GKCTF2021部分wp

Misc

过滤http流量,找到cat /f4g的流量，再追踪http流，可以发现末尾有一串16进制数:

拿到这串十六进制数去解码，在base64解码得到:

我们可以看到这串“==QIhM0QDN0Q”的顺序反了,由此猜测我们要把这串编码全部反着来：

a="wIDIgACIgACIgAyIK0wIjMyIjMyIjMyIjMyIjMyIjMyIjMyIjMyIjMyIjMyIjMyIjMyIjMiCNoQD"
b="jMyIjMyIjMyIjMyIjMyIjMyIjMyIjMyIjMyIjoQDjACIgACIgACIggDM6EDM6AjMgAzMtMDMtEjM"
c="t0SLt0SLt0SLt0SLt0SLt0SLt0SLt0SLt0SLt0SLt0SLt0SLt0SLt0SLt0iCNMyIjMyIjMyIjMyI"
d="6AjMgAzMtMDMtEjMwIjO0eZ62ep5K0wKrQWYwVGdv5EItAiM1Aydl5mK6M6jlfpqnrQDt0SLt0SL"
e="t0SLt0SLt0SLt0SLt0SLt0SLt0SLt0SLt0SLt0SLt0SLt0SLt0SLK0AIdZavo75mlvlCNMTM6EDM"
f="z0yMw0SMyAjM6Q7lpb7lmrQDrsCZhBXZ09mTg0CIyUDI3VmbqozoPW+lqeuCN0SLt0SLt0SLt0SL"
g="sxWZld1V913e7d2ZhFGbsZmZg0lp9iunbW+Wg0lp9iunbW+Wg0lp9iunbW+WK0wMxoTMwoDMyACM"
h="DN0QDN0QDlWazNXMx0Wbf9lRGRDNDN0ard0Rf9VZl1WbwADIdRampDKilvFIdRampDKilvVKpM2Y"
j="==QIhM0QDN0Q"
print(a[::-1])
print(b[::-1])
print(c[::-1])
print(d[::-1])
print(e[::-1])
print(f[::-1])
print(g[::-1])
print(h[::-1])
print(j[::-1])

得到的base64编码再次解码，最后处理一下即可得到flag

分解apng，从中找到四张二维码进行一些操作后扫码得到flag

Excel中发现有部分格子被隐藏了信息 1 ，于是联想到可能是张二维码，将其标注 1 的填充黑色

发现是汉信码，利用工具中国编码APP扫描得到flag