除了簽到簽退，只出了3到簽到題（https://shimo.im/docs/QTkJYhjrwq8RQqkJ）
哈哈哈
想著跟大佬們的wp，復現一下miscstudy

miscstudy

題目說明：本題目flag由7個部分構成，第一個部分為flag{level1...，最後一個部分為 !!!} 每一關都會存有flag的一部分，將所有flag的字串拼接即為最後flag

連結：https://pan.baidu.com/s/1iEvJ9_RD4q5gzhh-smvu0w
提取碼：0ycf

用wireshark開啟就卡死，關閉有道詞典，解決！
也過濾http了，就是沒往下看

1、過濾http

訪問http://39.99.247.28/fonts/1

flag{level1_begin_and_level2_is_come
2、
上面是sslkey.log檔案，另存為sslkey.log

把sslkey.log匯入misc.pcapng：編輯->首選項->Protocols->TLS

此時，多出一條流量

https://www.qiangwangbei.com/images/4e5d47b2db53654959295bba216858932.png

用zsteg命令：

zsteg 4e5d47b2db53654959295bba216858932.png

base64解密，得到3600（60*60）位的2進位制和level3(level3_start_it

考慮轉二維碼，指令碼網上有

from PIL import Image
MAX = 60
pic = Image.new("RGB",(MAX, MAX))
str="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001111111111110000000100110000100000000011100001111111111100001111111111110000000110111000100000000011100001111111111100001100000000110010011111110010000000001100111001000000000100001100000000110010000110110010000000000001111001000000000100001100111100110010000100110010011100000011101001001111100100001100111100110000100000001110011111110010000001001111100100001100111100110000000000001110011110110010000001001111100100001100111100110011100100111111111100110011100000001111100100001100000000110011000000000111100110110110000001000000000100001100000000110010011000000011100011111110011001000000000100001111111111110010011001001001100110110010011001111111111100001111111111110010011001001100000100110010011001111111111100000000000000000010011111110010011000111000100000000000000000000000000000000010001111100010011000011101100000000000000000001110011000111100000001000000011000001111111001111000111000000110000000000000000001000000011000000000011001000000000000000010000001000011100001000000111100110000011000000010000000001110011001111110000000000000010001001110011111000010011000001110011001111110000000000000011001001110011111000010011000001100111000000011111000000010000100000100100111000000100100000001100000000111011000000111000100001100000111000000000000000011100000111110011000001111111100001100011111110010000000000000111001001100000000001100000111001110011111001000100100000000111001001000000000001000000111001110011111001100100100000011100000110011111111000000011100001111111000001110011100000011000000010011111110000000011100001111111000000110001100000000000100000010000000000000011000001110011001000000100100000000000000000110000000000000000000001110011011100000000000000010001001111110000100000000100000011111111101111100000000000011000000001110000000111111100110000001100000000010000000000011100000001110000000111111100111000000100000000010000000001110000100111111111111000000011100111000011000001100000000001111000110001001100111000000011000011100011000000000000000001111100111001100100101111111111001111100001001110011111100001100000111110000100000000010000000111100011000000011100100001000000111110000100000000010000000111000011000000011100100000011011100000011100000000000000001110000011111000001100100000111111100000011000000000000000011100000001101000000100100001111100000110010000100000000011111000010000000001100010000000111100000000010000110000000000000000110000000001100000000000011100100000010011111000011100000001110000000111000100000001100111000111110011111001111111100001010011111111100011000001000111000111110011111001111111100001110011011111100011000000000000000000010011001001110000001110001111000001100000100000000000000000010011000001100000000110000011000001100000100001111111111110010011000111000110000111100011001001100111100001100000000110000111100000011111111001110001000001100111000001100000000110000111100000011111111001110011000001100111000001100111100110000100001000000100001001110011111111100000000001100111100110000100001000001100001001100001111111000000000001100111100110010011000111111111000111110000111000011011100001100111100110000011000110000000000000110000000000011011100001100111100110000011111110000000100001110011000000000011100001100000000110011100100111000011001111100011111111111100000001100000000110011100100111000011001111100011111111111100000001011111111010010011111110011111001001110011111100000011000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
i=0
for y in range (0,MAX):
    for x in range (0,MAX):
        if(str[i] == '1'):
            pic.putpixel([x,y],(0, 0, 0))
        else:
            pic.putpixel([x,y],(255,255,255))
        i = i+1
pic.save("res.png")
 

連結：https://pan.baidu.com/s/1wVJ7d0RLW8Rj-HOTL9Shug
提取碼：1lms

3、下載後得到level4.jpg

用stegdetect檢測到圖片是jphide加密（我感覺這工具一般只能檢測jphide）
.\stegdetect.exe -t jopi -s 10.0 .\level4.jpg

用stegbreak爆破一下
.\stegbreak.exe -r .\rules.ini -f .\password.txt -t p .\level4.jpg

https://pan.baidu.com/s/1o43y4UGkm1eP-RViC25aOw

mrpt

level4_here_all

4、下載後是leve5.zip(level5.png 1.png level6.zip level7.zip)
level5.png直接是第5段

level6.zip

crc32爆破

level7.zip(1.png 4.png 5.png)
直接明文攻擊（不到一分鐘就可以停了），4.png和5.png是一樣的，嘗試(盲水印)[https://github.com/chishaxie/BlindWaterMark/archive/master.zip]（用裡面的py3，py2都沒結果）

得到：level7ishere和39.99.247.28/final_level

根據提示blank，檢視頁面原始碼，發現前2行有空格和tab，html snow隱寫，http://fog.misty.com/perry/ccs/snow/snow/snow.html

the_misc_examaaaaaaa_!!!}

連起來，flag{level1_begin_and_level2_is_comelevel3_start_itlevel4_here_alllevel5_is_aaalevel_isreadylevel7isherethe_misc_examaaaaaaa_!!!}