以*CTF2018的misc题xp3为例子
image.png
附件下载地址
https://github.com/aye-whitehat/CTF-Collect/blob/master/StarCTF2018/xp3(misc)/challenge/xp3.zip
xp3文件提取器
在CSDN下载的，我也放到了github这个项目中
提取结果如图：
image.png
隐写1
g01.ks发现注释，是zip的头部的hex信息
image.png
然后将g01.ks~g56.ks的最后一行的hex提取出来，并写入bin文件中
image.png
cat.py
#!coding:utf-8
import os
#提取hex
a = ''
for i in range(1,57):
i = str(i)
i = i.zfill(2)
a += os.popen("cat g%s.ks | tail -n 1"%i).read()[6:]
#cat的原文是unicode编码 ;// 共占了6个字节
print a
hex2bin.py
#!coding:utf-8
hexString1 = '504B0304140009000800736B704CE5C121E6330000002700000008000000666C61672E747874C340D528ED5CC1EDD15C038FA53F28ADA8B44B201EF019F5EA25549804EAED5802B78AFCDC00AE8186BDAC0F35C811814133F1504B01021400140009000800736B704CE5C121E63300000027000000080024000000000000002000000000000000666C61672E7478740A002000000000000100180018E8397EE7BCD30100A58FCFDEBAD30111508455DEBAD301504B050600000000010001005A00000059000000000000000000000000000000000000000000000000'
hexList1 = []
intList1 = []
asciiString1 =''
while True:
intString1 = hexString1[0:2]
hexString1 = hexString1[2:]
hexList1.append(intString1)
if (hexString1 == ''):
break
for i in hexList1:
intList1.append(int(i,16))
for j in intList1:
asciiString1 += chr(int(j))
f = open('flag.bin','w')
f.write(asciiString1)
f.close()
隐写2
打开zip发现加密了，不是伪加密，爆破8位数字也没用，而且提取的图片信息也还没用到
将文件夹中的图片全部哈希，发现pic25.bmp跟别的图片表面上一样，实际上哈希不同
image.png
image.png
这里考察盲水印
github有个处理盲水印的项目
https://github.com/chishaxie/BlindWaterMark
wget https://raw.githubusercontent.com/chishaxie/BlindWaterMark/master/bwm.py
cp pic0.bmp hui.png #原图
cp pic25.bmp hui_with_wm.png #原图+盲水印
python bwm.py decode hui.png hui_with_wm.png wm_from_hui.png #盲水印图
image.png
image.png
得到密码
NoGalgameNoLife
得到flag
*ctf{Hope_Every0ne_Has_A_Happy_End2333}
image.png
