CTFMisc题思路
一.png图片格式
工具：010editor/风二西工具集.png宽高一把梭
1.头疼（修改文件头）
插入一行
89 50 4E 47 0D 0A 1A 0A
2.腰疼（修改图片高度）
3.又是哪里疼（修改图片宽度）
png的高度可以随便改，宽度更改则必须要满足crc32校验
python3代码
点击查看代码
import struct
import binascii
import os
crcbp=open("D:/网安/1.3-1.5/png/又是哪里疼.png",'rb').read()
for i in range(2000):
for j in range(2000):
data = crcbp[12:16] + \
struct.pack('>i', i)+struct.pack('>i', j)+crcbp[24:29]
crc32 = binascii.crc32(data) & 0xffffffff
if(crc32 == 0x50f7ad7e):
print(i, j)
print('hex:', hex(i), hex(j))
二.easy_rsa
e = 7
n = 1435403654103404978696814257675667163132255918183901643219314998304799183551454917297869043270982512865462818683917550512267117998373317971936669506124512425439960633391770814593051549225238334360749080244377797929129212087115270230555105361176280334950340730578342000490375752376652686116815057440700177115957079805080405946068320818872407870081331445694726396735365098330900351579087914442555297994417226123063703029237031061987335261314559888591762965622914381119950123706548490254387568158833211271099570835744069935018218631103744045777998454960387291214901116338261932321001785694483080711990075302679095117228739558918120079
c = 1249323822661831961722660777834601379491608479182422496192972071802343230655007104763345550270239924547073505335783691102066796391089203918112469354137584386637771152622375812751706465760512005771412733333171898324446461501416393873597334774675013089104083501844461114058502658166706552770255716733846871452808122942135915733704748079534991630193007339549925197393909646534812886639152125308102980918069303609582209115771410656373236482254363216264607894882819375189570048361950012863164492421019247096246436938795731510161989588771966479260315862206288485335068985084520135354124936165655792776462199885278116104081238844751497676
对照rsa题型，n很大，难以分解，注意到e比较小，可能是低加密指数攻击题型，python3代码：
点击查看代码
import gmpy2
import binascii
e = 7
n = 1435403654103404978696814257675667163132255918183901643219314998304799183551454917297869043270982512865462818683917550512267117998373317971936669506124512425439960633391770814593051549225238334360749080244377797929129212087115270230555105361176280334950340730578342000490375752376652686116815057440700177115957079805080405946068320818872407870081331445694726396735365098330900351579087914442555297994417226123063703029237031061987335261314559888591762965622914381119950123706548490254387568158833211271099570835744069935018218631103744045777998454960387291214901116338261932321001785694483080711990075302679095117228739558918120079
c = 1249323822661831961722660777834601379491608479182422496192972071802343230655007104763345550270239924547073505335783691102066796391089203918112469354137584386637771152622375812751706465760512005771412733333171898324446461501416393873597334774675013089104083501844461114058502658166706552770255716733846871452808122942135915733704748079534991630193007339549925197393909646534812886639152125308102980918069303609582209115771410656373236482254363216264607894882819375189570048361950012863164492421019247096246436938795731510161989588771966479260315862206288485335068985084520135354124936165655792776462199885278116104081238844751497676
i = 0
while True:
if gmpy2.iroot((c+i*n),e)[1] == True:
m = gmpy2.iroot((c+i*n),e)[0]
break
i += 1
print(binascii.unhexlify(hex(m)[2:]))
三.签到题misc
附件是pcapng格式，用wireshark打开，找到后半段蓝紫底色的FTP包，追踪TCP流，可看到flag提示，在1235行，于是在1236行可找到flag（题目提示说是一串md5值）
da9c88338b94d73484dea888276b59f3
四.签到题crypto
Li4uLi0gLS4uIC4uLi4uIC4tIC4uLi4uIC0tLi4uIC4uLi4tIC0tLi4uIC4uLi4tIC4uLi0tIC4uLi4uIC4tIC4uLi0tIC4uLi0tIC4uLi0tIC4uLi0tIC4uLi4tIC0tLi4uIC4uLi4tIC0uLiAuLi4uLiAtLS0tLiAuLi4uLiAtLS4uLiAuLi4uLSAuLi4tLSAuLi4uLSAtLi4gLi4uLi0gLi0gLi4uLi4gLS0tLS4gLi4uLi0gLS4uIC4uLi4tIC0uLi4uIC4uLi4uIC4uLi0tIC4uLi4tIC0tLi4uIC4uLi4tIC0tLS0uIC4uLi4tIC0uLiAuLi4uLSAuLi0tLSAuLi4uLiAuLi4uLSAuLi4uLSAtLS4uLiAuLi4uLSAuLi4uLiAuLi4tLSAuLi4uLSAuLi4uLiAuLi4uLSAuLi4uLSAtLi4gLi4uLi4gLi0gLi4uLi0gLi4tLS0gLi4uLi4gLi0gLi4uLi0gLS0uLi4gLi4uLi0gLS0tLS4gLi4uLS0gLi4uLi0gLi4uLi4gLi4uLi0gLi4uLi0gLi4tLiAuLi4uLSAtLi4gLi4uLi0gLS4tLiAuLi4uLSAuLi4uLiAuLi4uLSAtLS4uLiAuLi4uLSAuLS0tLSAuLi4tLSAuLi0tLSAuLi4uLSAuLi4uLSAuLi4uLSAtLS0tLiAuLi4uLiAtLS0tLiAuLi4uLSAuLSAuLi4uLiAuLS0tLSAuLi4uLSAtLS0uLiAuLi4uLSAuLS0tLSAuLi4uLiAuLSAuLi4uLiAuLi4uLSAuLi4uLSAuLi0uIC4uLi4tIC4gLi4uLi4gLi0gLi4uLi4gLS0tLi4gLi4uLi0gLS4uIC4uLi4tIC4uLi4uIC4uLi0tIC4uLi0tIC4uLi4tIC0tLS4uIC4uLi0tIC4uLS0tIC4uLi0tIC0uLiAuLi4tLSAtLi4gLi4uLS0gLS4u
base64解码：
....- -.. ..... .- ..... --... ....- --... ....- ...-- ..... .- ...-- ...-- ...-- ...-- ....- --... ....- -.. ..... ----. ..... --... ....- ...-- ....- -.. ....- .- ..... ----. ....- -.. ....- -.... ..... ...-- ....- --... ....- ----. ....- -.. ....- ..--- ..... ....- ....- --... ....- ..... ...-- ....- ..... ....- ....- -.. ..... .- ....- ..--- ..... .- ....- --... ....- ----. ...-- ....- ..... ....- ....- ..-. ....- -.. ....- -.-. ....- ..... ....- --... ....- .---- ...-- ..--- ....- ....- ....- ----. ..... ----. ....- .- ..... .---- ....- ---.. ....- .---- ..... .- ..... ....- ....- ..-. ....- . ..... .- ..... ---.. ....- -.. ....- ..... ...-- ...-- ....- ---.. ...-- ..--- ...-- -.. ...-- -.. ...-- -..
摩斯密码解码：
4D5A5747435A3333474D5957434D4A594D465347494D4254474534544D5A425A474934544F4D4C454741324449594A5148415A544F4E5A584D453348323D3D3D
十六进制解码：
MZWGCZ33GMYWCMJYMFSGIMBTGE4TMZBZGI4TOMLEGA2DIYJQHAZTONZXME3H2===
有=补齐，base类型解码，但base64解码是乱码，猜想是base32:
flag{31a18add03196d92971d044a083777a6}
五.数字水印分析
附件为一张图，010editor打开发现有flag.txt字样，用kali，binwalk分析
foremost分离文件，得到两张“一样”的图，和一个flag加密txt，猜想里面就是flag，对两张图进行处理，这里用的是github上的代码，由于源码是python2，我用的python3，做了小范围修改：
点击查看代码
#!/usr/bin/env python
# -*- coding: utf8 -*-
import sys
import random
import cv2
import numpy as np
import matplotlib.pyplot as plt
cmd = None
debug = False
seed = 20160930
oldseed = False
alpha = 3.0
def bgr_to_rgb(img):
b, g, r = cv2.split(img)
return cv2.merge([r, g, b])
if __name__ == '__main__':
if '-h' in sys.argv or '--help' in sys.argv or len(sys.argv) < 2:
print('Usage: python bwm.py <cmd> [arg...] [opts...]')
print(' cmds:')
print(' encode <image> <watermark> <image(encoded)>')
print(' image + watermark -> image(encoded)')
print(' decode <image> <image(encoded)> <watermark>')
print(' image + image(encoded) -> watermark')
print(' opts:')
print(' --debug, Show debug')
print(' --seed <int>, Manual setting random seed (default is 20160930)')
print(' --oldseed Use python2 random algorithm.')
print(' --alpha <float>, Manual setting alpha (default is 3.0)')
sys.exit(1)
cmd = sys.argv[1]
if cmd != 'encode' and cmd != 'decode':
print('Wrong cmd %s' % cmd)
sys.exit(1)
if '--debug' in sys.argv:
debug = True
del sys.argv[sys.argv.index('--debug')]
if '--seed' in sys.argv:
p = sys.argv.index('--seed')
if len(sys.argv) <= p + 1:
print('Missing <int> for --seed')
sys.exit(1)
seed = int(sys.argv[p + 1])
del sys.argv[p + 1]
del sys.argv[p]
if '--oldseed' in sys.argv:
oldseed = True
del sys.argv[sys.argv.index('--oldseed')]
if '--alpha' in sys.argv:
p = sys.argv.index('--alpha')
if len(sys.argv) <= p + 1:
print('Missing <float> for --alpha')
sys.exit(1)
alpha = float(sys.argv[p + 1])
del sys.argv[p + 1]
del sys.argv[p]
if len(sys.argv) < 5:
print('Missing arg...')
sys.exit(1)
fn1 = sys.argv[2]
fn2 = sys.argv[3]
fn3 = sys.argv[4]
if oldseed:
random.seed(seed, version=1)
rng = random.Random()
else:
rng = random.Random(seed)
if cmd == 'encode':
print('image<%s> + watermark<%s> -> image(encoded)<%s>' % (fn1, fn2, fn3))
img = cv2.imread(fn1)
wm = cv2.imread(fn2)
if debug:
plt.subplot(231), plt.imshow(bgr_to_rgb(img)), plt.title('image')
plt.xticks([]), plt.yticks([])
plt.subplot(234), plt.imshow(bgr_to_rgb(wm)), plt.title('watermark')
plt.xticks([]), plt.yticks([])
h, w = img.shape[0], img.shape[1]
hwm = np.zeros((int(h * 0.5), w, img.shape[2]))
assert hwm.shape[0] > wm.shape[0]
assert hwm.shape[1] > wm.shape[1]
hwm2 = np.copy(hwm)
for i in range(wm.shape[0]):
for j in range(wm.shape[1]):
hwm2[i][j] = wm[i][j]
m, n = list(range(hwm.shape[0])), list(range(hwm.shape[1]))
rng.shuffle(m)
rng.shuffle(n)
for i in range(hwm.shape[0]):
for j in range(hwm.shape[1]):
hwm[i][j] = hwm2[m[i]][n[j]]
rwm = np.zeros(img.shape)
for i in range(hwm.shape[0]):
for j in range(hwm.shape[1]):
rwm[i][j] = hwm[i][j]
rwm[rwm.shape[0] - i - 1][rwm.shape[1] - j - 1] = hwm[i][j]
if debug:
plt.subplot(235), plt.imshow(bgr_to_rgb(rwm)), \
plt.title('encrypted(watermark)')
plt.xticks([]), plt.yticks([])
f1 = np.fft.fft2(img)
f2 = f1 + alpha * rwm
_img = np.fft.ifft2(f2)
if debug:
plt.subplot(232), plt.imshow(bgr_to_rgb(np.real(f1))), \
plt.title('fft(image)')
plt.xticks([]), plt.yticks([])
img_wm = np.real(_img)
assert cv2.imwrite(fn3, img_wm, [int(cv2.IMWRITE_JPEG_QUALITY), 100])
img_wm2 = cv2.imread(fn3)
sum = 0
for i in range(img_wm.shape[0]):
for j in range(img_wm.shape[1]):
for k in range(img_wm.shape[2]):
sum += np.power(img_wm[i][j][k] - img_wm2[i][j][k], 2)
miss = np.sqrt(sum) / (img_wm.shape[0] * img_wm.shape[1] * img_wm.shape[2]) * 100
print('Miss %s%% in save' % miss)
if debug:
plt.subplot(233), plt.imshow(bgr_to_rgb(np.uint8(img_wm))), \
plt.title('image(encoded)')
plt.xticks([]), plt.yticks([])
f2 = np.fft.fft2(img_wm)
rwm = (f2 - f1) / alpha
rwm = np.real(rwm)
wm = np.zeros(rwm.shape)
for i in range(int(rwm.shape[0] * 0.5)):
for j in range(rwm.shape[1]):
wm[m[i]][n[j]] = np.uint8(rwm[i][j])
for i in range(int(rwm.shape[0] * 0.5)):
for j in range(rwm.shape[1]):
wm[rwm.shape[0] - i - 1][rwm.shape[1] - j - 1] = wm[i][j]
if debug:
assert cv2.imwrite('_bwm.debug.wm.jpg', wm)
plt.subplot(236), plt.imshow(bgr_to_rgb(wm)), plt.title('watermark')
plt.xticks([]), plt.yticks([])
if debug:
plt.show()
elif cmd == 'decode':
print('image<%s> + image(encoded)<%s> -> watermark<%s>' % (fn1, fn2, fn3))
img = cv2.imread(fn1)
img_wm = cv2.imread(fn2)
if debug:
plt.subplot(231), plt.imshow(bgr_to_rgb(img)), plt.title('image')
plt.xticks([]), plt.yticks([])
plt.subplot(234), plt.imshow(bgr_to_rgb(img_wm)), plt.title('image(encoded)')
plt.xticks([]), plt.yticks([])
if oldseed:
random.seed(seed, version=1)
rng = random.Random()
else:
rng = random.Random(seed)
m, n = list(range(int(img.shape[0] * 0.5))), list(range(img.shape[1]))
rng.shuffle(m)
rng.shuffle(n)
f1 = np.fft.fft2(img)
f2 = np.fft.fft2(img_wm)
if debug:
plt.subplot(232), plt.imshow(bgr_to_rgb(np.real(f1))), \
\
plt.title('fft(image)')
plt.xticks([]), plt.yticks([])
plt.subplot(235), plt.imshow(bgr_to_rgb(np.real(f2))), \
\
plt.title('fft(image(encoded))')
plt.xticks([]), plt.yticks([])
rwm = (f2 - f1) / alpha
rwm = np.real(rwm)
if debug:
plt.subplot(233), plt.imshow(bgr_to_rgb(rwm)), \
\
plt.title('encrypted(watermark)')
plt.xticks([]), plt.yticks([])
wm = np.zeros(rwm.shape)
for i in range(int(rwm.shape[0] * 0.5)):
for j in range(rwm.shape[1]):
wm[m[i]][n[j]] = np.uint8(rwm[i][j])
for i in range(int(rwm.shape[0] * 0.5)):
for j in range(rwm.shape[1]):
wm[rwm.shape[0] - i - 1][rwm.shape[1] - j - 1] = wm[i][j]
assert cv2.imwrite(fn3, wm)
if debug:
plt.subplot(236), plt.imshow(bgr_to_rgb(wm)), plt.title(u'watermark')
plt.xticks([]), plt.yticks([])
if debug:
plt.show()
将代码与两张图放在同一路径下，使用终端命令：
python bwmforpy3.py decode day1.png day2.png flag.png
即可得flag.png，实则为flag.txt的密码，输入密码得到：
ZmxhZ3tmOGQxNTZlZGFlN2ZkYzFlYzcyZjMzZjNlZGRkMGU3OX0=
base64解密：
flag{f8d156edae7fdc1ec72f33f3eddd0e79}
在有些题里，两张图处理后得到的就是flag
参考链接：
盲水印
六.都是些啥（加密算法）
1.
..-./.-../.-/--./----.--/-../...--/..-./-.-./-.../..-./.----/--.../..-./----./...--/----./----./...../-----/....-/-----.-
摩斯
FLAG%u7bD3FCBF17F9399504%u7d
synt{1296300rr49p35p1n25980r76n07rs5q}
凯撒
flag{1296300ee49c35c1a25980e76a07ef5d}
f{6ec1977dlg1930e93ca58e60e5}a204520af
栅栏
flag{1296300ee49c35c1a25980e76a07ef5d}
+++++ +++++ [->++ +++++ +++<] >++.+ +++++ .<+++ [->-- -<]>- -.+++ +++.< ++++[ ->+++ +<]>+ +++.< +++++ +++[- >---- ----< ]>--- ----- ---.+ ++++. --.-. .<+++ ++++[ ->+++ ++++< ]>+.. --.<+ +++++ [->-- ----< ]>--- ----- --.+. .--.< +++++ +[->+ +++++ <]>++ +++++ ++++. <++++ ++[-> ----- -<]>- ----- -.-.- .<+++ +++[- >++++ ++<]> +++++ ++++. <++++ ++[-> ----- -<]>- ----- -.<++ ++++[ ->+++ +++<] >++++ +++.+ .<+++ +++[- >---- --<]> ----- -.<++ ++++[ ->+++ +++<] >++++ +++.< +++++ +[->- ----- <]>-- ----- ----- .++++ .--.< +++++ +[->+ +++++ <]>++ +++++ .<+++ +++[- >---- --<]> ----- ----- .<+++ ++++[ ->+++ ++++< ]>.-- -.<++ +++++ [->-- ----- <]>.< +++++ ++[-> +++++ ++<]> ++.++ .<+++ +[->+ +++<] >++++ ++++. <
brianfuck
flag{05322ddb4553b765b7bc9d486a3da0ce}
ﾟωﾟﾉ= /｀ｍ´）ﾉ ~┻━┻ //´∇｀/ ['']; o=(ﾟｰﾟ) ==3; c=(ﾟΘﾟ) =(ﾟｰﾟ)-(ﾟｰﾟ); (ﾟДﾟ) =(ﾟΘﾟ)= (o_o)/ (o_o);(ﾟДﾟ)={ﾟΘﾟ: '' ,ﾟωﾟﾉ : ((ﾟωﾟﾉ==3) +'') [ﾟΘﾟ] ,ﾟｰﾟﾉ :(ﾟωﾟﾉ+ '')[o_o -(ﾟΘﾟ)] ,ﾟДﾟﾉ:((ﾟｰﾟ==3) +'')[ﾟｰﾟ] }; (ﾟДﾟ) [ﾟΘﾟ] =((ﾟωﾟﾉ3) +'') [c_o];(ﾟДﾟ) ['c'] = ((ﾟДﾟ)+'') [ (ﾟｰﾟ)+(ﾟｰﾟ)-(ﾟΘﾟ) ];(ﾟДﾟ) ['o'] = ((ﾟДﾟ)+'') [ﾟΘﾟ];(ﾟoﾟ)=(ﾟДﾟ) ['c']+(ﾟДﾟ) ['o']+(ﾟωﾟﾉ +'')[ﾟΘﾟ]+ ((ﾟωﾟﾉ3) +'') [ﾟｰﾟ] + ((ﾟДﾟ) +'') [(ﾟｰﾟ)+(ﾟｰﾟ)]+ ((ﾟｰﾟ3) +'_') [ﾟΘﾟ]+((ﾟｰﾟ3) +'') [(ﾟｰﾟ) - (ﾟΘﾟ)]+(ﾟДﾟ) ['c']+((ﾟДﾟ)+'') [(ﾟｰﾟ)+(ﾟｰﾟ)]+ (ﾟДﾟ) ['o']+((ﾟｰﾟ3) +'') [ﾟΘﾟ];(ﾟДﾟ) [''] =(o_o) [ﾟoﾟ] [ﾟoﾟ];(ﾟεﾟ)=((ﾟｰﾟ3) +'') [ﾟΘﾟ]+ (ﾟДﾟ) .ﾟДﾟﾉ+((ﾟДﾟ)+'') [(ﾟｰﾟ) + (ﾟｰﾟ)]+((ﾟｰﾟ3) +'_') [o_o -ﾟΘﾟ]+((ﾟｰﾟ3) +'') [ﾟΘﾟ]+ (ﾟωﾟﾉ +'') [ﾟΘﾟ]; (ﾟｰﾟ)+=(ﾟΘﾟ); (ﾟДﾟ)[ﾟεﾟ]='\'; (ﾟДﾟ).ﾟΘﾟﾉ=(ﾟДﾟ+ ﾟｰﾟ)[o_o -(ﾟΘﾟ)];(oﾟｰﾟo)=(ﾟωﾟﾉ +'')[c_o];(ﾟДﾟ) [ﾟoﾟ]='"';(ﾟДﾟ) [''] ( (ﾟДﾟ) [''] (ﾟεﾟ+(ﾟДﾟ)[ﾟoﾟ]+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ (ﾟｰﾟ)+ ((o_o) +(o_o))+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ ((ﾟｰﾟ) + (ﾟΘﾟ))+ (ﾟｰﾟ)+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ (ﾟｰﾟ)+ (ﾟΘﾟ)+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ (ﾟｰﾟ)+ ((ﾟｰﾟ) + (o_o))+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ ((ﾟｰﾟ) + (o_o))+ (o_o)+ (ﾟДﾟ)[ﾟεﾟ]+((o_o) +(o_o))+ (c_o)+ (ﾟДﾟ)[ﾟεﾟ]+((o_o) +(o_o))+ ((ﾟｰﾟ) + (ﾟΘﾟ))+ (ﾟДﾟ)[ﾟεﾟ]+((o_o) +(o_o))+ (o_o)+ (ﾟДﾟ)[ﾟεﾟ]+((o_o) +(o_o))+ ((o_o) - (ﾟΘﾟ))+ (ﾟДﾟ)[ﾟεﾟ]+((o_o) +(o_o))+ ((o_o) - (ﾟΘﾟ))+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ (ﾟｰﾟ)+ (ﾟｰﾟ)+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ (ﾟｰﾟ)+ (ﾟｰﾟ)+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ (ﾟｰﾟ)+ ((o_o) - (ﾟΘﾟ))+ (ﾟДﾟ)[ﾟεﾟ]+((o_o) +(o_o))+ (ﾟｰﾟ)+ (ﾟДﾟ)[ﾟεﾟ]+((o_o) +(o_o))+ ((ﾟｰﾟ) + (ﾟΘﾟ))+ (ﾟДﾟ)[ﾟεﾟ]+((o_o) +(o_o))+ ((ﾟｰﾟ) + (ﾟΘﾟ))+ (ﾟДﾟ)[ﾟεﾟ]+((o_o) +(o_o))+ (o_o)+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ (ﾟｰﾟ)+ ((o_o) - (ﾟΘﾟ))+ (ﾟДﾟ)[ﾟεﾟ]+((o_o) +(o_o))+ ((ﾟｰﾟ) + (o_o))+ (ﾟДﾟ)[ﾟεﾟ]+((o_o) +(o_o))+ ((o_o) +(o_o))+ (ﾟДﾟ)[ﾟεﾟ]+((o_o) +(o_o))+ ((ﾟｰﾟ) + (ﾟΘﾟ))+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ (ﾟｰﾟ)+ ((o_o) - (ﾟΘﾟ))+ (ﾟДﾟ)[ﾟεﾟ]+((o_o) +(o_o))+ ((ﾟｰﾟ) + (o_o))+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ (ﾟｰﾟ)+ ((o_o) - (ﾟΘﾟ))+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ (ﾟｰﾟ)+ (o_o)+ (ﾟДﾟ)[ﾟεﾟ]+((ﾟｰﾟ) + (o_o))+ (ﾟΘﾟ)+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ (ﾟｰﾟ)+ (ﾟｰﾟ)+ (ﾟДﾟ)[ﾟεﾟ]+((o_o) +(o_o))+ (ﾟｰﾟ)+ (ﾟДﾟ)[ﾟεﾟ]+((ﾟｰﾟ) + (o_o))+ (c_o)+ (ﾟДﾟ)[ﾟεﾟ]+((o_o) +(o_o))+ ((o_o) +(o_o))+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ (ﾟｰﾟ)+ (ﾟΘﾟ)+ (ﾟДﾟ)[ﾟεﾟ]+((o_o) +(o_o))+ (o_o)+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ (ﾟｰﾟ)+ (ﾟｰﾟ)+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ (ﾟｰﾟ)+ (ﾟΘﾟ)+ (ﾟДﾟ)[ﾟεﾟ]+((o_o) +(o_o))+ (c_o)+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ (ﾟｰﾟ)+ (o_o)+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ (ﾟｰﾟ)+ ((ﾟｰﾟ) + (ﾟΘﾟ))+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ ((ﾟｰﾟ) + (o_o))+ ((ﾟｰﾟ) + (ﾟΘﾟ))+ (ﾟДﾟ)[ﾟoﾟ]) (ﾟΘﾟ)) ('');
aaencode
flag{05322ddb4553b765b7bc9d486a3da0ce}
MZWGCZ33MJQXGZJTGJPWI327PFXXKX3LNZXXOPZ7PU======
base32
flag{base32_do_you_know??}
7.mzwgcz44mjqxgzjwgrpwiylol65w76k8mj3v764bnzpxc6lbnzpxg3djpu======
有=补齐，猜想是base类型
base64解密是乱码，base32密码本全大写，数字2-7,发现密文中数字范围是3-8，于是数字自减一，字母全大写，base32：
flag{base64_dan_you_bu_wan_quan_shi}
110000110000110001110000100000110000110001110000110000100000110000110001100000110001110001110000100000110001110001110001110001110000110001110001100000110001110001100000110001110001110001100000110000110001110000100000110000110000110000100000110000100000110000110000110001110001110000110001100000110000110001100000110001110000100000110001110000110000100000110000110000110001110001110000110001100000110001110000110000110000100000110000110000100000110001110000100000110001110001110001110001110001110000110001
504位二进制数，尝试6,7,8位一组分组转ascii，需高位补0，保证8位转
点击查看代码
# Convert the provided binary string to ASCII characters
binary_string = "110000110000110001110000100000110000110001110000110000100000110000110001100000110001110001110000100000110001110001110001110001110000110001110001100000110001110001100000110001110001110001100000110000110001110000100000110000110000110000100000110000100000110000110000110001110001110000110001100000110000110001100000110001110000100000110001110000110000100000110000110000110001110001110000110001100000110001110000110000110000100000110000110000100000110001110000100000110001110001110001110001110001110000110001"
# Group the binary string into 6-bit groups and prepend '00' to each group
grouped_binary = ['00' + binary_string[i:i+6] for i in range(0, len(binary_string), 6)]
# Convert each 8-bit binary group to its ASCII character
ascii_string = ''.join([chr(int(binary_group, 2)) for binary_group in grouped_binary])
ascii_string
提示：3-blacksheepwall
aiggidgaijggadggadjgiadagagaig
一共只有5个字符，猜想为ADFGX加密，根据题目凯撒密码移3位，得到：
xfddfadxfgddxaddxagdfxaxdxdxfd
点击查看代码
Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook! Ook? Ook!
。。。。。
点击查看代码
# Convert the provided Ook! code to Brainfuck code
ook_code =
# Mapping from Ook! to Brainfuck
ook_to_brainfuck = {
"Ook.Ook?": ">", "Ook?Ook.": "<",
"Ook.Ook.": "+", "Ook!Ook!": "-",
"Ook!Ook.": ".", "Ook.Ook!": ",",
"Ook!Ook?": "[", "Ook?Ook!": "]"
}
# Process the Ook! code and convert it to Brainfuck
brainfuck_code = ""
ook_tokens = ook_code.split()
for i in range(0, len(ook_tokens), 2):
ook_command = ook_tokens[i] + ook_tokens[i + 1]
if ook_command in ook_to_brainfuck:
brainfuck_code += ook_to_brainfuck[ook_command]
print(brainfuck_code)
七.easymisc
附件为加密压缩包，用Advanced Archive Password Recovery(ARCHPR)暴力破解，得到两个压缩包（一个加密一个无加密），用ARCHPR进行明文攻击，破解加密压缩包，得到一张jpg图像，在kali中用binwalk分析，图像中有zip，用foremost分离文件，将得到的压缩包在010editor中分析，发现0900(伪加密)，修改为0000，即可解密，解压后得到flag
八.机密图片恢复（拼图）
附件解压为600张小图片，需要拼图
kali安装montage和gaps
参考链接：https://blog.csdn.net/qq_68643282/article/details/132393550
九.flag
附件压缩包伪加密，用010editor改0900为0100，解压后有一flag无后缀文件和一个word文件，打开word，提示“逆向思维”，用010editor打开flag文件，发现文件尾为B405，结合提示，猜测为zip文件倒置，以十六进制复制，翻转字符串，再新建文件粘贴自十六进制，得到新zip文件，解压得到一pdf加密文件。用kali的pdfcrack进行爆破，参考链接：kali安装pdfcrack
得到密码4876352，打开pdf，发现里面全是01的二进制，ctrl+A全选，用toolsfx的01toqrcode工具转为二维码图片，识别即可得flag。
浙公网安备 33010602011771号