[2020強網杯]記錄
除了簽到簽退,只出了3到簽到題(https://shimo.im/docs/QTkJYhjrwq8RQqkJ)
哈哈哈
想著跟大佬們的wp,復現一下miscstudy
miscstudy
題目說明:本題目flag由7個部分構成,第一個部分為flag{level1...,最後一個部分為 !!!} 每一關都會存有flag的一部分,將所有flag的字串拼接即為最後flag
連結:https://pan.baidu.com/s/1iEvJ9_RD4q5gzhh-smvu0w
提取碼:0ycf
用wireshark開啟就卡死,關閉有道詞典,解決!
也過濾http了,就是沒往下看
1、過濾http
訪問http://39.99.247.28/fonts/1
flag{level1_begin_and_level2_is_come
2、
上面是sslkey.log檔案,另存為sslkey.log
把sslkey.log匯入misc.pcapng:編輯->首選項->Protocols->TLS
此時,多出一條流量
https://www.qiangwangbei.com/images/4e5d47b2db53654959295bba216858932.png
用zsteg命令:
zsteg 4e5d47b2db53654959295bba216858932.png
base64解密,得到3600(60*60)位的2進位制和level3(level3_start_it
考慮轉二維碼,指令碼網上有
from PIL import Image MAX = 60 pic = Image.new("RGB",(MAX, MAX)) str="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001111111111110000000100110000100000000011100001111111111100001111111111110000000110111000100000000011100001111111111100001100000000110010011111110010000000001100111001000000000100001100000000110010000110110010000000000001111001000000000100001100111100110010000100110010011100000011101001001111100100001100111100110000100000001110011111110010000001001111100100001100111100110000000000001110011110110010000001001111100100001100111100110011100100111111111100110011100000001111100100001100000000110011000000000111100110110110000001000000000100001100000000110010011000000011100011111110011001000000000100001111111111110010011001001001100110110010011001111111111100001111111111110010011001001100000100110010011001111111111100000000000000000010011111110010011000111000100000000000000000000000000000000010001111100010011000011101100000000000000000001110011000111100000001000000011000001111111001111000111000000110000000000000000001000000011000000000011001000000000000000010000001000011100001000000111100110000011000000010000000001110011001111110000000000000010001001110011111000010011000001110011001111110000000000000011001001110011111000010011000001100111000000011111000000010000100000100100111000000100100000001100000000111011000000111000100001100000111000000000000000011100000111110011000001111111100001100011111110010000000000000111001001100000000001100000111001110011111001000100100000000111001001000000000001000000111001110011111001100100100000011100000110011111111000000011100001111111000001110011100000011000000010011111110000000011100001111111000000110001100000000000100000010000000000000011000001110011001000000100100000000000000000110000000000000000000001110011011100000000000000010001001111110000100000000100000011111111101111100000000000011000000001110000000111111100110000001100000000010000000000011100000001110000000111111100111000000100000000010000000001110000100111111111111000000011100111000011000001100000000001111000110001001100111000000011000011100011000000000000000001111100111001100100101111111111001111100001001110011111100001100000111110000100000000010000000111100011000000011100100001000000111110000100000000010000000111000011000000011100100000011011100000011100000000000000001110000011111000001100100000111111100000011000000000000000011100000001101000000100100001111100000110010000100000000011111000010000000001100010000000111100000000010000110000000000000000110000000001100000000000011100100000010011111000011100000001110000000111000100000001100111000111110011111001111111100001010011111111100011000001000111000111110011111001111111100001110011011111100011000000000000000000010011001001110000001110001111000001100000100000000000000000010011000001100000000110000011000001100000100001111111111110010011000111000110000111100011001001100111100001100000000110000111100000011111111001110001000001100111000001100000000110000111100000011111111001110011000001100111000001100111100110000100001000000100001001110011111111100000000001100111100110000100001000001100001001100001111111000000000001100111100110010011000111111111000111110000111000011011100001100111100110000011000110000000000000110000000000011011100001100111100110000011111110000000100001110011000000000011100001100000000110011100100111000011001111100011111111111100000001100000000110011100100111000011001111100011111111111100000001011111111010010011111110011111001001110011111100000011000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" i=0 for y in range (0,MAX): for x in range (0,MAX): if(str[i] == '1'): pic.putpixel([x,y],(0, 0, 0)) else: pic.putpixel([x,y],(255,255,255)) i = i+1 pic.save("res.png")
連結:https://pan.baidu.com/s/1wVJ7d0RLW8Rj-HOTL9Shug
提取碼:1lms
3、下載後得到level4.jpg
用stegdetect檢測到圖片是jphide加密(我感覺這工具一般只能檢測jphide)
.\stegdetect.exe -t jopi -s 10.0 .\level4.jpg
用stegbreak爆破一下
.\stegbreak.exe -r .\rules.ini -f .\password.txt -t p .\level4.jpg
https://pan.baidu.com/s/1o43y4UGkm1eP-RViC25aOw
mrpt
level4_here_all
4、下載後是leve5.zip(level5.png 1.png level6.zip level7.zip)
level5.png直接是第5段
level6.zip
level7.zip(1.png 4.png 5.png)
直接明文攻擊(不到一分鐘就可以停了),4.png和5.png是一樣的,嘗試(盲水印)[https://github.com/chishaxie/BlindWaterMark/archive/master.zip](用裡面的py3,py2都沒結果)
得到:level7ishere和39.99.247.28/final_level
根據提示blank,檢視頁面原始碼,發現前2行有空格和tab,html snow隱寫,http://fog.misty.com/perry/ccs/snow/snow/snow.html
the_misc_examaaaaaaa_!!!}
連起來,flag{level1_begin_and_level2_is_comelevel3_start_itlevel4_here_alllevel5_is_aaalevel_isreadylevel7isherethe_misc_examaaaaaaa_!!!}