buuctf misc page 3

[HBNIS2018]低个头

键盘密码的一种

flag{CTF}

[HBNIS2018]caesar

凯撒加密

flag{flagiscaesar}

[SUCTF2018]single dog

010editor打开图片hex，尾部发现pk字符，另存位zip

解压后打开发现是aaencode

aaencode：http://www.hiencode.com/aaencode.html

我吃三明治

foremost分解出两张图片以为是盲水印，结果在两图的交界处找到base32的字符

[ACTF新生赛2020]NTFS数据流

跟题目名字一样考ntfs文件流

Mysterious

stegsolve打开图片发现bgr有图片，另存

发现图片只有一半，怀疑是修改了高度

import binascii
import struct
import sys

file = input("图片地址：")
fr = open(file,'rb').read()
data = bytearray(fr[0x0c:0x1d])
crc32key = eval('0x'+str(binascii.b2a_hex(fr[0x1d:0x21]))[2:-1])
#原来的代码: crc32key = eval(str(fr[29:33]).replace('\\x','').replace("b'",'0x').replace("'",''))
n = 4095
for w in range(n):
    width = bytearray(struct.pack('>i', w))
    for h in range(n):
        height = bytearray(struct.pack('>i', h))
        for x in range(4):
            data[x+4] = width[x]
            data[x+8] = height[x]
        crc32result = binascii.crc32(data) & 0xffffffff
        if crc32result == crc32key:
            print(width,height)
            newpic = bytearray(fr)
            for x in range(4):
                newpic[x+16] = width[x]
                newpic[x+20] = height[x]
            fw = open(file+'.png','wb')
            fw.write(newpic)
            fw.close
            sys.exit()

得到一个百度网盘的链接，里面有一个压缩包，解压后用查看ntfs文件流，并导出pyc文件

然后用在线pyc反编译工具进行反编译
网站: https://www.toolnb.com/tools/pyc.html

编写decode函数

import base64

def encode():
    flag = '*************'
    ciphertext = []
    for i in range(len(flag)):
        s = chr(i ^ ord(flag[i]))
        if i % 2 == 0:
            s = ord(s) + 10
        else:
            s = ord(s) - 10
        ciphertext.append(str(s))

    return ciphertext[::-1]
def decode(ciphertext):
    flag = ''

    for i in range(len(ciphertext)):
        #
        if i % 2 == 0:
            s = int(ciphertext[i]) - 10
        else:
            s = int(ciphertext[i]) + 10
        # s = s^i
        # flag+=(chr(s))
        print(chr(s^i),end='')
    print(flag)

ciphertext = [
 '96', '65', '93', '123', '91', '97', '22', '93', '70', '102', '94', '132', '46', '112', '64', '97', '88', '80', '82', '137', '90', '109', '99', '112']
decode(ciphertext[::-1])

john-in-the-middle

从scanlines.png其他通道可以找到，然后和logo.png 合并就出来了

弱口令

空格和table转成相应的.和-

a = """    
 
 	  
 	  
					
  	 
			
 	 
  	
		""".split('\n')
for b in a:
    for i in b:
        if ord(i) == 32:
            print(".",end='')
        else:
            print("-",end='')
    print(end=' ')