1.[GXYCTF2019]SXMgdGhpcyBiYXNlPw==
题目描述:得到的 flag 请包上 flag{} 提交。
解题步骤:发现题目为base64编码,解密得到Is this base?
打开flag.txt,发现base64隐写
Q2V0dGUgbnVpdCwK
SW50ZW5hYmxlIGluc29tbmllLAp=
TGEgZm9saWUgbWUgZ3VldHRlLAo=
SmUgc3VpcyBjZSBxdWUgamUgZnVpcwp=
SmUgc3ViaXMsCt==
Q2V0dGUgY2Fjb3Bob25pZSwK
UXVpIG1lIHNjaWUgbGEgdOmUmnRlLAp=
QXNzb21tYW50ZSBoYXJtb25pZSwK
RWxsZSBtZSBkaXQsCo==
VHUgcGFpZXJhcyB0ZXMgZGVsaXRzLAp=
UXVvaSBxdSdpbCBhZHZpZW5uZSwK
T24gdHJh5Y2vbmUgc2VzIGNoYeWNr25lcywK
U2VzIHBlaW5lcywK
SmUgdm91ZSBtZXMgbnVpdHMsCm==
QSBsJ2Fzc2FzeW1waG9uaWUsCl==
QXV4IHJlcXVpZW1zLAr=
VHVhbnQgcGFyIGRlcGl0LAq=
Q2UgcXVlIGplIHNlbWUsCt==
SmUgdm91ZSBtZXMgbnVpdHMsCp==
QSBsJ2Fzc2FzeW1waG9uaWUsCp==
RXQgYXV4IGJsYXNwaGVtZXMsCo==
Sidhdm91ZSBqZSBtYXVkaXMsCl==
VG91cyBjZXV4IHF1aSBzJ2FpbWVudCwK
TCdlbm5lbWksCu==
VGFwaSBkYW5zIG1vbiBlc3ByaXQsCp==
RumUmnRlIG1lcyBkZWZhaXRlcywK
U2FucyByZXBpdCBtZSBkZWZpZSwK
SmUgcmVuaWUsCq==
TGEgZmF0YWxlIGhlcmVzaWUsCh==
UXVpIHJvbmdlIG1vbiDplJp0cmUsCo==
SmUgdmV1eCByZW5h5Y2vdHJlLAp=
UmVuYeWNr3RyZSwK
SmUgdm91ZSBtZXMgbnVpdHMsCn==
QSBsJ2Fzc2FzeW1waG9uaWUsCq==
QXV4IHJlcXVpZW1zLAp=
VHVhbnQgcGFyIGRlcGl0LAq=
Q2UgcXVlIGplIHNlbWUsCo==
SmUgdm91ZSBtZXMgbnVpdHMsCm==
QSBsJ2Fzc2FzeW1waG9uaWUsCl==
RXQgYXV4IGJsYXNwaGVtZXMsCm==
Sidhdm91ZSBqZSBtYXVkaXMsCu==
VG91cyBjZXV4IHF1aSBzJ2FpbWVudCwK
UGxldXJlbnQgbGVzIHZpb2xvbnMgZGUgbWEgdmllLAp=
TGEgdmlvbGVuY2UgZGUgbWVzIGVudmllcywK
U2lwaG9ubmVlIHN5bXBob25pZSwK
RGVjb25jZXJ0YW50IGNvbmNlcnRvLAq=
SmUgam91ZSBzYW5zIHRvdWNoZXIgbGUgRG8sCo==
TW9uIHRhbGVudCBzb25uZSBmYXV4LAp=
SmUgbm9pZSBtb24gZW5udWksCo==
RGFucyBsYSBtZWxvbWFuaWUsCl==
SmUgdHVlIG1lcyBwaG9iaWVzLAq=
RGFucyBsYSBkZXNoYXJtb25pZSwK
SmUgdm91ZSBtZXMgbnVpdHMsCv==
QSBsJ2Fzc2FzeW1waG9uaWUsCn==
QXV4IHJlcXVpZW1zLAp=
VHVhbnQgcGFyIGRlcGl0LAo=
Q2UgcXVlIGplIHNlbWUsCm==
SmUgdm91ZSBtZXMgbnVpdHMsCp==
QSBsJ2Fzc2FzeW1waG9uaWUsCm==
RXQgYXV4IGJsYXNwaGVtZXMsCu==
Sidhdm91ZSBqZSBtYXVkaXMsCm==
VG91cyBjZXV4IHF1aSBzJ2FpbWVudCwK
SmUgdm91ZSBtZXMgbnVpdHMsCn==
QSBsJ2Fzc2FzeW1waG9uaWUgKGwnYXNzYXN5bXBob25pZSksCn==
Sidhdm91ZSBqZSBtYXVkaXMsCt==
VG91cyBjZXV4IHF1aSBzJ2FpbWVudA==
base64隐写脚本
from urllib3.connectionpool import xrange
def get_base64_diff_value(s1, s2):
base64chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'
res = 0
for i in xrange(len(s2)):
if s1[i] != s2[i]:
return abs(base64chars.index(s1[i]) - base64chars.index(s2[i]))
return res
def solve_stego():
with open('flag.txt', 'rb') as f:
file_lines = f.readlines()
bin_str = ''
for line in file_lines:
steg_line = line.replace('\n', '')
norm_line = line.replace('\n', '').decode('base64').encode('base64').replace('\n', '')
diff = get_base64_diff_value(steg_line, norm_line)
print diff
pads_num = steg_line.count('=')
if diff:
bin_str += bin(diff)[2:].zfill(pads_num * 2)
else:
bin_str += '0' * pads_num * 2
print goflag(bin_str)
def goflag(bin_str):
res_str = ''
for i in xrange(0, len(bin_str), 8):
res_str += chr(int(bin_str[i:i + 8], 2))
return res_str
if __name__ == '__main__':
solve_stego()
运行得到结果GXY{fazhazhenhaoting}
flag{fazhazhenhaoting}
2.[RoarCTF2019]黄金6年
题目描述:得到的 flag 请包上 flag{} 提交。
解题步骤:Kinovea打开附件,在2.46s时发现一个二维码
QR打开发现:key1:i
继续观察视频,分别在4.90s,8.16s
QR打开分别发现:key2:want,key3:play
连接为iwantplay,感觉不像一句话,应该差了一个二维码,眼看瞎了也没找到,看别人wp才知道,还有一个,QR扫码为:key4:ctf
连接起来为:iwantplayctf,试了下不是flag,010打开.mp4文件,在末尾发现了一段base64编码:
UmFyIRoHAQAzkrXlCgEFBgAFAQGAgADh7ek5VQIDPLAABKEAIEvsUpGAAwAIZmxhZy50eHQwAQAD
Dx43HyOdLMGWfCE9WEsBZprAJQoBSVlWkJNS9TP5du2kyJ275JzsNo29BnSZCgMC3h+UFV9p1QEf
JkBPPR6MrYwXmsMCMz67DN/k5u1NYw9ga53a83/B/t2G9FkG/IITuR+9gIvr/LEdd1ZRAwUEAA==
解码发现为rar文件,里面包含flag.txt
python代码转换为rar文件
import base64
code="UmFyIRoHAQAzkrXlCgEFBgAFAQGAgADh7ek5VQIDPLAABKEAIEvsUpGAAwAIZmxhZy50eHQwAQADDx43HyOdLMGWfCE9WEsBZprAJQoBSVlWkJNS9TP5du2kyJ275JzsNo29BnSZCgMC3h+UFV9p1QEfJkBPPR6MrYwXmsMCMz67DN/k5u1NYw9ga53a83/B/t2G9FkG/IITuR+9gIvr/LEdd1ZRAwUEAA=="
r=base64.b64decode(code)
test_file=open("flag.rar","wb")
test_file.write(r)
test_file.close()
运行得到压缩包,用iwantplayctf为密码进行解压,发现flag.txt,打开发现flag:roarctf{CTF-from-RuMen-to-RuYuan}
flag{CTF-from-RuMen-to-RuYuan}
3.[ACTF新生赛2020]swp
题目描述:得到的 flag 请包上 flag{} 提交。
解题步骤:打开wget.pcapng
发现应该是http,导出http
发现secret.zip,解压得到.flag.swp和flag文件,看见.swp文件,隐藏文件,flag应该在里面,打开发现flag:actf{c5558bcf-26da-4f8b-b181-b61f3850b9e5}
flag{c5558bcf-26da-4f8b-b181-b61f3850b9e5}
4.间谍启示录
题目描述:在城际公路的小道上,罪犯G正在被警方追赶。警官X眼看他正要逃脱,于是不得已开枪击中了罪犯G。罪犯G情急之下将一个物体抛到了前方湍急的河流中,便头一歪突然倒地。警官X接近一看,目标服毒身亡。数分钟后,警方找到了罪犯遗失物体,是一个U盘,可惜警方只来得及复制镜像,U盘便报废了。警方现在拜托你在这个镜像中找到罪犯似乎想隐藏的秘密。 注意:得到的 flag 请包上 flag{} 提交
解题步骤:发现是.iso文件,foremost文件分离下发现四个文件夹
在rar文件夹中发现压缩包,解压后发信flag.exe,勾选隐藏项目的复选框,运行flag.exe,出现机密文件.txt,打开文件,发现flag:Flag{379:7b758:g7dfe7f19:9464f:4g9231}
flag{379:7b758:g7dfe7f19:9464f:4g9231}
5.zip
题目描述:拼在一起解下base64就有flag 注意:得到的 flag 请包上 flag{} 提交
解题步骤:打开附件发现68个压缩包,但是每个压缩包里只有4bytes大小,于是可以想到是crc爆破,代码
import zipfile
import string
import binascii
def CrackCrc(crc):
for i in dic:
for j in dic:
for k in dic:
for h in dic:
s = i + j + k + h
if crc == (binascii.crc32(s.encode())):
f.write(s)
return
def CrackZip():
for i in range(0,68):
file = 'out'+str(i)+'.zip'
crc = zipfile.ZipFile(file,'r').getinfo('data.txt').CRC
CrackCrc(crc)
dic = string.ascii_letters + string.digits + '+/='
f = open('out.txt','w')
CrackZip()
print("CRC32碰撞完成")
f.close
解出base64编码:
`z5BzAAANAAAAAAAAAKo+egCAIwBJAAAAVAAAAAKGNKv+a2MdSR0zAwABAAAAQ01UCRUUy91BT5UkSNPoj5hFEVFBRvefHSBCfG0ruGnKnygsMyj8SBaZHxsYHY84LEZ24cXtZ01y3k1K1YJ0vpK9HwqUzb6u9z8igEr3dCCQLQAdAAAAHQAAAAJi0efVT2MdSR0wCAAgAAAAZmxhZy50eHQAsDRpZmZpeCB0aGUgZmlsZSBhbmQgZ2V0IHRoZSBmbGFnxD17AEAHAA==
解码为十六进制:
cf907300000d00000000000000efbfbd3e7a00efbfbd2300490000005400000002efbfbd34efbfbdefbfbd6b631d491d33030001000000434d54091514efbfbdefbfbd414fefbfbd2448efbfbde88f984511514146efbfbdefbfbd1d20427c6d2befbfbd69ca9f282c3328efbfbd4816efbfbd1f1b181defbfbd382c4676efbfbdefbfbdefbfbd674d72efbfbd4d4ad58274efbfbdefbfbdefbfbd1f0aefbfbdcdbeefbfbdefbfbd3f22efbfbd4aefbfbd7420efbfbd2d001d0000001d0000000262efbfbdefbfbdefbfbd4f631d491d30080020000000666c61672e74787400efbfbd346966666978207468652066696c6520616e64206765742074686520666c6167efbfbd3d7b00400700
放入winhex中,看到CF 90 73我们知道这是一个残缺的rar,补上52 61 72 21 1A 07 00 保存后解压
保存,修改后缀为rar,在压缩文件注释中看到了flag:flag{nev3r_enc0de_t00_sm4ll_fil3_w1th_zip}