BUUMisc通关6

1

while [ "find . -type f -name '*.tar.xz' | wc -l" -gt 0 ]; do find -type f -name "*.tar.xz" -exec tar xf '{}' \; -exec rm -- '{}' \;; done;

1

while [ "find . -type f -name '*.tar.xz' | wc -l" -gt 0 ]; do find -type f -name "*.tar.xz" -exec tar xf '{}' \; -exec rm -- '{}' \;; done;

1

# strings flag 查找flag字符

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

# python3
from collections import Counter
f=open('1.txt','r')
f_read=f.read()
out= Counter(f_read)
print(out)
print(out.items())

sorted_x = sorted(out.items(), key=lambda x: x[1], reverse=True) #对可迭代的对象进行排序

for i in sorted_x:
    print(i[0],end="")

#item()方法把字典中每对key和value组成一个元组，并把这些元组放在列表中返回。
#sorted() 可以对所有可迭代的对象进行排序操作。
'''
sorted 语法： sorted(iterable, cmp=None, key=None, reverse=False)
参数说明：

iterable -- 可迭代对象。
cmp -- 比较的函数，这个具有两个参数，参数的值都是从可迭代对象中取出，此函数必须遵守的规则为，大于则返回1，小于则返回-1，等于则返回0。
key -- 主要是用来进行比较的元素，只有一个参数，具体的函数的参数就是取自于可迭代对象中，指定可迭代对象中的一个元素来进行排序。
reverse -- 排序规则，reverse = True 降序 ， reverse = False 升序（默认）。
'''

1
2

# "YOUHAVEFOUNDME", CONGRATULATIONSONFINDINGMYSECRETNOWIWILLGIVEYOUTHEPASSWORDITISIAMTHEPASSWD
# CONGRATULATION SON FINDING MY SECRET NOW I WILL GIVE YOU THE PASSWORD IT IS IAMTHEPASSWD

1
2
3
4

# 文本中的零宽字符有
<200c>
<200b>
<200d>

1
2
3
4
5
6
7
8

# 通过观察图片的 RGB 16进制编码信息，发现黄色部分的16进制编码是不同的。
#ffff70
#ffff40 
#ffff73
#ffff73
#ffff57
#ffff64
704073735764

1

# flag{1t's_v3ry_De1iCi0us~!}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

#python3 
from PIL import Image

x = 36	  #x坐标	
y = 12	  #y坐标	

file=Image.open('file.png')
outfile = open('out','w')

z=''
for i in range(x):
    for j in range(y):
        rgb=file.getpixel((i, j))
        print(rgb)
        if(rgb[0] == 255):
            z+='1'
        elif(rgb[0] == 0):
            z+='0'
        if(rgb[1] == 255):
            z+='1'
        elif(rgb[1] == 0):
            z+='0'
        if(rgb[2] == 255):
            z+='1'
        elif(rgb[2] == 0):
            z+='0'
print(z)
outfile.write(z)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

from PIL import Image

x = 36	  #x坐标	
y = 36	  #y坐标	

im = Image.new("RGB", (x, y))	
file = open('out','r')	

a=file.read()
z=0
for i in range(0, x):
	for j in range(0, y):
		print(a[z])
		if(a[z]=='1'):
			im.putpixel((i, j), (255, 255, 255))
		elif(a[z]=='0'):
			im.putpixel((i, j), (0, 0, 0))
		z=z+1

im.show()
im.save('1.png')

1
2
3

# EENSA(M0R53W2HLN3V3SE4G3!)
# flag{M0R53_W2HLN3V3SE4G3!}
# flag是错的，测试发现这在线网站解码有误，还是手动解更稳

1
2
3
4

#执行命令
python3 deepsound2john.py finl_flag.wav > hash.txt
john hash.txt
john hash.txt --show

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135

# python3
#!/usr/bin/env python3
'''
deepsound2john extracts password hashes from audio files containing encrypted
data steganographically embedded by DeepSound (http://jpinsoft.net/deepsound/).
This method is known to work with files created by DeepSound 2.0.
Input files should be in .wav format. Hashes can be recovered from audio files
even after conversion from other formats, e.g.,
    ffmpeg -i input output.wav
Usage:
    python3 deepsound2john.py carrier.wav > hashes.txt
    john hashes.txt
This software is copyright (c) 2018 Ryan Govostes <rgovostes@gmail.com>, and
it is hereby released to the general public under the following terms:
Redistribution and use in source and binary forms, with or without
modification, are permitted.
'''

import logging
import os
import sys
import textwrap


def decode_data_low(buf):
  return buf[::2]

def decode_data_normal(buf):
  out = bytearray()
  for i in range(0, len(buf), 4):
    out.append((buf[i] & 15) << 4 | (buf[i + 2] & 15))
  return out

def decode_data_high(buf):
  out = bytearray()
  for i in range(0, len(buf), 8):
    out.append((buf[i] & 3) << 6     | (buf[i + 2] & 3) << 4 \
             | (buf[i + 4] & 3) << 2 | (buf[i + 6] & 3))
  return out


def is_magic(buf):
  # This is a more efficient way of testing for the `DSCF` magic header without
  # decoding the whole buffer
  return (buf[0] & 15)  == (68 >> 4) and (buf[2]  & 15) == (68 & 15) \
     and (buf[4] & 15)  == (83 >> 4) and (buf[6]  & 15) == (83 & 15) \
     and (buf[8] & 15)  == (67 >> 4) and (buf[10] & 15) == (67 & 15) \
     and (buf[12] & 15) == (70 >> 4) and (buf[14] & 15) == (70 & 15)


def is_wave(buf):
  return buf[0:4] == b'RIFF' and buf[8:12] == b'WAVE'


def process_deepsound_file(f):
  bname = os.path.basename(f.name)
  logger = logging.getLogger(bname)

  # Check if it's a .wav file
  buf = f.read(12)
  if not is_wave(buf):
    global convert_warn
    logger.error('file not in .wav format')
    convert_warn = True
    return
  f.seek(0, os.SEEK_SET)

  # Scan for the marker...
  hdrsz = 104
  hdr = None

  while True:
    off = f.tell()
    buf = f.read(hdrsz)
    if len(buf) < hdrsz: break

    if is_magic(buf):
          hdr = decode_data_normal(buf)
          logger.info('found DeepSound header at offset %i', off)
          break

    f.seek(-hdrsz + 1, os.SEEK_CUR)

  if hdr is None:
    logger.warn('does not appear to be a DeepSound file')
    return

  # Check some header fields
  mode = hdr[4]
  encrypted = hdr[5]

  modes = {2: 'low', 4: 'normal', 8: 'high'}
  if mode in modes:
    logger.info('data is encoded in %s-quality mode', modes[mode])
  else:
    logger.error('unexpected data encoding mode %i', modes[mode])
    return

  if encrypted == 0:
    logger.warn('file is not encrypted')
    return
  elif encrypted != 1:
    logger.error('unexpected encryption flag %i', encrypted)
    return

  sha1 = hdr[6:6+20]
  print('%s:$dynamic_1529$%s' % (bname, sha1.hex()))


if __name__ == '__main__':
  import argparse

  parser = argparse.ArgumentParser()
  parser.add_argument('--verbose', '-v', action='store_true')
  parser.add_argument('files', nargs='+', metavar='file',
    type=argparse.FileType('rb', bufsize=4096))
  args = parser.parse_args()

  if args.verbose:
    logging.basicConfig(level=logging.INFO)
  else:
    logging.basicConfig(level=logging.WARN)

  convert_warn = False

  for f in args.files:
    process_deepsound_file(f)

  if convert_warn:
    print(textwrap.dedent('''
    ---------------------------------------------------------------
    Some files were not in .wav format. Try converting them to .wav
    and try again. You can use: ffmpeg -i input output.wav
    ---------------------------------------------------------------
    '''.rstrip()), file=sys.stderr)

1
2
3
4

# john hash.txt                                                                                         
Using default input encoding: UTF-8
Loaded 1 password hash (dynamic_1529 [sha1($p null_padded_to_len_32) (DeepSound) 128/128 AVX 4x1])
No password hashes left to crack (see FAQ)                                

1

zsteg -e "b8,rgb,lsb,xy" 1.png > diskimage.dat

1

# testdisk diskimage.dat

1
2
3
4

# 按C 复制图片，得到 flag
use Right to change directory, h to hide deleted files                                                   
    q to quit, : to select the current file, a to select all files                                       
    C to copy the selected files, c to copy the current file