pythonchallenge(5-9)

pythonchallenge 5：网址：http://www.pythonchallenge.com/pc/def/peak.html

查看页面源代码有提示.peak hell sounds familiar.考察的是标准库pickle的。pickle模块用来实现python对象的序列化,反序列化。构建payload:

import urllib.request as urt
import pickle
url = "http://www.pythonchallenge.com/pc/def/banner.p"
httpnote = urt.urlopen(url)
dataBytes = httpnote.read()
obj = pickle.loads(dataBytes)
for ele in obj:
    s=""
    for i in ele:
        s += i[0]*i[1]
    print(s)

得到结果：

输出：channel,得到下一关的网址：http://www.pythonchallenge.com/pc/def/channel.html

pythonchallenge 6：网址：http://www.pythonchallenge.com/pc/def/channel.html

查看源码，提示是zip文件，直接访问http://www.pythonchallenge.com/pc/def/channel.zip，下载该压缩文件（需要非常大的脑洞）。打开后发现readme.txt，该文件内容：welcome to my zipped list.hint1: start from 90052。hint2: answer is inside the zip，告诉我们答案在zip文件中，且开始在90052，打开90052.txt面提示：Next nothing is 94191，打开94191.txt，提示：Next nothing is 85503。构造payload寻找不一样的文档：

import re
numbers = re.compile("\d+")
numbs='90052'
for i in range(911):
    with open('D:/pythoncode/www.pythonchallenge.com/channel/'+numbs+'.txt',) as f:
        text = f.read()
 #判断网页中是否含有“Next nothing is”，有的话就继续寻找，没有的话就打印出来
    if text.find("Next nothing is") != -1:
    #提取网页中的数字
        numbs = re.findall(numbers,text)
        numbs = numbs[-1]
        print(numbs)
    else:
        print(numbs,text)
        break

输出：46145，Collect the comments.comments，打开46145.txt文档，提示Collect the comments.comments，是指zip文件中的属性,这里考察的就是zipfile模块的知识点。主要考察：ZipInfo.comment：文档说明。
构造payload获取ZipInfo.comment内容，一个一个获取的时候，发现出现空值、*等等，和第五题差不多，就将所有的文档说明合并到一起输出：

import zipfile,re
comments=''
numbers = re.compile("\d+")#纯数字的正则表达式
numbs='90052'#第一个开始的文档标题
zipf = zipfile.ZipFile('D:/pythoncode/www.pythonchallenge.com/channel.zip','r') #这里的第二个参数用r表示是读取zip文件，w或a是创建一个zip文件
for i in range(911):#里面含有911个文件。
    with zipf.open(numbs+'.txt','r') as f:
        text = f.read().decode('utf-8')
 #判断网页中是否含有“Next nothing is”，有的话就继续寻找，没有的话就打印出来
    if text.find("Next nothing is") != -1:
    #提取网页中的数字
        numbs = re.findall(numbers,text)
        numbs = numbs[-1]
        zipInfo = zipf.getinfo(numbs+'.txt').comment.decode('utf-8')
        comments+=zipInfo
    else:
        print(numbs,text)
        break
print(comments)

输入内容：

得到：hockey，得到网址：http://www.pythonchallenge.com/pc/def/hockey.html，打开该网页显示：it’s in the air. look at the letters.鬼知道：hockey==>oxygen。
得到下一关网址：http://www.pythonchallenge.com/pc/def/oxygen.html

pythonchallenge 7：网址：http://www.pythonchallenge.com/pc/def/oxygen.html

打开网页得到如下图片：

图片中间的灰色区域有线索，python图像处理可以使用可以使用PIL库。
**需要注意的是：**PIL(Python Image Library)是python的第三方图像处理库，PIL的功能非常的强大，几乎被认定是Python的官方图像处理库了。由于PIL仅支持到python2.7于是一群志愿者在PIL的基础上创建了兼容的版本，名字叫Pillow，支持最新的python3，而且扩容了很多特性，所以在python3我们可以直接安装Pillow。
python3引入时依然写：from PIL import Image 而不是 from Pillow import Image
将图片保存下来，只要R=G=B，那么就是灰色的，正如图片上显示的那样，可以获取图像的尺寸，先找到纵坐标的区域。对于‘RGB’颜色而言，有三个参数分别代表三种颜色各自的值,使用getpixel（xy）方法得到坐标（x，y）处的像素信息.

from PIL import Image
img = Image.open('D:/pythoncode/www.pythonchallenge.com/oxygen.png', 'r')
print(img.size)#获得尺寸(629, 95)
print(img.mode)#获得图像的像素'RGBA'
LIST1=[]
for i in range(95):#检查纵坐标范围:
    xiangrgb=img.getpixel((0,i))
    if xiangrgb[0]==xiangrgb[1] and xiangrgb[1]==xiangrgb[2] and xiangrgb[0]==xiangrgb[2]:
        LIST1.append(i)

纵坐标R=G=B相等的像素点：[43, 44, 45, 46, 47, 48, 49, 50, 51]，这里也就是说纵坐标在43-51的位置就是图片中的那片区域。随意选择一个坐标即可。
下一步再检查横坐标范围:这里纵坐标选择43：

LIST2=[]
for i in range(629):
    xiangrgb=img.getpixel((i,43))
    if xiangrgb[0]==xiangrgb[1] and xiangrgb[1]==xiangrgb[2] and xiangrgb[0]==xiangrgb[2]:
        LIST2.append(i)

纵坐标R=G=B相等的像素点：[0-607]，横坐标中存在大量的R=G=B的重复值，将每一组中xiangrgb[0]拿出来对比，上一组和下一组不相同的话，最最多出现8次，超过8次就把重复的加进去（第一组出现5次，最后一组出现了8次），就加入列表。

a=0
k=0
LIST3=[]
for i in range(608):
    xiangrgb=img.getpixel((i,43))
    b=xiangrgb[0]
    if a!=b:
        LIST3.append(b)
        a=b
        k=0
    else:
        k+=1
        if k>8:
            LIST3.append(b)
            a=b
            k=0
print(LIST3)

得到如下结果;[115, 109, 97, 114, 116, 32, 103, 117, 121, 44, 32, 121, 111, 117, 32, 109, 97, 100, 101, 32, 105, 116, 46, 32, 116, 104, 101, 32, 110, 101, 120, 116, 32, 108, 101, 118, 101, 108, 32, 105, 115, 32, 91, 49, 48, 53, 44, 32, 49, 49, 48, 44, 32, 49, 49, 54, 44, 32, 49, 48, 49, 44, 32, 49, 48, 51, 44, 32, 49, 49, 52, 44, 32, 49, 48, 53, 44, 32, 49, 49, 54, 44, 32, 49, 50, 49, 93]。一看就是ascii码，转换。

answ=''
for i in LIST3:
    answ+=chr(i)
print(answ)

输出：smart guy, you made it. the next level is [105, 110, 116, 101, 103, 114, 105, 116, 121],告诉你成功了，下一层是[105, 110, 116, 101, 103, 114, 105, 116, 121]。ascii码，转换。

answ=''
LIST3=[105, 110, 116, 101, 103, 114, 105, 116, 121]
for i in LIST3:
    answ+=chr(i)
print(answ)

输出：integrity，得到下一关网址：http://www.pythonchallenge.com/pc/def/integrity.html

pythonchallenge 8：网址：http://www.pythonchallenge.com/pc/def/integrity.html

查看网页发现图中的小蜜蜂可以点击，点击之后进入到一个登陆界面：

查看源码，看到有如下内容：
un: 'BZh91AY&SYA\xaf\x82\r\x00\x00\x01\x01\x80\x02\xc0\x02\x00 \x00!\x9ah3M\x07<]\xc9\x14\xe1BA\x06\xbe\x084'
pw: 'BZh91AY&SY\x94$|\x0e\x00\x00\x00\x81\x00\x03$ \x00!\x9ah3M\x13<]\xc9\x14\xe1BBP\x91\xf08'
BZh91AY&开头考察的知识点就是bz2模块中的一次性的解压缩，构建payload(注意的一点是要将字符串转换为字节):

import bz2
un=b'BZh91AY&SYA\xaf\x82\r\x00\x00\x01\x01\x80\x02\xc0\x02\x00 \x00!\x9ah3M\x07<]\xc9\x14\xe1BA\x06\xbe\x084'
pw=b'BZh91AY&SY\x94$|\x0e\x00\x00\x00\x81\x00\x03$ \x00!\x9ah3M\x13<]\xc9\x14\xe1BBP\x91\xf08'
username = bz2.decompress(un).decode("utf-8")#转化为字符串。
password=bz2.decompress(pw).decode("utf-8")
print(username)
print(password)

输出：huge file，输入密码框，跳转到下一关网址：http://www.pythonchallenge.com/pc/return/good.html

pythonchallenge 9：网址：http://www.pythonchallenge.com/pc/return/good.html

查看网页源码，提示：connect the dots 根据提示连接这些点。继续使用PIL模块中的Image,ImageDraw两种类。

from PIL import Image,ImageDraw
img = Image.open('D:/pythoncode/www.pythonchallenge.com/good.jpg')
first=[146,399,163,403,170,393,169,391,166,386,170,381,170,371,170,355,169,346,167,335,170,329,170,320,170,310,171,301,173,290,178,289,182,287,188,286,190,286,192,291,194,296,195,305,194,307,191,312,190,316,190,321,192,331,193,338,196,341,197,346,199,352,198,360,197,366,197,373,196,380,197,383,196,387,192,389,191,392,190,396,189,400,194,401,201,402,208,403,213,402,216,401,219,397,219,393,216,390,215,385,215,379,213,373,213,365,212,360,210,353,210,347,212,338,213,329,214,319,215,311,215,306,216,296,218,290,221,283,225,282,233,284,238,287,243,290,250,291,255,294,261,293,265,291,271,291,273,289,278,287,279,285,281,280,284,278,284,276,287,277,289,283,291,286,294,291,296,295,299,300,301,304,304,320,305,327,306,332,307,341,306,349,303,354,301,364,301,371,297,375,292,384,291,386,302,393,324,391,333,387,328,375,329,367,329,353,330,341,331,328,336,319,338,310,341,304,341,285,341,278,343,269,344,262,346,259,346,251,349,259,349,264,349,273,349,280,349,288,349,295,349,298,354,293,356,286,354,279,352,268,352,257,351,249,350,234,351,211,352,197,354,185,353,171,351,154,348,147,342,137,339,132,330,122,327,120,314,116,304,117,293,118,284,118,281,122,275,128,265,129,257,131,244,133,239,134,228,136,221,137,214,138,209,135,201,132,192,130,184,131,175,129,170,131,159,134,157,134,160,130,170,125,176,114,176,102,173,103,172,108,171,111,163,115,156,116,149,117,142,116,136,115,129,115,124,115,120,115,115,117,113,120,109,122,102,122,100,121,95,121,89,115,87,110,82,109,84,118,89,123,93,129,100,130,108,132,110,133,110,136,107,138,105,140,95,138,86,141,79,149,77,155,81,162,90,165,97,167,99,171,109,171,107,161,111,156,113,170,115,185,118,208,117,223,121,239,128,251,133,259,136,266,139,276,143,290,148,310,151,332,155,348,156,353,153,366,149,379,147,394,146,399]
second=[156,141,165,135,169,131,176,130,187,134,191,140,191,146,186,150,179,155,175,157,168,157,163,157,159,157,158,164,159,175,159,181,157,191,154,197,153,205,153,210,152,212,147,215,146,218,143,220,132,220,125,217,119,209,116,196,115,185,114,172,114,167,112,161,109,165,107,170,99,171,97,167,89,164,81,162,77,155,81,148,87,140,96,138,105,141,110,136,111,126,113,129,118,117,128,114,137,115,146,114,155,115,158,121,157,128,156,134,157,136,156,136]
#考虑first为X坐标,second为y坐标，但是数组长度不对，因此考虑x,y,x,y....方式，根据提示first+second=?，将两组数据画到一张图上。
new_xycode=first+second
draw = ImageDraw.Draw(img)
draw.line(first, fill='#f00')
draw.line(second, fill='#f00')
img.show()

草里面出现了一头牛，得到的为cow,正确答案为bull(公牛)。
得到下一关网址：http://www.pythonchallenge.com/pc/return/bull.html