2022CISCN部分wp misc pwn

1.everlasting_night

图片末尾iend后有数据fb3efce4ceac2f5445c7ae17e3e969ab
somd5 https://www.somd5.com/解密获得ohhWh04m1
alpha2通道的的右下角找到

得到f78dcd383f1b574b lsb密码
python lsb.py extract everlasting_night.png 1.txt f78dcd383f1b574b

lsb.py
“””
import sys
import struct
import numpy
import matplotlib.pyplot as plt

from PIL import Image

from crypt import AESCipher

#Decompose a binary file into an array of bits
def decompose(data):
v = []

# Pack file len in 4 bytes
fSize = len(data)
bytes = [ord(b) for b in struct.pack("i", fSize)]

bytes += [ord(b) for b in data]

for b in bytes:
	for i in range(7, -1, -1):
		v.append((b >> i) & 0x1)

return v

#Assemble an array of bits into a binary file
def assemble(v):
bytes = “”

length = len(v)
for idx in range(0, len(v)/8):
	byte = 0
	for i in range(0, 8):
		if (idx*8+i < length):
			byte = (byte<<1) + v[idx*8+i]                
	bytes = bytes + chr(byte)

payload_size = struct.unpack("i", bytes[:4])[0]

return bytes[4: payload_size + 4]

#Set the i-th bit of v to x
def set_bit(n, i, x):
mask = 1 << i
n &= ~mask
if x:
n |= mask
return n

#Embed payload file into LSB bits of an image
def embed(imgFile, payload, password):
# Process source image
img = Image.open(imgFile)
(width, height) = img.size
conv = img.convert(“RGBA”).getdata()
print “[] Input image size: %dx%d pixels." % (width, height)
max_size = widthheight3.0/8/1024 # max payload size
print "[] Usable payload size: %.2f KB.” % (max_size)

f = open(payload, "rb")
data = f.read()
f.close()
print "[+] Payload size: %.3f KB " % (len(data)/1024.0)
	
# Encypt
cipher = AESCipher(password)
data_enc = cipher.encrypt(data)

# Process data from payload file
v = decompose(data_enc)

# Add until multiple of 3
while(len(v)%3):
	v.append(0)

payload_size = len(v)/