{"id":319,"date":"2021-11-26T22:51:11","date_gmt":"2021-11-26T14:51:11","guid":{"rendered":"http:\/\/101.34.19.194\/?p=319"},"modified":"2021-11-26T22:51:12","modified_gmt":"2021-11-26T14:51:12","slug":"2020%e9%bb%91%e7%9b%be%e6%9d%af%e9%83%a8%e5%88%86misc","status":"publish","type":"post","link":"http:\/\/101.34.19.194\/?p=319","title":{"rendered":"2020\u9ed1\u76fe\u676f\u90e8\u5206MISC"},"content":{"rendered":"\n

Misc-encrypt<\/h2>\n\n\n\n

\u538b\u7f29\u5305\u91cc\u6709flag.txt<\/code>\u6587\u4ef6\uff0c\u6211\u7684banzip\u8f6f\u4ef6\u76f4\u63a5\u7834\u4e86\u4f2a\u52a0\u5bc6<\/p>\n\n\n\n

flag.txt\u6587\u4ef6\u5185\u5bb9\u4e3aUTAxSlUwTkRWRVo3Um1GclpWOWxibU55ZVhCMGFXOXVmUT09<\/code><\/p>\n\n\n\n

\u7528base64\u89e3\u5bc6\uff0c\u5f97\u5230Q01JU0NDVEZ7RmFrZV9lbmNyeXB0aW9ufQ==<\/code><\/p>\n\n\n\n

\u660e\u663e\u7ed3\u5c3e\u6709=<\/code>\uff0c\u518d\u4e00\u6b21\u7528base64\u89e3\u5bc6\uff0c\u5f97\u5230flag\uff1aCMISCCTF{Fake_encryption}<\/code><\/p>\n\n\n\n

Misc-Burps<\/h2>\n\n\n\n

\u6253\u5f00\u538b\u7f29\u5305\uff0c\u67091.txt~6.txt\u4ee5\u53caflag.txt<\/code>\uff0c\u4e141~6\u6587\u4ef6\u7684\u5927\u5c0f\u6bd4\u8f83\u5c0f\uff0c\u5e94\u8be5\u7528crc32\u78b0\u649e<\/p>\n\n\n\n

\u7167\u5e38\u7528crc32\u78b0\u649e\u811a\u672c\uff0c\u6bcf\u6b21\u8fd0\u884c\u811a\u672c\u4f1a\u5f97\u52304\u4e2a\u5b57\u8282\u7684\u6570\u636e<\/p>\n\n\n\n

python crc32.py reverse 0x6083a1c8<\/code><\/pre>\n\n\n\n
\"image-20211126105725499\"\/<\/div><\/figure>\n\n\n\n
\u5c06\u5f97\u5230\u76844\u5757\u5341\u516d\u8fdb\u5236\u7684\u6570\u636e\uff0c\u63d0\u53d6\u51fa\u6765\uff0c\u5f97\u52307468655f<\/code><\/p>\n\n\n\n
\u5c06\u5176\u8f6c\u6362\u6210ASCII\u7801\uff0c\u5f97\u5230the_<\/code><\/p>\n\n\n\n
\u5176\u540e\u76845\u4e2a\u6587\u4ef6\u90fd\u5982\u6b64\uff0c\u63d0\u53d64\u5757\u5341\u516d\u8fdb\u5236\u6570\u636e\u5e76\u8f6cASCII\u7801<\/p>\n\n\n\n
\u6700\u7ec8\u5f97\u5230\u89e3\u538b\u5bc6\u7801the_password_here_cipher<\/code><\/p>\n\n\n\n
\u6253\u5f00flag.txt<\/code>\uff0c\u5f97\u5230flag\uff1aCMISCCTF{how_to_burp_by_coding}<\/code><\/p>\n\n\n\n
Misc-blind<\/h2>\n\n\n\n
\u6253\u5f00\u538b\u7f29\u5305\u6709blind.png<\/code>\u548cenc.rar<\/code>\uff0c\u5176\u4e2denc.rar<\/code>\u6709\u5bc6\u7801<\/p>\n\n\n\n
\"image-20211126112342821\"\/<\/div><\/figure>\n\n\n\n
\u6240\u4ee5\u8003\u8651\u4ece\u56fe\u7247\u5165\u624b\uff0c\u4e14\u9898\u76ee\u4e5f\u63d0\u793a\u76f2\u6c34\u5370<\/p>\n\n\n\n
\u62c9\u8fdbkali\u8fdb\u884cbinwalk\u5206\u6790<\/p>\n\n\n\n
\"image-20211126112606709\"\/<\/div><\/figure>\n\n\n\n
\u53d1\u73b0\u6709\u4e24\u5f20\u56fe\u7247\uff0c\u5206\u79bb\uff0c\u5f97\u5230\u4e24\u5f20\u4e00\u6a21\u4e00\u6837\u7684\u56fe\u7247<\/p>\n\n\n\n
\u7528\u666e\u901a\u7684\u76f2\u6c34\u5370\u811a\u672c\u89e3\u6790\uff0c\u53d1\u73b0\u5f97\u5230\u7684\u56fe\u7247\u5565\u4e5f\u6ca1\u6709\uff0c\u5bbd\u9ad8\u4e5f\u6ca1\u88ab\u4fee\u6539<\/p>\n\n\n\n
\"image-20211126112929662\"\/<\/div><\/figure>\n\n\n\n
\u4e8e\u662f\u8003\u8651\u7528\u9891\u57df\u76f2\u6c34\u5370\u8fdb\u884c\u89e3\u6790<\/p>\n\n\n\n
python2 BlindWaterMarkplus.py --original 1.png --image 2.png --result res.png<\/code><\/pre>\n\n\n\n
\u5f97\u5230\u4e00\u5f20\u6709\u70b9\u6a21\u7cca\u7684\u89e3\u538b\u5bc6\u7801\u7167\u7247\uff0c\u83b7\u5f97\u89e3\u538b\u5bc6\u7801Q@CTF@NX<\/code><\/p>\n\n\n\n
\u5177\u4f53\u5185\u5bb9\u53ef\u53c2\u8003ctf misc \u56fe\u7247\u9898\u77e5\u8bc6\u70b9volcano\u7684\u535a\u5ba2-CSDN\u535a\u5ba2<\/em>ctf misc \u56fe\u7247<\/a><\/p>\n\n\n\n
\"image-20211126113326656\"\/<\/div><\/figure>\n\n\n\n
\u89e3\u538b\u538b\u7f29\u5305\uff0c\u5f97\u5230\u4e00\u5f20\u56fe\u7247<\/p>\n\n\n\n
\"image-20211126113754151\"\/<\/div><\/figure>\n\n\n\n
\u7167\u5e38\u62c9\u8fdbkali\u8fdb\u884c\u5206\u6790\uff0c\u53d1\u73b0\u6709\u4e24\u4e2azlib\uff0c\u8bf4\u660e\u6709\u4e24\u5f20png\u56fe\u7247\u7ed3\u5c3e\uff0c\u7b2c\u4e8c\u5f20\u7167\u7247\u6570\u636e\u635f\u574f\u4e86\u6216\u88ab\u5220\u53bb\u6587\u4ef6\u5934\u4e86<\/p>\n\n\n\n
\u6709\u4e24\u79cd\u65b9\u6cd5\u5206\u79bb<\/p>\n\n\n\n
\u7b2c\u4e00\u79cd\uff1a\u7528zsteg\u5de5\u5177\u5206\u6790\uff0c\u53ef\u4ee5\u53d1\u73b0\u6709\u5f02\u5e38\u5757\uff0c\u4e3aimage<\/p>\n\n\n\n
\"image-20211126162425213\"\/<\/div><\/figure>\n\n\n\n
\u7136\u540e\u8fdb\u884c\u63d0\u53d6<\/p>\n\n\n\n
zsteg -E \"extradata:0\" ctfer.png > 1.jpg <\/code><\/pre>\n\n\n\n
\u7b2c\u4e8c\u79cd\uff1a\u5728010editor\u641c\u7d2249 48 44 52<\/code>\u5341\u516d\u8fdb\u5236\u5b57\u8282\u53ef\u4ee5\u627e\u5230IHDR\u5757<\/p>\n\n\n\n
\"image-20211126162625768\"\/<\/div><\/figure>\n\n\n\n
\u7136\u540e\u6807\u8bb0\u4e3a\u5f00\u59cb\uff0c\u62c9\u5230\u6700\u540e\u6807\u8bb0\u4e3a\u7ed3\u675f\uff0c\u4fdd\u5b58\u9009\u62e9\uff0c\u6539\u540e\u7f00\u4e3apng\uff0c\u5373\u53ef\u5f97\u5230\u7f3a\u5931\u6587\u4ef6\u5934\u7684\u56fe\u7247<\/p>\n\n\n\n
\u5f97\u5230\u56fe\u7247\u540e\uff0c\u62c9\u8fdb010editor\uff0c\u63d2\u516512\u4e2a0\u6570\u503c<\/p>\n\n\n\n
\u4fee\u6539\u6587\u4ef6\u5934\u4e3a89 50 4E 47 0D 0A 1A 0A 00 00 00 0D<\/code><\/p>\n\n\n\n
\"image-20211126162824500\"\/<\/div><\/figure>\n\n\n\n
\"image-20211126163050721\"\/<\/div><\/figure>\n\n\n\n
\u6700\u7ec8\u5f97\u5230flag\u7684\u56fe\u7247\uff0cflag\u4e3aCMISCCTF{double_picture}<\/code><\/p>\n\n\n\n
\"image-20211126163155903\"\/<\/div><\/figure>\n\n\n\n
Misc-Trees<\/h2>\n\n\n\n
\u538b\u7f29\u5305\u91cc\u6709\u5f20\u56fe\u7247\uff0c\u89e3\u538b\u5f97\u5230<\/p>\n\n\n\n
\"image-20211126204452926\"\/<\/div><\/figure>\n\n\n\n
\u9898\u76ee\u63d0\u793a\u662fLSB\uff0c\u4e0d\u4f1a\uff0c\u653e\u811a\u672c<\/p>\n\n\n\n
from PIL import Image
\u200b
img = Image.open('enc.png')
w = img.width
h = img.height
img_obj = Image.new(\"RGB\",(w\/\/16,h\/\/16))
\u200b
for x in range(w\/\/16):
    for y in range(h\/\/16):
        (r,g,b)=img.getpixel((x*16,y*16))
        img_obj.putpixel((x,y),(r,g,b))
\u200b
img_obj.save('ok.png')<\/code><\/pre>\n\n\n\n
\"image-20211126204542783\"\/<\/div><\/figure>\n\n\n\n
\u5f97\u5230flag\uff1aCMISCCTF{coconut_tree}<\/code><\/p>\n\n\n\n
\u770bwp\u8bf4\u6709\u975e\u9884\u671f\u89e3\uff0c\u7528stegsolve<\/code>\u8c03\u989c\u8272\u901a\u9053\u8c03\u504f\u79fb\u91cf\u4ec0\u4e48\u7684\u53ef\u4ee5\u5f97\u5230\u6a21\u7cca\u7684\u5b57\u7b26<\/p>\n\n\n\n
Misc-music<\/h2>\n\n\n\n
\u6253\u5f00\u538b\u7f29\u5305\u91cc\u6709\u4e00\u4e2a_MACOSX\u6587\u4ef6\u5939<\/code>\u548cmusic.wav<\/code>\u6587\u4ef6\uff0c\u88ab\u90a3\u4e2a\u6587\u4ef6\u5939\u9a97\u4e86\uff0c\u4ee5\u4e3a\u6709\u5565\u63d0\u793a<\/p>\n\n\n\n
\u540e\u6765\u5f97\u77e5\u662f\u5728mac\u7535\u8111\u4e0a\u538b\u7f29\u751f\u6210\u7684<\/p>\n\n\n\n
\"image-20211126205308883\"\/<\/div><\/figure>\n\n\n\n
\u7528audacity<\/code>\u6253\u5f00\uff0c\u770b\u6ce2\u5f62\u56fe\u6709\u4e00\u9ad8\u4e00\u4f4e<\/p>\n\n\n\n
\u4f30\u8ba1\u662f\u9ad8\u7684\u6ce2\u5f62\u8f6c\u62101\uff0c\u4f4e\u7684\u8f6c\u62100<\/p>\n\n\n\n
\"image-20211126205335048\"\/<\/div><\/figure>\n\n\n\n
\u6446\u4e0a\u5927\u4f6c\u7684\u811a\u672c<\/p>\n\n\n\n
import numpy as np
import struct
import wave
import re
\u200b
\u200b
def write_records(records, format, f):
    #Write a sequence of tuples to a binary file of structures.
    record_struct = Struct(format)
    for r in records:
        f.write(record_struct.pack(*r))
\u200b
path = \".\/music.wav\"
f = wave.open(path, \"rb\")
# \u8bfb\u53d6\u683c\u5f0f\u4fe1\u606f
# (nchannels, sampwidth, framerate, nframes, comptype, compname)
params = f.getparams()
nchannels, sampwidth, framerate, nframes = params[:4]
# \u8bfb\u53d6\u6ce2\u5f62\u6570\u636e
str_data = f.readframes(nframes)
f.close()
#\u5c06\u6ce2\u5f62\u6570\u636e\u8f6c\u6362\u4e3a\u6570\u7ec4
wave_data = np.fromstring(str_data, dtype=np.short)
b = ''
# arr = [elem for elem in wave_data if elem >0]
max = 0
d = ''
for i in wave_data:
    if i <0:
        if max !=0:
            if max<25000:
                d +='0'
            else:
                d += '1'
                pass
        max = 0
    if max < i:
        max = i
\u200b
print(d)
print(\"\\n\\n\\n\\n\")
a = re.findall(r'.{8}',d)
hex_list=[]
for i in a:
    res = hex(int(i,2))
    hex_list.append(res)
print(hex_list)
\u200b
with open(\"result.txt\",\"wb\") as f:
    for x in hex_list:
        s = struct.pack('B',int(x,16))
        f.write(s)<\/code><\/pre>\n\n\n\n
\u770b\u5230\u8fd0\u884c\u89e3\u538b\u540e\u7684\u524d\u56db\u4e2a\u5b57\u7b26\u662f52 61 72 21<\/code>\uff0c\u662frar\u538b\u7f29\u5305\u7684\u6587\u4ef6\u5934\uff0c\u6539\u540e\u7f00\u540d\u4e3arar<\/p>\n\n\n\n
\"image-20211126205556499\"\/<\/div><\/figure>\n\n\n\n
\u6253\u5f00\u538b\u7f29\u5305\uff0c\u63d0\u793a\u6ca1\u6709flag<\/p>\n\n\n\n
\"image-20211126205643582\"\/<\/div><\/figure>\n\n\n\n
\u9898\u76ee\u63d0\u793aNTFS\u6570\u636e\u6d41\uff0c\u7528winrar<\/code>\u89e3\u538b\uff0c\u7528NtfsStreamsEditor2<\/code>\u626b\u63cf\u89e3\u538b\u540e\u7684\u6587\u4ef6\u5939\uff0c\u626b\u63cf\u5f97\u5230png\u56fe\u7247<\/p>\n\n\n\n
\"image-20211126205846764\"\/<\/div><\/figure>\n\n\n\n
\u6253\u5f00\u56fe\u7247\uff0c\u662f\u4e00\u4e2a\u6b8b\u7f3a\u7684\u4e8c\u7ef4\u7801\uff0c\u731c\u6d4b\u662f\u4fee\u6539\u4e86\u5bbd\u9ad8\uff0c\u811a\u672c\u8ba1\u7b97CRC32\u5e76\u4fee\u590d<\/p>\n\n\n\n
\u6700\u7ec8\u626b\u63cf\u5f97\u5230flag\uff1aflag{4dcfda814ec9fd4761c1139fee3f65eb}<\/code><\/p>\n\n\n\n
\"image-20211126210145029\"\/<\/div><\/figure>\n","protected":false},"excerpt":{"rendered":"
Misc-encrypt \u538b\u7f29\u5305\u91cc\u6709flag.txt\u6587\u4ef6\uff0c\u6211\u7684banzip\u8f6f\u4ef6\u76f4\u63a5\u7834\u4e86\u4f2a\u52a0\u5bc6 flag.txt […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[17],"tags":[],"_links":{"self":[{"href":"http:\/\/101.34.19.194\/index.php?rest_route=\/wp\/v2\/posts\/319"}],"collection":[{"href":"http:\/\/101.34.19.194\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/101.34.19.194\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/101.34.19.194\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/101.34.19.194\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=319"}],"version-history":[{"count":1,"href":"http:\/\/101.34.19.194\/index.php?rest_route=\/wp\/v2\/posts\/319\/revisions"}],"predecessor-version":[{"id":320,"href":"http:\/\/101.34.19.194\/index.php?rest_route=\/wp\/v2\/posts\/319\/revisions\/320"}],"wp:attachment":[{"href":"http:\/\/101.34.19.194\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=319"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/101.34.19.194\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=319"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/101.34.19.194\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=319"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}