u5f3a\u7f51\u201d\u62df\u6001\u6311\u6218\u8d5bMISC"},"content":{"rendered":"\n

weirdphoto<\/strong><\/h2>\n\n\n\n

\u538b\u7f29\u5305\u91cc\u6709\u4e00\u5f20png\u56fe\u7247\u548c\u538b\u7f29\u5305<\/p>\n\n\n\n

\u91cc\u9762\u7684\u538b\u7f29\u5305\u6709\u5bc6\u7801\uff0c\u56fe\u7247\u5168\u662f\u6a2a\u7eb9\u4f30\u8ba1\u9700\u8981\u8c03\u6574\u5bbd\u9ad8<\/p>\n\n\n\n

\"image-20211112105657555\"\/<\/div><\/figure>\n\n\n\n

\u4e8e\u662f\u5c1d\u8bd5\u7528\u811a\u672c\u8fdb\u884c\u7206\u7834\u4fee\u6539\u5bbd\u9ad8<\/p>\n\n\n\n

import binascii
import struct
import sys
file = input(\"\u56fe\u7247\u5730\u5740\uff1a\")
fr = open(file,'rb').read()
data: bytearray = bytearray(fr[0x0c:0x1d])
crc32key = eval('0x'+str(binascii.b2a_hex(fr[0x1d:0x21]))[2:-1])
#\u539f\u6765\u7684\u4ee3\u7801: crc32key = eval(str(fr[29:33]).replace('\\\\x','').replace(\"b'\",'0x').replace(\"'\",''))
n = 4095
for w in range(n):
    width = bytearray(struct.pack('>i', w))
    for h in range(n):
        height = bytearray(struct.pack('>i', h))
        for x in range(4):
            data[x+4] = width[x]
            data[x+8] = height[x]
        crc32result = binascii.crc32(data) & 0xffffffff
        if crc32result == crc32key:
            print(width,height)
            newpic = bytearray(fr)
            for x in range(4):
                newpic[x+16] = width[x]
                newpic[x+20] = height[x]
            fw = open(file+'.png','wb')
            fw.write(newpic)
            fw.close
            sys.exit()<\/code><\/pre>\n\n\n\n
\u4fee\u590d\u6210\u529f\u540e\u5f97\u5230\u4e00\u5f20\u7167\u7247\uff0c\u53f3\u8fb9\u6709\u82f1\u6587<\/p>\n\n\n\n
\"image-20211112105914997\"\/<\/div><\/figure>\n\n\n\n
\u5f53\u65f6\u505a\u5230\u8fd9\u5c31\u5361\u4f4f\u4e86\uff0c\u4e0d\u77e5\u9053\u8fd9\u4e32\u5b57\u7b26\u662f\u4ec0\u4e48<\/p>\n\n\n\n
(\u590d\u76d8)<\/p>\n\n\n\n
\u770b\u4e86wp\u624d\u77e5\u9053\u662f\u6805\u680f\u5bc6\u7801\uff0c\u63d0\u53d6\u51fa\u6765\u89e3\u7801<\/p>\n\n\n\n
\"image-20211112110549787\"\/<\/div><\/figure>\n\n\n\n
\u5f97\u5230\u538b\u7f29\u5305\u5bc6\u7801\uff0c\u89e3\u7801\uff0c\u5f97\u5230out\u6587\u4ef6<\/p>\n\n\n\n
\u770b\u5230\u5f00\u593400000000\u540e\u662f2D312E\uff0c\u662fpdf\u6587\u4ef6\u5934\u7684\u4e00\u90e8\u5206<\/p>\n\n\n\n
\u4fee\u6539\u5f00\u5934\u4e3a25504446<\/p>\n\n\n\n
\u5f97\u5230pdf\u540e\u7528wbStego\u5bf9pdf\u8fdb\u884c\u9690\u5199\u63d0\u53d6<\/p>\n\n\n\n
\u5f97\u5230flag<\/p>\n\n\n\n
bluewhale<\/strong><\/h2>\n\n\n\n
\u89e3\u538b\u5f97\u5230\u4e00\u4e2a\u6d41\u91cf\u5305\u548c\u4e00\u4e2a\u538b\u7f29\u5305\uff0c\u538b\u7f29\u5305\u6709\u5bc6\u7801<\/p>\n\n\n\n
wireshark\u6253\u5f00\u6d41\u91cf\u5305\uff0c\u641c\u7d22password\u770b\u6709\u6ca1\u6709\u5bc6\u7801<\/p>\n\n\n\n
\u641c\u7d22\u5f97\u5230password<\/p>\n\n\n\n
\"image-20211112112726383\"\/<\/div><\/figure>\n\n\n\n
\u5c1d\u8bd5\u89e3\u538b\u53d1\u73b0\u4e0d\u662f\u538b\u7f29\u5305\u5bc6\u7801<\/p>\n\n\n\n
\u7136\u800c\u538b\u7f29\u5305\u91cc\u7684\u4e00\u4e2atxt\u6587\u4ef6\u540d\u4e5f\u53ebpassword<\/p>\n\n\n\n
\u5c1d\u8bd5\u660e\u6587\u653b\u51fb<\/p>\n\n\n\n
\u5c06\u8fd9\u6bb5th1sIsThEpassw0rD<\/code>\u6dfb\u52a0\u5230txt\u91cc\u538b\u7f29\u6210zip<\/p>\n\n\n\n
\u8fdb\u884c\u53d1\u73b0crc\u4e00\u6837\uff0c\u8fdb\u884c\u660e\u6587\u653b\u51fb\uff0c\u5f97\u5230\u5bc6\u7801<\/p>\n\n\n\n
\"image-20211112114608033\"\/<\/div><\/figure>\n\n\n\n
\u89e3\u538b\u5f97\u5230\u4e00\u4e2atxt\u548cpng\uff0c\u7528stegolve\u67e5\u770b\u56fe\u7247\u6709\u6ca1\u6709\u9690\u5199<\/p>\n\n\n\n
\u53d1\u73b0\u8fdb\u884cdata extract\uff0c\u53d1\u73b0\u662flsb\u9690\u5199\uff0c\u5f97\u5230flag<\/p>\n\n\n\n
\"image-20211112114902259\"\/<\/div><\/figure>\n\n\n\n
bar<\/h2>\n\n\n\n
GIF\u6587\u4ef6\uff0c\u6253\u5f00\u5168\u662f\u4e00\u5e27\u4e00\u5e27\u7684\u9ed1\u767d\u7070\u95ea\u70c1<\/p>\n\n\n\n
GIFFrame\u6253\u5f00\u4fdd\u5b58\u6240\u6709\u5e27\u5230\u4e00\u4e2a\u6587\u4ef6\u5939\uff0c\u9ed1\u8272\u4e3a1\uff0c\u767d\u8272\u4e3a0\uff0c\u7070\u8272\u7a7a\u683c\uff0c\u6309\u987a\u5e8f\u8f93\u5165\u51e0\u4e2a<\/p>\n\n\n\n
\u590d\u5236\u5230\u6469\u65af\u5bc6\u7801\u89e3\u7801<\/p>\n\n\n\n
\"image-20211112155839385\"\/<\/div><\/figure>\n\n\n\n
\u63d0\u793acode93\uff0c\u641c\u7d22\u627e\u5230code93\u6761\u7801\u89c4\u8303<\/p>\n\n\n\n
\u6761\u7801\u89c4\u8303\u2014\u2014Code 93_kzhuangood\u7684\u535a\u5ba2-CSDN\u535a\u5ba2<\/a><\/p>\n\n\n\n
\u6bcf9\u4e2a\u4e00\u7ec4\uff0c\u9ed1\u8272\u4e3a1\u767d\u8272\u4e3a0<\/p>\n\n\n\n
\u4f9d\u6b21\u7167\u7740\u8f93\u5165\uff0c\u5bf9\u7167\u7f16\u7801\u8868<\/p>\n\n\n\n
\"image-20211112161036628\"\/<\/div><\/figure>\n\n\n\n
\u6700\u540e\u5f97\u5230\u4e00\u4e32\u5b57\u7b26\u8fd8\u6709\u6821\u9a8c\u4f4d<\/p>\n\n\n\n
F0C62DB973684DBDA896F9C5F6D962<\/code><\/p>\n\n\n\n
\u7136\u540e\u5230\u5728\u7ebf\u751f\u6210\u6761\u5f62\u7801\u7f51\u7ad9\u751f\u6210\uff0c\u5176\u4f1a\u81ea\u52a8\u53bb\u6389\u6821\u9a8c\u4f4d<\/p>\n\n\n\n
\"image-20211112161658377\"\/<\/div><\/figure>\n\n\n\n
\u6700\u540e\u5176\u751f\u6210\u7684\u7801\u8f6c\u6210\u5c0f\u5199\u5373\u4e3aflag<\/p>\n\n\n\n
mirror<\/h2>\n\n\n\n
\u56fe\u7247\u5728kali\u91ccbinwalk\u3001foremost\u6ca1\u6709\u5565\u7ed3\u679c<\/p>\n\n\n\n
\u56fe\u7247\u5728kali\u91cc\u6253\u4e0d\u5f00\uff0ccrc\u9519\u8bef\uff0c\u6240\u4ee5\u7528\u811a\u672c\u8fdb\u884c\u4fee\u590d\u5bbd\u9ad8<\/p>\n\n\n\n
\"image-20211112195851172\"\/<\/div><\/figure>\n\n\n\n
\u53d1\u73b0\u4e0a\u4e0b\u98a0\u5012\u4e00\u5f20\u76f8\u540c\u7684\u56fe\u7247<\/p>\n\n\n\n
\u62c9\u8fdb010editor\uff0c\u53d1\u73b0\u7ed3\u5c3e\u6709png\u6807\u8bc6<\/p>\n\n\n\n
\"image-20211112195253378\"\/<\/div><\/figure>\n\n\n\n
\u7528\u811a\u672c\u8fdb\u884c\u53cd\u8f6c\u98a0\u5012<\/p>\n\n\n\n
data = open('full.png.png', 'rb').read()
data = data[::-1]
data = [data[i:i+16][::-1] for i in range(0, len(data), 16)]
# print(data[0]) 
print(len(data)) 
res = b''.join(data) 
f = open('flag.png', 'wb') 
f.write(res) 
f.close()<\/code><\/pre>\n\n\n\n
\u51fa\u6765\u4e24\u5f20\u4e00\u6a21\u4e00\u6837\u7684\u7167\u7247\uff0c\u8dd1\u76f2\u6c34\u5370\u8bd5\u8bd5<\/p>\n\n\n\n
python bwmforpy3.py decode flag.png.png full.png.png flag.png<\/code><\/pre>\n\n\n\n
\"image-20211112200506808\"\/<\/div><\/figure>\n\n\n\n
\u53ef\u4ee5\u770b\u5230\u6709\u6570\u5b57\uff0c\u955c\u50cf\u7ffb\u8f6c\u4e00\u4e0b\u6839\u636ehint\u5c31\u5f97\u5230flag<\/p>\n\n\n\n
\u8f6cCTF | 2021 \u7b2c\u56db\u5c4a\u201c\u5f3a\u7f51\u201d\u62df\u6001\u9632\u5fa1\u56fd\u9645\u7cbe\u82f1\u6311\u6218\u8d5b SU WriteUp | MiaoTony’s\u5c0f\u7a9d<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
weirdphoto \u538b\u7f29\u5305\u91cc\u6709\u4e00\u5f20png\u56fe\u7247\u548c\u538b\u7f29\u5305 \u91cc\u9762\u7684\u538b\u7f29\u5305\u6709\u5bc6\u7801\uff0c\u56fe\u7247\u5168\u662f\u6a2a\u7eb9\u4f30\u8ba1\u9700\u8981\u8c03\u6574\u5bbd\u9ad8 \u4e8e\u662f […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[17],"tags":[],"_links":{"self":[{"href":"http:\/\/101.34.19.194\/index.php?rest_route=\/wp\/v2\/posts\/309"}],"collection":[{"href":"http:\/\/101.34.19.194\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/101.34.19.194\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/101.34.19.194\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/101.34.19.194\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=309"}],"version-history":[{"count":1,"href":"http:\/\/101.34.19.194\/index.php?rest_route=\/wp\/v2\/posts\/309\/revisions"}],"predecessor-version":[{"id":310,"href":"http:\/\/101.34.19.194\/index.php?rest_route=\/wp\/v2\/posts\/309\/revisions\/310"}],"wp:attachment":[{"href":"http:\/\/101.34.19.194\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=309"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/101.34.19.194\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=309"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/101.34.19.194\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=309"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}