ISCTF的MISC复现

import os

def josephus_circle(num_files, step):
    files = list(range(1, num_files + 1))  # 文件编号从1到num_files
    result = []  # 用于存放挑选的文件编号
    index = 0  # 起始位置

    # 进行约瑟夫环的数数与挑选过程
    while files:
        index = (index + step - 1) % len(files)  # 计算挑选的位置
        result.append(files.pop(index))  # 将文件编号加入结果并从列表中移除

    return result

# 调用约瑟夫环函数得到文件顺序
selected_files = josephus_circle(137, 7)

# 设定要读取的文件夹路径
folder_path = r"C:\Users\Lenovo\Desktop\ISCTF\奇怪的txt"  # 请替换为您的文件夹路径

# 获取文件夹中的所有 .txt 文件
all_files = [f for f in os.listdir(folder_path) if f.endswith('.txt')]

# 确保文件名正确的顺序
ordered_files = []
for file_number in selected_files:
    file_name = f"{file_number}.txt"
    if file_name in all_files:
        ordered_files.append(file_name)

# 创建输出文件
with open("flag.txt", "w", encoding="utf-8") as output_file:
    for file_name in ordered_files:
        try:
            # 读取每个文件的内容
            with open(os.path.join(folder_path, file_name), "r", encoding="utf-8") as f:
                content = f.read().replace(" ", "")  # 删除所有空格
                content = "\n".join([line for line in content.splitlines() if line])  # 删除所有空行
                # 写入到输出文件中
                output_file.write(content + "\n")
        except FileNotFoundError:
            print(f"Warning: {file_name} not found and will be skipped.")

# 输出文件顺序
print("文件排列顺序:", ordered_files)

import base64

def recursive_base64_decode(encoded_content):
    try:
        # 尝试解码
        decoded_content = base64.b64decode(encoded_content)

        # 将解码后的内容转换为字符串
        decoded_str = decoded_content.decode('utf-8')

        # 如果解码后的内容仍然包含 Base64 标志字符，则递归解码
        if "==" in decoded_str or len(decoded_str) % 4 == 0:
            return recursive_base64_decode(decoded_str)
        else:
            return decoded_content

    except Exception as e:
        # 如果解码失败，说明已经解码完毕，返回当前内容
        return decoded_content

# 读取包含 Base64 编码内容的文件
with open('flag.txt', 'r') as file:
    encoded_content = file.read()

# 递归解码
decoded_content = recursive_base64_decode(encoded_content)

# 将最终解码后的内容保存为 key.bin
with open('key.bin', 'wb') as output_file:
    output_file.write(decoded_content)

print("解码完成，结果保存为 key.bin")

# 读取输入文件，替换内容，并写入输出文件
def replace_values(input_file, output_file):
    # 创建一个替换字典
    replacements = {
        "63": "00",
        "127": "01",
        "191": "10",
        "255": "11"
    }

    with open(input_file, 'r') as file:
        content = file.read()

    # 替换值
    for old_value, new_value in replacements.items():
        content = content.replace(old_value, new_value)

    # 替换换行符为空
    content = content.replace('\n', '')

    # 将结果写入输出文件
    with open(output_file, 'w') as file:
        file.write(content)

# 调用函数
replace_values(r"C:\Users\Lenovo\Desktop\output.txt", 'aaa.txt')

import wave
import numpy as np


def embed_message(wav_file, message, output_file):
    # 将消息转换为二进制
    message_bits = ''.join(format(ord(c), '08b') for c in message)

    # 打开原始WAV文件
    with wave.open(wav_file, 'rb') as wav:
        params = wav.getparams()  # 获取WAV文件的参数
        frames = wav.readframes(wav.getnframes())  # 读取所有音频帧
        frames_array = bytearray(frames)  # 将音频帧转换为字节数组

    # 确保消息可以被嵌入，检查音频数据的长度是否足够
    if len(message_bits) > len(frames_array):
        raise ValueError("消息太长，无法嵌入到音频文件中！")

    # 遍历每一位消息并修改音频帧的最低有效位
    for i in range(len(message_bits)):
        if message_bits[i] == '1':
            frames_array[i] |= 0b00000010  # 将最低有效位置为1
        else:
            frames_array[i] &= 0b11111101  # 将最低有效位置为0

    # 创建新的WAV文件并保存修改后的音频数据
    with wave.open(output_file, 'wb') as output_wav:
        output_wav.setparams(params)  # 设置输出文件的参数
        output_wav.writeframes(bytes(frames_array))  # 写入修改后的音频帧

    print(f"消息成功嵌入到 {output_file} 文件中！")


# 示例使用
embed_message("test.wav", '{{url_for.__globals__.os.popen(\'cat /flag\').read()}}', '2.wav')