BMZCTF：掘地三尺

http://bmzclub.cn/challenges#%E6%8E%98%E5%9C%B0%E4%B8%89%E5%B0%BA

juedisanchi.doc打开隐藏文字，全选切换颜色

第一部分flag

flag{real_

复制这串字符，得到如下

在底部发现jpg文件结尾FF D9

但是这里复制出的文件头却没有jpg文件头FF D8，将juedisanchi.doc修改后缀为zip，解压，然后在juedisanchi\word\document.xml中找到前面的文件头

得到如下的jpg字节流文件

FFD8FFE000104A46494600010101006000600000FFDB004300080606070605080707070909080A0C140D0C0B0B0C1912130F141D1A1F1E1D1A1C1C20242E2720222C231C1C2837292C30313434341F27393D38323C2E333432FFDB0043010909090C0B0C180D0D1832211C213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232FFC0001108002800EA03012200021101031101FFC4001F0000010501010101010100000000000000000102030405060708090A0BFFC400B5100002010303020403050504040000017D01020300041105122131410613516107227114328191A1082342B1C11552D1F02433627282090A161718191A25262728292A3435363738393A434445464748494A535455565758595A636465666768696A737475767778797A838485868788898A92939495969798999AA2A3A4A5A6A7A8A9AAB2B3B4B5B6B7B8B9BAC2C3C4C5C6C7C8C9CAD2D3D4D5D6D7D8D9DAE1E2E3E4E5E6E7E8E9EAF1F2F3F4F5F6F7F8F9FAFFC4001F0100030101010101010101010000000000000102030405060708090A0BFFC400B51100020102040403040705040400010277000102031104052131061241510761711322328108144291A1B1C109233352F0156272D10A162434E125F11718191A262728292A35363738393A434445464748494A535455565758595A636465666768696A737475767778797A82838485868788898A92939495969798999AA2A3A4A5A6A7A8A9AAB2B3B4B5B6B7B8B9BAC2C3C4C5C6C7C8C9CAD2D3D4D5D6D7D8D9DAE2E3E4E5E6E7E8E9EAF2F3F4F5F6F7F8F9FAFFDA000C03010002110311003F00F7FA28AC1D1BC489AAEBBAC694F686DE5D3E40B1B190309D0FF18E38C30208EDC1EF475B074B9BD456141E244B8F185D68496DFBBB7B6F39AE8C9C1705729B71D83A9CE7B918E2ADDA788744BF8E67B3D634FB94808599A1BA471192700360F049E39A3A5C3AD8D2A2A86ADA82E9FA75D4A9245F694B69668A373F7F62E4F19C9038CE3D6A2D2B5ED3B5422DE1D42CA5BF4895EE2DA1994BC4481F7941257AFF00150B5BFF005FD6C0F43528AA306B5A55D6A3369D6FA9D94D7D0FFADB68E756963FF7941C8FC455AF3E2FB4183CD4F382EF31EE1BB6EEC671D719EF40125154AE757D32CACE4BCBBD46D20B58D9A379A59D551581C152C4E01CF18A743AA69F736D6F7305FDACB05CB6D86549959653CF0A41C31E0F4F434016E8A8D6789E77856546962019D0302CA0E7048ED9C1C7D0D617FC2516969AE6A767AADED8D8C16EF0C76EF3CA223233A6E232C704FA01401D0D154351D6F49D1FCAFED3D52CACBCD388FED37091EF3EDB88CD5B49E19649238E58DDE3C6F50412B9195C8ED91CD00494566CBE20D1609AD619B58D3E392EC036C8F7280CC0F036027E6FC2975CD6F4FF000EE9336A5A95C2436F10E4B3852C7B28C90093D850068D15973789341B6D3E0D427D6F4D8ACA73886E5EE916390FFB2C4ED3D0F4AD18A58E789258A41246EA195D0E4303D083DC5003E8ACD1E21D11AFE4B05D634F37913057B71729E623120005739049207D48A74FAEE8F6BA947A6DC6AB6315FCB8F2ED64B84595F3D3084E4FE5401A14536491218DA491D5234059998E0281D49358167E29B4D57C496F65A55F58DF58BDA4B33CD6D28976BA3C602EE5240E1CF1D7A50B57607A2B9D0D1546C35AD2B559268F4ED4ECAF1E03B665B79D64319F46009C743D69B69AF68FA80BA365AB58DC8B5CFDA3C9B847F2719CEFC1F97A1EBE9401A14550B2D7348D4AEE5B4B1D56C6E6E611992182E11DD07BA8391F8D2C1AD69575A8CDA75B6A76535F41CCB6F1CEAD247FEF28391F88A00BD4554B4D574EBF9A486CEFED6E258C2BBA4332BB2AB72A4807807B1EF56E800A28A2800AE1E682F34D7BCD760B0BA9E7B5D4A62608A325EE2DE4081828FE2C3056FF00801AEE28A3ADFF00AE9FE41E5FD75FF33829B4CD534DB9925B7B1FB6DDFF0061DC97DE84C52DCBC8AE50E783939C2E7A0C556D2F4C9357D79A3B9975ABBB19B489AD659AFB4E5B358D8BC78540228D8606586777FB27835E8D50DD5B47796B25BCAD2AA48BB58C52B46E07FB2CA4303EE08A36FF00C9BF1BFF00987F5F97F91C6598BED634AD6B50BB8DE4B9B7B1974C8820C979103095D40EBB9C28C7FD33A2C5CEA4FE1BB5B5D26FECAE74E62F70F7366F1AC0BE4BA150E46D909665FB8587193D2BB2B3B3B6D3ECE2B4B489628225DA88BD87F5FAF7A9E95B7FEBBFF987FC1FEBF03CDFC2FA44824D16CAFAEFC486F34C3B9E096C614B78DC2B29227100DEAD93F76462770CF7C749E2A964D28DAEBF6F119A6B6CDB344BD6559485551EFE608BF0CFAD74954EE74AB3BCBEB6BCB847925B624C40CAFB15BFBDB33B4B0EC482476229BD43ADCE624D39BC3F3E8175756D717D6F6704C97125BC0D33A5C485099BCB4058E48906541237FA135425B6B8124FAEC7A7DEAD87F6D457A96CB6EDE718C43E5BC9E56378258E76E3710338C9AF42A28EB7FEB7B874B7F5D8E73439A4BDF126AF7E2D2EE0B69ADED842D7103C45F69973F2B00475E8CA0F4E3914CB6D37CCF11F8A24B8B4668AE628634678CED917CB2180CF0467838F6AE9A8A525CCAC0B43CC8C7A9C7A7E9B653C7AAD9A7F62C10A1B1D316796E24DA43C52BC91B88D461783B46589CFA5A4B2D634FD13476B2B7BA5B8D474A834DB9C4649B79428D92B8C7CBB434B927BAA8F4AF43A2A9BBB7E7FF07FCC36B5BA7FC0FF0023CD6FF42FB2EA3AC69B2CFE2082C6F5638EDA0D3AC22B88668840B1EC2ED0BF964153F7D9579041E49AEA7C55633CDE06BFB2B649AE2616FB557EF48F8C7A7DE3C76EA7A5743452BBB0AC720DA8C36FE241AECDA7EA52D95CD92416F2A69D3BBC0CAEE5D5A209E626ECA1CEDC1DBF376CE87852CAE2D342952685AD44D75712C1011CC31BC8CC8A476E0838ED9C76ADFA286B4B7F5DC7FD7E8799C8F047E1AF0F6913E917515F69D7F642579AD9D228E412AAB3A4A46D94B127A162771271CD5BBA468741D7F409747BE9B54BF96E5A2912D1DE2B83233189CCC06C4DAA547CCC0AECE3B67A8B7F0AE8F6D7EB791C329923732451C9752BC3131CE4A44CC510F2794518C9F5AD9A7BA69F5FF81FE41B3D3A7FC1FF003303C4765733F85960F29AF648A4B7927880CB4E8922348003D7214F1DFA77AE63538A5F126BDA84FA46977F6ED368173682F2E2CDED7CC94B26C4FDE28618E7048C72719C1AF46A2975BFAFE2AC0B4DBCBF0773CD13479B57B1BAFB25E7891EFE3D2E7B585350B186D1222EA0797B9614DDC81B482CA36E73D32F86C927B2BBBC377E23925B3D2AE22D9A8E9F0DB471064198F2218CBF20636165F9739E99F48A8EE208AEADA5B79977452A1475C919523691C7B529AE68B5DD7F9FF98E1EEB5E5FF03FC8E1F4B923D4E2F0BDAE9DA4DED949A700F2B4D66D1476E9E43C6555C80B26E665E232C38C9E954BC31A44A1B45B2BEBBF121BCD31B73412D8C296F1B85656227108DEA727EEC858EE19EF8F468A24B785228C6D4450AA339C01C0A7D549DDB7DC94BDDB7C8C2F06D89D3BC21A6DB3C0F0C8210D223AED60C793907BE4D6ED1452185145140051451400514514005145140051451400514514005154AC35387509EFE185640D6571F6790B80016D8AD91CF4C38F4EF576800A28A2800A28A2800A28A2800A28A2800A28A2800A28A2800A28A2800A28A2800A28A2800A28A2800A28A2800A28A2800A28A2800AE735D5FB7788B4AD267BBB9B6B39E19E5616D70F03CD2218F62F988430C0676C02338F406B66EED66B929E56A1736BB739F25633BBEBB91BF4A826D16D2FAC0D96AE89AB445B7EDBE8227191F77E50A178FA66803CE609EE6DADAFEC74BBFF00B54573E246B479E7D41A0665FB38210CE8ACCADB9553701B8E319C9CD5DBA6F10D858C7A6BDCDAF9773AA25B88C6B933B4486166F29AE8C5E629670A5782DF36011918EF068BA50B096C0699662CE500496FE42F96E0000657183C003FE02284D174A8F4A3A5A69964BA73020DA2DBA88883C91B318FD28E9F77E16FF20FF83F8DFF00CFF0FBB86B85D52C74E8ECF52D5C595BBEB10420DB6AD25CC90A321DD13CCE8ADF31C11BB246F183C0C749A227D83C49A9E936F777371670DBC1305B9B979DA192469015DEE4B608553824E3B706ACDDF8634E9AC6CAC2DED6D6DACADAE04C6D62B7511B8C302BB46000777A5588744B4B1B1167A42A691087DFB6C2189013DFE52847E99A175F5FD103FEBEF6695155AD2D66B60FE6DFDC5DEEE9E6AC636FD362AFEB566800A28A2800A28A2800A28A2800A28A2800A28A2800A28A2800A28A2800A28A2800A28A8E5B886DB679D3471F98EB1A6F603731E8A33D4FB500494514500145145001451450014514500145151CF710DAC2D35C4D1C312E373C8C15464E0649F7A00928A28A0028A28A0028A28A0028A28A0028A8DEE218A58A19268D2598911A33005C819385EF81CD494005145140051451400514514005145140195AFE8DA56B1A7C9FDA7A659DEF931BB45F698164D8D8EABB81C74ED5C5A68DA7E97E13F09DC691A5D85ADDDCDC59191E28163F35BCB382E5402DC927D7AD7A34B189A178D890AEA54E3AF359A740B53A769765E64DE5698F13C27232C635DABBB8E78EB8C50B47F38FE0F507AAF93FC76324EBDA9E9D1EB36DAA4FA60B9B28A1962BC11C91C2E252CA018F73B6E0CA4000B6EC851826B06FBC51ADDDF863C45145751C579650C5225D9D2EE2D4B249B8102295C329054E1C311CF4C835D86A5E1AB3D4E5BA9A49AE23967580078994189A172E8EB904643377C8381C75CD61E0FB4783544BBBFBFBC97528120B89E6740D84DDB4A8550AA46EE806381C7DEC9FCC0FC89E7B6BEB0B2BAD5B6C77FACC76463090C6628E52A59942A9258649C7DE350786B57BCD465B88AF2FF4EB964557DB05B4B6B3459CF1243233301C70C48CF231C56A2E9EE7486B09F50BC9DD94A1BB6658E6E7BEE8D54023D80E955B4CD08D85F497D71AA5F6A574D10844B77E50D899CE02C688BC9E72413EF4D6FF00D7F5B874FEBFAD8E775AF18EA56FABEA36FA75BBB8D3982187FB22EEE4DD39457DAB2C43645C301C8639E48C63379B58D7B50BED4E0D312C6D859470CABF6C81D9A4DF1EEF2C80E9B4E7F8B9C7F74D685D786C4FA94F796DAA6A363F69DBF6A86D6440939036827729653B401942A70073F28AB9069305BDF5FDDA3CA64BD0824048206D5DA31C7A7AE6A657E5D371FDA30EDF5DD5F5E6B48B47167625AC21BD9E5BC89AE02F9BBB6C6AAAE993F29CB16F4E0E785D33C4F777BA969B653C1023C8D790DD6DC91E640CA32873F74E73C827903B55A3E138628ACBEC1A96A1A7DC5ADB25A0B8B731979625FBAAE1D194E0E483B411938C64D2C9E13B4FB1DA4367797B633DAC8F2C77703832B33963216DEACADB89C9CA9E718C62A9DAFA6DFF0007FCBFAEF3FD7E1FE6559FC41A8BCF3D8DA25AADDBEA86C6DA49958A46A21129775041638DC300AE72391C9AC6F106A3ACB691E22D33555B394DA45692C335AA347E76F94E72ACC76E0A63193EB9E7036350F0D8B3D265FB0AEA17775F6C178248AE234B8493684678CB8D84919CABFCA4330E9815534AF0CDCEA09ABCBAC25F40B7EB047FE932C4D72DE533B6F7F2F31AE4B602AF185CF04F096D6FEB65FD7F5A0FBFF5BBFD3FAEFAF657FABC3E231A5EA86CA68E7B67B8866B68DA331EC60A5183336EFBE0861B7A1F94568EAFA82E93A35EEA2D19916D6079B60382DB4138CF6CE28B8D3925D4535059245B98ADE5823C11B70E54B1E41E7283F5E0D12DA3DCE88F677891DD3CB6E629958ED59495C30240E01E7A0EFD293F87FAF3FD0A5F16A617F6978974FD5B4887537D2E7B4BF924595ADA0923680AC4CE146E76DF9DBF7B0BD3EEF3C409E20D7534AB4F10DC0D3C69570F11FB1242FE7C714AC1031977E1986E04AEC1DC03C64D5D2347D5EE35DD327BD87564834E2EFBF54B8B693AC6C812210F2C3E6C9793E6F9475C9C6CC3E0FB585A287FB42FDF4C8655961D31DA3F223656DCB8213795040214B95181C600AAEBFD7F5FD6FD4957B6BFD7F5FD762E6BBA8DDD9259DB69E90B5EDF4FE444D3E4C71FCACECEC010480A878046491C8EA30EFF00C4BABE8906A76D7AB65777D690437314B044628E54790A1050BB156041E7710723DC5747AB69306AF6A91CB24D0BC5209609E060248641900A921867048C1041048208359C7C256B35A5E45797D7B7971782349AEE631890A21DCAA02A0450093D179C9CF3CD2FEBFAF9FF005D9BFEBFAF41D657FABC3E231A5EA86CA68E7B67B9864B68DA331EC65528C199B77DF0430DBD0FCA2A3D4AFB5D9BC4ABA4E94FA7DBC42CC5C49737503CC41DE54284574CE71D72318EF9E35DF4F89F5687522CFE6C303C0AA08DA55D949CFCB9CFCA3BFAD62EA5A05DEA1E2D1A8437F7BA7AA588856E2D5E324B7984952922B29E3072578EC7AD2FE5F9FEB6FD03A3F97E9FF04CEFED39750D5FC333DDC691DC43777B04E2324AEE8E391495DDCE0EDC81DB38A8744F1A6A7AA5F69F29B499ECAFCAFEE5746BB88DB2952559AE1879720E00380A39C8271CF496FE1BB1B53A698DE726C1E5990B3EE32BC8183BB923924B31E31C9F4E2A2D3BC331E9AEB1C5A9EA2F6118221B09244F2620411B410A1D9402405666038C0E061F5174662699E30BEBAF1059DB196DAF2D2F9A548CDB69F731221556752B72FF00BB9810AC3E50BD723201A6D978BF5282CAEEF35592C0BC16525D3E9AB6D35B5D44506768F309F357B6F014742320D6AD97836DACE6D3D9B54D4EE22D3B22CE09644090A942BB46D4566C2B7058923039EB97C7E1185E4CEA5AA6A5AA42B0C904705E3C7B511C6D6E51159895E32E58FF00C08EEA36DBFAFEBFA652DF5DBFAFEBEC94BC3FE24D52FB588ED2F2092686588C9E6AE8D7766B6EC31846330DAF904F2369CAFDDE78EBEB234DD0E5D389DFADEA97A04663885CBC644438E9B506F3C0F99F71F7E4E75635291AAB39720005DB196F738007E4B4DD8957EA3A8A28A430A28A2800A28A2800A28A2800A28A2800A28A2800A28A2800A28A2800A28A2800A28A2800A28A2800A28A2800A28A2800A28A2800A28A2800A28A2803FFD9000000000000000068696465206465657074683A31303620

使用Python处理转换

import struct

a = open("text.txt","r")#十六进制数据文件
lines = a.read()
res = [lines[i:i+2] for i in range(0,len(lines),2)]

with open("flag.jpg","wb") as f:
	for i in res:
		s = struct.pack('B',int(i,16))
		f.write(s)

flag.jpg

图片高度看起来有问题，加上

深度也可以看成高度，那么就修改flag.jpg的高度为106，原来是40

保存得到如下

第二部分flag

_deep__

接着对flag.jpg尝试steghide

密码不知道，使用脚本尝试爆破密码

#python3运行
from subprocess import *

def foo():
    stegoFile='flag.jpg'#隐写的图片
    extractFile='result.txt'#爆破的密码
    passFile='english.dic'#字典

    errors=['could not extract','steghide --help','Syntax error']
    cmdFormat='steghide extract -sf "%s" -xf "%s" -p "%s"'
    f=open(passFile,'r')

    for line in f.readlines():
        cmd=cmdFormat %(stegoFile,extractFile,line.strip())
        p=Popen(cmd,shell=True,stdout=PIPE,stderr=STDOUT)
        content=str(p.stdout.read(),'gbk')
        for err in errors:
            if err in content:
                break
        else:
            print (content),
            print ('the passphrase is %s' %(line.strip()))
            f.close()
            return

if __name__ == '__main__':
    foo()
    print ('ok')
    pass

得到第三部分flag

doc}

完整flag

flag{real_deep_doc}