以*CTF2018的misc题xp3为例子

image.png

附件下载地址
https://github.com/aye-whitehat/CTF-Collect/blob/master/StarCTF2018/xp3(misc)/challenge/xp3.zip

xp3文件提取器

在CSDN下载的，我也放到了github这个项目中

提取结果如图：

image.png

隐写1

g01.ks发现注释，是zip的头部的hex信息

image.png

然后将g01.ks~g56.ks的最后一行的hex提取出来，并写入bin文件中

image.png

cat.py

#!coding:utf-8
import os

#提取hex
a = ''
for i in range(1,57):
    i =  str(i)
    i = i.zfill(2)
    a += os.popen("cat g%s.ks | tail -n 1"%i).read()[6:]
    #cat的原文是unicode编码 ;// 共占了6个字节
print a 

hex2bin.py

#!coding:utf-8
hexString1 = '504B0304140009000800736B704CE5C121E6330000002700000008000000666C61672E747874C340D528ED5CC1EDD15C038FA53F28ADA8B44B201EF019F5EA25549804EAED5802B78AFCDC00AE8186BDAC0F35C811814133F1504B01021400140009000800736B704CE5C121E63300000027000000080024000000000000002000000000000000666C61672E7478740A002000000000000100180018E8397EE7BCD30100A58FCFDEBAD30111508455DEBAD301504B050600000000010001005A00000059000000000000000000000000000000000000000000000000'

hexList1 = []
intList1 = []
asciiString1 =''

while True:
    intString1 = hexString1[0:2]
    hexString1 = hexString1[2:]
    hexList1.append(intString1)
    if (hexString1 == ''):
        break

for i in hexList1:
    intList1.append(int(i,16))
for j in intList1:
    asciiString1 += chr(int(j))

f = open('flag.bin','w')
f.write(asciiString1)
f.close()

隐写2

打开zip发现加密了，不是伪加密，爆破8位数字也没用，而且提取的图片信息也还没用到
将文件夹中的图片全部哈希，发现pic25.bmp跟别的图片表面上一样，实际上哈希不同

image.png image.png

这里考察盲水印

github有个处理盲水印的项目
https://github.com/chishaxie/BlindWaterMark

wget https://raw.githubusercontent.com/chishaxie/BlindWaterMark/master/bwm.py
cp pic0.bmp hui.png #原图
cp pic25.bmp hui_with_wm.png #原图+盲水印
python bwm.py decode hui.png hui_with_wm.png wm_from_hui.png #盲水印图

image.png image.png

得到密码
NoGalgameNoLife
得到flag
*ctf{Hope_Every0ne_Has_A_Happy_End2333}

image.png