CTF论剑场学习——杂项

（https://new.bugku.com/）

头像

（http://123.206.31.85:2018/touxiang.png）
遇到图片题，下意识下载后拖到winhex中分析，搜索文本flag.

---

签到

如题目所示，点开即得flag。

---

0和1的故事

刚开始打开压缩包时，逐步解压得一个flag.txt文件，打开后发现是flag is not here。思考可能是遗漏了什么，然后发现压缩包大小不对，隐藏了文件？


后来查阅资料加上大佬提点发现虽然都是压缩文件，但是格式（后缀）不一样。可以用下面一张图解释。

参考文章https://www.linuxidc.com/Linux/2017-02/140397.htm（这篇比较通俗易懂，较为全面）

所以排除了这个可能性，再去看题目时发现“听说空格和零很配”，考虑是否有空格隐写的可能，再次打开flag{}.txt文件，后面有很多空格。

20是空格表示1，那么09就表示0了，最后转换为16进制字符串就是最后的flag了

---

这个人真的很高

将图片下载后打开，并没有发现什么。
根据题目提示“这个人真的很高”，放入winhex中尝试改变图片的长宽，作为一个小白，这时候就要想改哪里，怎么改，改多少？（白一下参考了以下文章https://blog.csdn.net/CliffordR/article/details/81123232）
先查看图片的具体数据

然后决定把高更改成740，先搜索一个进制在线转换器，输入680，转换成16进制是280，在winhex中搜索0280。

锁定位置后，再搜索740所对应的16进制值，是2e4，将0280改成02E4，另存为XX。再打开更改后的图片

栅栏密码解密，再根据英文字义调整顺序

---

easypdf

下载之后解压，如果用网页或者文档等形式查看pdf是不能做任何移动的，下载了一个pdf编辑器，利用编辑器打开pdf之后，发现左上角还有一个框

将图片移动开，发现flag。

根据题目提示改成小写就好了。

---

损坏的图片

CTF中UE、winhex打开文件里面的各类文件头：https://blog.csdn.net/qq_39030256/article/details/83009354
文件解压之后得到两张损坏的图片，先拖到winhex中分析一下

看到最后一行
当它反过来，变成89 50 4E 47时，发现是png图片的文件头，猜测：是正常格式反过来了。

import re
str1 = "826042AE444E454900000000B202663A259009D007FD7A4A012179C8F76403B7F0077E803BF761A9D5EDDDCC1600EFDBE242F0BA6E9F02C8F96935D3B7D90006800D5E927EC87043E920844E631AD4F9588003421A141930626DC77008FD5E927EC87043E920844E631AD4F9588011FA10D108C9831041EDC01BDE7B43FC4213B5800D05BFB8037BB0D4F973BA1A4E00DEDF1397C9C08978164C792F0D2C01BD3191B7CF7346B0077D2D42BF06697F89A735800DCE25B9AD7C933610B0E7F1B0D4F973BA1A4E0036F89CBE4E044BC0B263C9AC6960034C641AB779909012FC57A42E109443E93383740F7C4EAB5C75CEC13F2671210E725758C0CBD19FFEB23D7C71FC64A26FBEC78FD700A7FA6F800D001BE8C80034F883D0E5C4DF24F749BE1140F2737FFFABBAEF96403A7F001BE8C80034E1ABE2C7D26E8638217097C26E94EBA4A0B24DFF7475C2190D76FE8C9012FD386AF8B1F49BA18E085C25F09BA532E1282C86AA67045E90B843196381B81AC014FE56E96BE49EF34EEF84DD2C107530A07C7606C42D3B3506D0E2000D2E24E085C25F086A93826259300941644B92E003449900068C24FA45EA79E397127042E12F843549C1312C90D250593AFA8E517012FA378932000D1849F48BD483321C10B84BE1374A72CD635533822F497C260CB1AA9BCC42027891E9397E39F11B87986127D22F520CC87042E12F84DD29841D635533822F487C2043586167986008FBB61F6A70218E09BA5AAF25F520B34B5941A9F930B001A71265C2033240863826E96ABC97D482CB84C0B228353F261600DE9C4997165D0C704DD12E0E41893E4B19F2C80727C01BD006F43ED4E0431C1374B55E4BEA416696B28353F261600DE9C4997080CC9DA18E09BA58D5BB3D106138164384AF5610B2043596983C01BD0FB53810C704DD2D5792FA9059A5ACA0D4FC985800D38932E1019920431C1374B55E4BEA4165C26059381A9F930B001A483307DA9C0863826E96ABC97D482CD2D6506A7E4C2C01BD38932E107A3C734D6863826E963BF57BE8AE3036A4A79A4812DCAF9924006F401BD006F401BD006F534437963821F56BE24D56BF88304CE257A41A9FC99709CD2A73D2403B7F006F401BD006F401BD006F534437963821F56BE24D56BE1019933895EC9A6961825F06849FD06125C21F126A47C921A4911A48973F7006F401BD006F401BD4D10DE58E087D5AF89355AF8418267129A26EA87D4A696384AF49B0C9855E83097A921CC98B81E0034D46BC390F9BC0006800D001A9A21BCB1C10FAB5F126AB161C8304384D0590D2C80707C006800D4D10DE58E087D5AF89BC3AD7C58E12BD58561CFA31709C0C658B5BE99DC006EB36EF9F267A497089A4EC9648A5B774164FA793C006EB36EF9F267A497089A4EC9648A5B774164FA793C006EB36EF9F267A497089A4EC9648A5B774164FA793C006EB36EF9F267A497089A4EC9648A5B774164FA793C006EB36EF9F267A497089A4EC9648A5B774164FA793C006EB36EF9F267A497089A4EC9648A5B774164FA793C006EB36EF9F267A497089A4EC9648A5B774164FA793C006EB36EF9F267A497089A4EEE4914B6EE82C86A169710006AE88F7727CF933D24B844D2766A9CE10F8DDBA90B9418497087169E7D1E64E10800251C499716354AF485875988408392804A7EBDA401BD006F4E24CB84D6643792BD593527BA58B892C3C9F45A682C8B174609F94F001A0034FA962106093074DE1C86A1F67390006800D8BB1E00EFD3EA5884182625A540E4E7A7F5ED200340069C4997163E257AB725918841823E58DEB7A7001A0034F8413B219DC99AB5A1C4001A30934B23B5A421C9F333B800D38939664D664356B438800346127D236927C21BC479A4F9F4B992F3298047E271265C58F895EAC3039F525C20C11FE49F087044717E8309BE1334938934D1272C8EB5740E9845801DF4EE9DB54ABFD0E127FD7DE9CD256127C21AD2B841818F892C3920847CB5B6F07A1CD600EFD43920035FA93E11AF9BFD22E30328319D62FC750023F57AB73F7EDF246063818DE5819ACFD4A6B4C606BC38CD49A41A56217A2DCC00340E9FC023F7D8D7181852C6756BF2D4008FDDD559A20C0C7094D117A4238FD061339647049F080A27A24460650636DF10E6D600371E2033273F1E8724006B824F840513D1223032831B6F88736B008FD13B5889B5800D5D97DE7FB1AE3030A58CEAD7E5A80035F07A6F923031C0C6F2C0CD67EA5A8687A5860614B18F4B08591D53BD094C0EBFD3BAE31818E065E90B84E7EFFEF4E692FD49F0888E61818F8950642D87609FA9A2B37F2910137F15EACB03268F20023F496F200DE8037A8764023F7EF497C97EA4F8B0D3A1F54D7A9849FAD612430BED964800681DA7001A0034006AF565819365B6E0034557F25BC8037A00DEA1D90077EFDE92F92FD49F16A5A87D535EA420EB60C41807B1318006AC0E2F09B4EA078AFD59F4E00340069BCB5F22BFC96B05E37A0D3D0591D6FF97BA000D001ABD5B79907B48E697547F6A8A07CEF9F54D7A958B5B06222D9DC0069BCB5F22BFCFDFFDE92F92FD49F16351C6087D19871FC8BD4F688C38FEB73E3BC9A9809BF29A49E03E17C006800D001BCFC2F929D20034006800D692780F85F001A0034006F3F0BE4A74800D001A0035A49E03E17C006800D001BCFC2F929D20034006800D6D2780F95F3EA9CC1D4EE0E40383E0034006F3F2BE3C49F54CF893821BC42E12F842C3A98C5ACF964BA677001BCFCAF8F127D5337927045E90B84BE2D9C18D487047989CF1EE64970800F7E1191A809BF28F84DD11D52B14BE139F41E24FA317C4384AF485C21A5AC341941939E07A7240069F09BA23AA56297C273E83C49F462F887095E90B8434B58683283273C0F4E4800D3E13744754AC52F84E7D07893E8C5F10E12BD21708696B0D065064E781E9C9001A7C26E88EA958A5F09CFA0F127D18BE21C257A42E10D2D61A0CA0C9CF03D3920034F84DD11D52B14BE139F41E24FA317C4384AF485C21A5AC341941939E07A7240069F09BA23AA56297C273E83C49F462F887095E90B8434B58683283273C0F4E4800D3E13744754AC52F84E7D07893E8C5F10E12BD21708696B55F7FF805A8321C05913580069F09BA22F56BE139EB1F529A217C4384AF5634B58F844D0DCF98612F30C7046A9BF01910410BFB19F09BA23AA56297C273E83C49F462E113495E90B8B6E88FD18DE273E61849F482CD270B1B488D2446053F00176E2E8003BF75EC60077E803BF534B17CB17062C3ADEAB7BED9FA2D635B394590006800D38409D905844E6435F9E24C800346125C20A5A42193065936DB8053FD38409D905844E6435F9E24C9012FD18497087C48E89612B043232CCF51A000362E8000DD7B18006800D4D2C5F2C5C18B0EB3906E8B58613FAF63000D001A9A58BE58B83161D64BD7FE6A5FA2D6E7A5ECED20034006A6962F96BE2775266A31C10F843525F0870458B217085872085A70659899DC006A6962F962E2775267095EAC7C20C0F7F0CB1ABF8361AFC6125C21F1210E4E41938432046FEDDE002BF3E8C5C21BC31F08FF12E0F27725334B933806E2E580069F464D10DE18E24F74470392E4A669726700DC5CB000D3E8C5C21BC31F08FF12E0F27725334B933806E2E580069F464D10DE18E24F74470392E4A669726700DC5CB000D3E8C5C21BC31F08FF12E0F27725334B933806E2E580069F464D10DE18E24F74470392E4A669726700DC5CB000D3E8C5C21BC31F08FF12E0F27525334B9338C5F272C00346073E8C9A23AA3DB543893DD135993EFA572AC19C99AD5AE887171DF8421916E0F3FCADD10E089CE83094D0C70B17164D10F89A92CB174184961C930D26B93D2E2000DDD10E089CE83094D0C70B17164D10F89A92CB174184961C930D26B93D2E2000DDD10E089CE83094D0C70B17164D10F89A92CB174184961C930D26B93D2E2000DDD10E089CE83094D0C70B17164D10F89A92CB174184961C930D26B93D2E2000DDD10E089CE83094D0C70B17164D10F89A92CB174184961C930D26B93D2E2000DDD10E089CE83094D0C70B17164D10F89A92CB174184961C930D26B93D2E2000DDD10E089CE83094D0C70B17164D10F89A92CB174184961C930D26B93D2E2000D3F887044E74184A686E7E98F529A21F12EA9CE5162E8309BE13389351CBE21714CC6270353352101002FFF8EE887044E74184A6863858B8B26887C4D2C3F6827089FD0612EF133890013E0B2E32568E953E7E59C0A401BD006F401BD006F4DEC5FC9754873A0C10F8330B706E9BF81818E127C25F09CFA0C24FA42E24E085C25F08BD49F168E922C491AA564C1BB8037A00DE8037A00DE9BCD5B5AC3043E0C0CE4F2EB930E9B8047EE0CD1C1DE4E58006A5E37ED3A5DA842B3AFFE00034006800D4E6D3AA5F2CF4001AB16D01D3F800D001A6F35CFA6B348C10F83033934D1374158B96FD8697CB060CD6ADB7001A6F62FE4BAA439D06087C1862EFC1C9781818E127C25F09CFA0C24FA4DD24E085C25F099329F889842404DFA9A6B05C4F3E9FF253443E25F0685C534D1374A6EA9481A1F4930753BE1282DBBC01DF69E00EFD0077E9F462E1134346A9B0D34129DB2D5D468000D2D3C0006800D001A314CD0C7D58DE4CC1D65E8D4172636DC80707C01DFA00EFDB9A4CFAB470A99AAB7B5C90006800D001A0034FA31709307189048E87201CFFC006800D001A7D18B844D0DBA5B9E43EA712D6754861E8F9640393E00340069F462E12C6B85612BFB989B0D2971DC0069C113CEB0335839A726F1E0034FA317089A1B74B40C9DE1167CB2404EFF13E8E5F299F563794CE14F79AC353FA1F462E113436E96BAAE9DE5E3FCB12D4191032FF480089EEE8B800D9CB465F1765B4B001A00371E435F7FEEE8B800D9CB465F1765B4B001A00371E41234B001B3968E7C99F525C5B29A70A64F1EDB8037B8F202F9FEBED38037B396818D3D9D8C00DE8037A9A26E963518E087C22B320335939912EFB8047E8C10FA95A134448E94E5E13C1897815BFA71E47BC96003672D1CF29F1F69001A0035344DE6B1C257AB1F099C590F37F04E5A39F267D4971658B484393AA677001A9A26E963F94CF84DD49A73273E4CFA92E2CB09E6CFD06087D4AF49A221CC93ED344A600F7F14D1374B43CA67C26EA4CBE21AB763C266927C1B74479A4E0649AC998C4006ED1F46BE133832F489A58B841822F468E91F2C93964A5E39589C01BD001B30718D44E4124006F401BD006F4FA35F099C1939C99BC41822F464D498C0E7A18B8A720C8CB0F56703989B303C006CC1C67586C9E80034006800D3E8D7C2670635A0C10FA92E10608BD4D0591D0E47CB201C9F001A0034FA35F099C1939C9B7C41822F464D49BA899C5D1419306255307800D3E8D7C2670635A0C10FA96210608F969A0B21A87FEEC80034006AF487A1CFA35F099C197A44D2CFF10608BD1934B1A5939F27B0D2A0C8C4CEE0034DE93BE13389C7A8676A66F10608BD1935263039E862E277930DC222163F9302AFD8EF927CF5819A4E163EACBD532E49CD12A0E4DA985800DBE49F3D606693858FAB2F54CB927344A83936A6160036F927CF5819A4E163EACBD532E49CD12A0E4DA985800DBE49F3D606693858FAB2F54CB927344A83936A6160036F927CF5819A4E163EACBD532E49CD12A0E4DA985800DBE49F3D606693858FAB2F54CB927344A8393D50F9B373800DBE49CDEE73A7D7385934B4B3186DB80D2E8E4EEB800D355B084C0ADFE37C9318227318E163EADBA532E37784358E065EAD8421AAC6423069FE937B417094424B353E7E5C6C9001B20D1D09506435EBEEC4001A6F682E12884966A7CFCB8D92003641A3A12A0C86BD7DD89012FD37B417094424B353E7E5C6C9006F641A3C12A0C86A17B71001BD3788FF11EEC92CE2BF90397C349DB7001A978DC04973E93A2D4DD52E4774008FD008FD1E2519B8520D1A095064758BFD3A0047EAF485C25F16CE0DBAA1706BE2CFF0D9AA1F46BE29F5F7F94A2CFA438B1A6191D62D0EA0037B5C49706BE2CB094E64E7D3FE488592369B800DC221D527174809BF18DED1BCC8F767D800D1E24FA35F08BD4A8326DFFFC3AD67D23FED697FFF8E3FC221D530350029FCA5E90B84BE2D9C1B9FBFAE24B830F478E632C24F84E7EFCF9A4BE535071DF8188EA9C9A800DDABE377EE86E7D06137C21AA4F845EAC9CC97A21709BA4EDD6AFA268F932719242085FE1F3F006F401BD006F401BDBE377EE86E7D06137C21AA4F845EAD7C266885C27C4A988591D46E69A424FC1BC00681CFFC01BD006F401BDBE377EE86E7D06137C21AA4F845EAD7C227590B84F8953C1898F1DC023F4287EB1AFDC0E2000D1677D97800D001B7C6EF503B778C113437BD79A72C67547C05D0B23E060036F8DDFBA1B9F4184DF086A93E117AB27325E885C26E93B75ABA074E14998C4408DFD26ADD7F7C6EFDD0DCFA0C26F843549F08BD5A82C99A21709BA4ED7A328A4D41AD0137F135932E10608BD1AFE226962F887127816375EBFB5A2FA2C80727C023F616C800DEDF137F3767C4A69BB089F92F89DA689F129DB54AC733F7006F401BD006F401BD359396641820DB725F137F3767C4A69BB069F92F89DA8327C4A76B620F001AE6DD2001A0034006BAA99F28304DD0C987A654FC83035E1C6C4B201C1F001A0034D64CB841822F46BF885C58BE21C299716E0631C138191AF1F61A76E3B800D3593966418267120CC7BE26FE6ECF894D3762164BE2769A27034ED44B6055FC4D64CB84BE11FE532E2D1CC870A65C5B9E4BE24E163EAD9CD2704E06458B230D7130E1BFC7008FE7F16C029EF84ABD4ECB059C10FA42E13A2C62C3ADE4C2C0069C577D7AB5F09CF58B893821F485C24D133072161D6FF82C01BD3EEDE6E53006F61E98E087D21709D163161D603B9801BDC5B00A7BE12AF53B2C167043E90B84E8B18B0EB5930B006F4FB55F2E29DF08B08F87A63821F485C27458C587580EE6001B8B6014F7C255EA76582CE087D21709D163161D614B0B001A0727F16C029EF84ABD4ECB059C10FA42E13A2C62C3AC2761600340EDFF56C439EF849BDCEC775CE087D21709D163161D6FC7D7001A3F18CEF9F46BE10D464D10E087D2170808C62788B22F9195BBE4D30871F927E00DF3BE00DE8037A00DEE361C96CBC01DFA00EFDB9AEA74D65E7C24BC006800D001A0037C097C59F278053FC0006800D001ACB93E84F0006F63854C0E0F8037A00DEE361C96CBC006800DB83A981CCBC006800DE4BFB800DE4B48047C2C006959C7B001B8F24B0F9DFB83A9EA8F7B839C01BC658E7DDB1EF4D477B30BEB1713B38539E920D4FC8703DE732B0037A00DE8037A00DEA689CF5B7495EC99BCB17087C4EEA4CD485C20C117A35F087044D11EA490F231F4FE4D127EF012FD006F401BD006F65991D6E7A5D4006F46085C4DF09C96B2F5210759F2C80727C01BD006F4FA31708B4235B590D2C80707C01BD006F65991D6E7A5D4001A3042E24D485C20C117A97F895C21C10D2D675AB38BA60CB55307800D3E8C5C26706351C6085C49A90B841822F53416448647989A71DC006A6886A33FC45EC99E873E8C5C267063823FC435217083045E8D7C23CCB6888703289600128F84DE64C7961821F064D3766B263C20C24FA49869F0260C4226160034F84DE64C7961821F064D3766B263C20C24FA49869F0260C4226160034F84DE64C7961821F064D3766B263C20C24FA49869F0260C4226160034F84DE64C7961821F064D3766B263C20C24FA49869F0260C4226160034F84DE64C7961821F064D3766B263C20C24FA49869F0260C4226160034F84DE64C7961821F064D3766B263C20C24FA49869F0260C4226160034F84DE64C7961821F064D3766B263C20C24FA49869F0260C4226160034F84DE64C7961821F064D3766B263C20C24FA49869F0260C422616011FA7C21BC4C7961821F064D4980090D64C784184961C6CC640077FDBC01DFBA7113557A93E2C696458B5842C8C32FAD287C5E0036AF0FB7585B81C8514FE0001A00376E2000D4D13744CE11349DDE3A1F525875358B201C1F008FDDB88011FA7C24B359A8567F93BD3F6B001A9D646A9FFE0011FA011FAC4C89ABBA4ECE089A266881074ECB84C4B1A82D60393E0034006970619124191D0E3003BE17B71001BD3E1259AC9CD6D3BEE0034B8367087D22F46C4B21A3A0C2562C60393E003589913557A958BA1706E78E3093E902895064C4B20730B006F539D2FE49AFDD89913557A92C9FD0B8367087D22F46E064665061210C6C56B96353800D384961D6ABD4FEB059F4FCA78037A8364001BBCE85C487DC99C26F8B73C9BA4AF64F96BCC9D3F4CD13F132644C2C00683329EDD616A04FE90037A00DEEDC4006F535277F2C709BE2DCF26E92BD93BE2C9A22713C0E4D9941848431B15AE58D4E0034E137C5AAF53FAC167D3FA041D20707C01BDDB8800DEA6A4EFE58E137C5B9E4DD257B277C593443E2781C9BC591E621CD83C00697121F726709379635197A4503CC7D4885AD344F0393353BEDC4001AD4342E27344BF96DD24B0F317D56BD93BE2C9A23AD5AC517A4487490692E13849D8037293531E861826E926F10D4733B217D56BD93BE2C9A23AD5AC517A424741849708A074CC8710B53008FE2F5386008FD58A1F082B50FAA7896360C4D382C006A688EA31F292CD4FBB47786C1BAE00DEE0C44E61600DEA7321AFAF4B8800363AC91C3FFA400DE8037AA70C00DEAC50F8415A87D5334B1B06269C1600DEA7323AA3F7943E499AC7CCE3D4BBC31AA4E087C2475913526BD1B0B3F49438D396403AFF006F54E1801BD58A1F082B50FAA7896360C4D382C006A688EA31F292CD4FBB47786C1BAE00370627FC1600353990636EA70C00356287C273F7EA1693EA9AF46C1889A5B4515F006F14D10D539C21F24D3442E1139ACEA8F58A1F086A3DFC43EA9AF54D34B1A593619042D3B006F1600DE8C26F843549F08BD5AF84191302C8696A634C2C01BD354ED7445EAC9A25FCB73C89A4AF56BE49E25A682D6E4B580E4F8037A00DE8C26F843549F08BD5AF84191302C8696A634C2C0069AA767C22F564D10E097C273C89A4AF56BE1250EB0513416B1A9DD06C800350EC7800D184DF086A93E117AB5F0832260590D2D4C6985800D354ECF845EAC9A273C7184DF086A93E117AB5F0832260590D2D4C8985800DE7B769A4AF564D12FE58D52FF117AB5F24CD2D4C5A410B22F62F59261A73B06C71893DD0CBD59344BF9631865EAD7C937388C7E3F1FE48E9FCFDFF66F9FF3F3FCFF3FC7E49E292E0B20020D9B5E6364AA2BAEEDC24B1C6CCDD9D3D9D1FFFF27430E491B76D19DED5E7854414449031A000066A8725C00000006080001000000010000524448490D0000000A1A0A0D474E5089"
str1 = re.sub(r"(?<=\w)(?=(?:\w\w)+$)"," ",str1)
list1 = str1.split()
list1 = list(reversed(list1))
str1 = " ".join(list1)
print(str1)

我是直接用记事本编写后再改后缀，打开命令提示符后输入python再将文件直接拖入即可

看到损坏图片的大小是6.6KB,新建了一个文件，把跑出来的数据粘贴到文件里去
编辑–剪贴板数据–粘贴–ASCII Hex（别选错），将图片另存，打开，得到一个二维码。

感觉有点奇怪，第二张图还没用就得到了flag.

---

怀疑人生

哈哈哈，ctf真的搞得我天天怀疑人生，下载文件，解压。

第一个是加密的压缩包，第三个是高糊的二维码，第二个暗藏玄机。。。。。
第三个二维码利用网站扫https://online-barcode-reader.inliteresearch.com/

第一个压缩包，看大佬的writeup说跑一遍字典，得出密码是password。。。不是很懂，用foremost也出现了问题，