0329 CTF通识课测试1 WriteUp

Hervey
  2024-04-07 16:54:32 2024-04-07 16:54:32 创建   2024-04-07 22:04 2024-04-07 22:04 更新      

1-tail

hint其实就在题目里…

用 010Editor 打开图片，flag 就在文件尾

2-goose

考点: Exif 隐写

右键 >> 属性 >> 详细信息 可以看到 flag 在 来源 > 作者 栏

3-lsb

考点: lsb 隐写

使用工具: StegSolve.jar

1
java -jar Stegsolve.jar

使用StegSolve打开 1_lsb.png 文件， Analyse > Data Extract ，勾选 Red 0 , Green 0 , Blue 0 , LSB First 点击 Preview 获得 flag

4-polar-light

考点: png 长宽爆破

使用 010Editor 获得 png 文件的 CRC 校验码

使用如下脚本爆破 png 文件的真实长宽

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
import os
import binascii
import struct

#文件名
filename = "4.png"
#图片当前CRC(29-32位)
CRC = 0x2EE0E28E

crcbp = open(filename, "rb").read()
for i in range(2000):
    for j in range(2000):
        data = crcbp[12:16] + \
            struct.pack('>i', i)+struct.pack('>i', j)+crcbp[24:29]
        crc32 = binascii.crc32(data) & 0xffffffff
        if (crc32 == CRC):
            print(i, j)
            print('hex:', hex(i), hex(j))

得到png的真实尺寸

1
2
3
4
┌──(hervey㉿Hervey)-[/mnt/c/Users/hervey/Downloads]
└─$ python3 ./calc_pic_size.py
952 490
hex: 0x3b8 0x1ea

替换掉原来的长宽值后打开图片即可获得 flag

5-spring

使用 010Editor 打开文件，观察后发现文件倒置了

使用如下脚本还原 png 文件

1
2
3
with open('5.png', 'rb') as f:
    with open('real.png', 'wb') as g:
        g.write(f.read()[::-1])

打开还原后的图片即可获得 flag

6-bridge

使用 010 Editor 打开 6.png 发现后面有一段”冗余”内容

binwalk 一下看看

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
┌──(hervey㉿Hervey)-[/mnt/c/Users/hervey/Downloads/6]
└─$ binwalk ./6.jpg

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             JPEG image data, JFIF standard 1.02
30            0x1E            TIFF image data, big-endian, offset of first image directory: 8
332           0x14C           JPEG image data, JFIF standard 1.02
9499          0x251B          JPEG image data, JFIF standard 1.02
21682         0x54B2          Copyright string: "Copyright (c) 1998 Hewlett-Packard Company"
809662        0xC5ABE         JPEG image data, JFIF standard 1.02
809692        0xC5ADC         TIFF image data, big-endian, offset of first image directory: 8
809994        0xC5C0A         JPEG image data, JFIF standard 1.02
817885        0xC7ADD         JPEG image data, JFIF standard 1.02
828791        0xCA577         Copyright string: "Copyright (c) 1998 Hewlett-Packard Company"

可以发现在 jpg 文件后还藏了一个 jpg 文件

使用 foremost 命令分离文件

1
2
3
4
┌──(hervey㉿Hervey)-[/mnt/c/Users/hervey/Downloads/6]
└─$ foremost ./6.jpg
Processing: ./6.jpg
|*|

从分离出的图片中可获得 flag

7-nopassword

考察内容: zip伪加密

使用工具偷懒工具: 7zip

直接用 7zip 解压即可

修改 5D 位的 09 为 00 即可无密码进行解压得到 flag.txt ，进而获得 flag

8-birthday

考察内容: zip密码爆破

根据题目提示可猜测密码是数字(但是不确定几位)，使用 John 进行爆破

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
┌──(hervey㉿Hervey)-[/mnt/c/Users/hervey/Downloads]
└─$ zip2john 8.zip > 8.hash

┌──(hervey㉿Hervey)-[/mnt/c/Users/hervey/Downloads]
└─$ john 8.hash
Using default input encoding: UTF-8
Loaded 1 password hash (ZIP, WinZip [PBKDF2-SHA1 512/512 AVX512BW 16x])
Cost 1 (HMAC size) is 47 for all loaded hashes
Will run 16 OpenMP threads
Proceeding with single, rules:Single
Press 'q' or Ctrl-C to abort, almost any other key for status
Almost done: Processing the remaining buffered candidate passwords, if any.
Proceeding with wordlist:/usr/share/john/password.lst
Proceeding with incremental:ASCII
040508           (8.zip/flag.txt)
1g 0:00:00:01 DONE 3/3 (2024-04-07 00:02) 0.8333g/s 314803p/s 314803c/s 314803C/s batow1..mcfars
Use the "--show" option to display all of the cracked passwords reliably
Session completed.

得到密码为 040508

解压后打开 flag.txt 即可获得 flag

9-manyzip

解压文件后可以发现有很多 zip 文件，每个文件里都有一个 txt 文件，尝试使用如下脚本解压文件

1
2
3
for file in *.zip; do
    unzip "$file" -d .
done

然后使用 strings 命令寻找 flag

1
2
3
┌──(hervey㉿Hervey)-[/mnt/c/Users/hervey/Downloads/manyzip]
└─$ strings *.txt | grep Stinger
Stinger{dfc2e6b5-9f14-4321-a961-2ef0e756d3b7}

10-baseXX

打开 txt 文件，发现这样一段文字

1
;fl_kB4Z+11G^q!2Ig;Q/Mpur1bCO=2E!-I@Q-+q2.L&P2`<L&0k<$qI/

使用 Base85 解码获得 flag

11-baseN顾

打开 txt 文件，发现这样一段文字

1
Vm0xNFUxUXhWWGxVYTJoVVlteEthRlZxVG05alZteDBUbFU1VDFKc1NucFdWM014WVRBeFdHVklhRnBXUlRVelZqSjRWMDVzU25WUmJHaFlVMFZLYUZaR1VrTk9SbHBYVm01U2ExSXdXbGhWYkdRelpERlplRmt6YUZSaGVsWlhWRlpvUTFSc1dYcFJhemxoVmpOb00xa3dXbE5YUlRGWFkwVTFWMVpGV2pSV2JYaFRVakZSZUZOclpGaFdSbFU1

使用 Base64 连续解码 6 次获得 flag

12-流量

考察内容: 流量分析

使用工具: Wireshark

使用 Wireshark 打开 ftp.pcapng, Ctrl + F ，选择 分组字节流 、 字符串 查找 Stinger 即可获得 flag

13-流量2

考察内容: 流量分析

使用工具: Wireshark

使用 Wireshark 打开 13.pcapng, 这类问题有个技巧，一般情况下 flag 都藏在 HTTP/OK 附近，这里也不例外，发现上传了一张 jpg 文件，找到那一段 jpg 文件 右键 >> 显示分组字节... 即可获得 flag

14-word-frequency

考察内容: 词频统计

使用工具: quipqiup

把文本内容扔进去分析一下，flag 在最后

1
2
0   -1.380
Zhejiang University of technology is the first crovincial and ministerial jointly built university in the eastern coastal region, the first leading university of the national Higher education innovation ability enhancement clan (2011 clan) Collaborative innovation Center, and the first key construction university in Zhejiang crovince. it is located in Hangzhou, a famous historical and cultural city in China and a scenic tourist destination. the school was founded in 1953, and its credecessor can be traced back to the Zhejiang Middle industrial school founded in 1910. it has gone through various stages of develocment, including Hangzhou Chemical school, Zhejiang Chemical Vocational school, Zhejiang institute of Chemical technology, and Zhejiang institute of technology. in 1993, it was renamed Zhejiang University of technology. the school has three camcuses, namely Chaohui, cingfeng, and Moganshan, covering an area of 3333 acres. it has 26 secondary colleges and 1 decartment, as well as an indecendent college - Zhijiang College. there are currently 20536 full-time undergraduate students, 14561 graduate students of various tyces, and 1037 international students on camcus. there are 3392 faculty members in school, including 2486 full-time teachers, including 5 academicians of the Cae Member, 1 academician of the Cas Member, 11 scecial excerts of Zhejiang crovince, 4 distinguished crofessors of Changjiang scholars of the Ministry of education, 7 winners of the national science fund for distinguished Young scholars, 13 leading talents of the national "ten thousand talents crogram", 3 national famous teachers, 6 young Changjiang scholars of the Ministry of education, 14 winners of the national science fund for distinguished Young scholars, 3 young toc talents of the national "ten thousand talents crogram", 10 young and middle-aged excerts with outstanding contributions at the national level, and 11 candidates of the "ten Million talents crogram" of the Ministry of Human Resources and social security. the school adheres to the fundamental task of cultivating virtue and talents, with toc-notch innovative talents as the guide, advanced acclied talents as the main body, and comcound talents as the characteristics, vigorously cultivating industry elites and leading talents with comcrehensive develocment in morality, intelligence, chysical fitness, aesthetics, and labor, rich catriotism, international cerscective, innovative scirit, and cractical ability. since its establishment, the school has trained and delivered over 300000 outstanding talents of various tyces to the country. there are currently 63 undergraduate enrollment majors, covering 12 categories including chilosochy, economics, law, education, literature, science, engineering, agriculture, medicine, management, art, and interdisciclinary studies. there are 13 doctoral degree authorization coints in first level disciclines, 2 doctoral crofessional degree authorization categories, 30 master's degree authorization coints in first level disciclines, 3 master's degree authorization coints in second level disciclines that are not covered by first level disciclines, 22 master's crofessional degree authorization categories, and 13 costdoctoral mobile stations established. nine disciclines, including chemistry, engineering, materials science, environmental science and ecology, agricultural science, biology and biochemistry, comcuter science, charmacology and toxicology, and general social science, have entered the toc 1% of the global esi. among them, two disciclines, including chemistry and engineering, have entered the toc 1 ‰ of the global esi. the school adheres to serving the major needs of national and regional develocment as its own resconsibility, and focuses on strengthening the strategic layout of the cooceration network between government, industry, academia, research and acclication. there are currently 10 national level research clatforms and 69 crovincial and ministerial level research clatforms. the school has won more than 800 national and crovincial-level scientific research awards, including 24 national science and technology awards, ranking among the toc 40 universities in China in terms of the number of awards; 11 awards for outstanding achievements in humanities and social sciences from the Ministry of education. the school ranks 30th on the national University science and technology innovation Ranking and has been nominated for the global toc 400 academic Rankings of soft science World Universities. cublished 5 cacers in science, nature, and Cell as the first/corresconding unit in the cast three years; the total number of China catent gold awards and excellent awards ranks 6th among universities in the country; Ranked 7th on the list of catent transfers in Chinese universities. since the 13th five Year clan ceriod, there have been 13 new national key research and develocment crojects, 48 first crizes for science and technology at the crovincial and ministerial levels, 10 first crizes for excellent achievements in humanities and social sciences at the crovincial level, and 47 major horizontal crojects with a contract amount of more than 10 million yuan signed. in 2022, the school's research funding received 1.107 billion yuan. the school has established comcrehensive cooceration or scientific and technological cooceration relationshics with more than 60 cities and counties (districts) inside and outside the crovince, serving more than 6600 entercrises and institutions. the flag is {flag在这个位置}

zipinzip

试着解压这个文件，发现这是个套娃压缩包，根据提示，使用如下 python 脚本进行解压

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
import zipfile

def extract_nested_zip(zip_file_path, extract_path):
    with zipfile.ZipFile(zip_file_path, 'r') as zip_ref:
        for file_name in zip_ref.namelist():
            if file_name.endswith('.zip'):
                nested_zip_file = zip_ref.open(file_name)
                nested_zip_file_path = extract_path + '/' + file_name
                with open(nested_zip_file_path, 'wb') as output_file:
                    output_file.write(nested_zip_file.read())
                extract_nested_zip(nested_zip_file_path, extract_path)
            else:
                zip_ref.extract(file_name, extract_path)

# 示例用法
nested_zip_file_path = '11.zip'
extract_path = '.'

extract_nested_zip(nested_zip_file_path, extract_path)

打开 flag.txt 即可获得 flag

  • 标题: 0329 CTF通识课测试1 WriteUp
  • 作者: Hervey
  • 创建于 : 2024-04-07 16:54:32
  • 更新于 : 2024-04-07 22:04:00
  • 链接: https://herveyb3b4.github.io/2024/04/07/Test-0329-WriteUp/
  • 版权声明: 本文章采用 CC BY-NC-SA 4.0 进行许可。
此页目录
0329 CTF通识课测试1 WriteUp
  1. 1-tail
  2. 2-goose
  3. 3-lsb
  4. 4-polar-light
  5. 5-spring
  6. 6-bridge
  7. 7-nopassword
  8. 8-birthday
  9. 9-manyzip
  10. 10-baseXX
  11. 11-baseN顾
  12. 12-流量
  13. 13-流量2
  14. 14-word-frequency
  15. zipinzip