本次线下赛由Tr0jAnV1rU4，chumen77，NonupleBroken三人出征，最终获得了一等奖（第三名）的成绩，现在就过程中遇到的一题misc分享下思路。
题目是一个图片题，也算是比较技术流的隐写了(最少比stegslove一把梭的题质量好太多
secret.png hint.md 以及 flag.crypto(这个地方同时考察了一个工具，后边再说。（题目文件在公众号回复“祥云杯”获取）
# -*- coding: utf-8 -*-# @Project: Hello Python# @File : 20-图片处理# @Author : Tr0jAn <[email protected]># @Date : 2020-12-13from PIL import Imageimg = Image.open('C:/Users/86176/Desktop/secret.png')picture = img.load()List = []lower = 5upper = int(560 - (560 / 20) + 5)step = int(560 / 20)for x in range(lower, upper +1, step):for y in range(lower, upper + 1, step):List.append(picture[x, y][1])print(List)# [237, 96, 69, 58, 64, 63, 9, 101, 84, 208, 115, 21, 104, 116, 101, 105, 97, 105, 159, 84, 71, 58, 116, 75, 119, 116, 31, 116, 71, 126, 84, 103, 105, 143, 168, 105, 69, 104, 101, 75, 224, 188, 114, 75, 101, 132, 71, 101, 205, 126, 75, 146, 51, 165, 128, 113, 105, 152, 69, 116, 101, 89, 115, 154, 22, 64, 109, 141, 58, 104, 69, 68, 252, 114, 9, 236, 58, 115, 104, 180, 55, 104, 207, 105, 114, 58, 116, 101, 69, 75, 71, 58, 58, 84, 75, 58, 101, 84, 71, 69, 54, 116, 101, 115, 105, 115, 116, 126, 51, 75, 114, 75, 64, 69, 66, 71, 240, 89, 89, 101, 116, 101, 83, 101, 69, 58, 71, 51, 58, 114, 115, 89, 64, 104, 84, 89, 220, 122, 69, 64, 114, 89, 51, 89, 51, 179, 166, 58, 126, 126, 71, 69, 69, 71, 102, 69, 149, 101, 69, 69, 101, 51, 98, 101, 89, 11, 104, 116, 89, 191, 104, 104, 51, 115, 56, 101, 126, 5, 116, 31, 146, 69, 64, 93, 175, 84, 164, 101, 114, 185, 101, 75, 89, 51, 104, 56, 58, 105, 105, 104, 84, 71, 58, 73, 114, 115, 126, 43, 27, 89, 104, 51, 53, 105, 58, 115, 107, 104, 116, 232, 114, 51, 75, 89, 8, 28, 51, 246, 104, 85, 89, 116, 48, 69, 116, 125, 45, 186, 174, 115, 64, 176, 116, 116, 31, 222, 123, 64, 20, 104, 75, 114, 75, 72, 152, 69, 112, 104, 58, 58, 151, 33, 241, 126, 104, 116, 101, 105, 114, 183, 104, 64, 207, 75, 71, 51, 75, 165, 8, 115, 58, 0, 167, 115, 105, 224, 142, 116, 78, 101, 69, 116, 51, 116, 105, 105, 97, 240, 75, 114, 115, 71, 177, 104, 207, 236, 89, 89, 141, 75, 69, 104, 116, 89, 75, 235, 84, 75, 115, 101, 105, 84, 156, 11, 191, 146, 114, 71, 75, 126, 114, 246, 115, 89, 129, 89, 69, 75, 101, 104, 75, 53, 126, 71, 177, 84, 116, 104, 115, 100, 224, 64, 115, 16, 115, 64, 104, 193, 49, 116, 191, 64, 255, 251, 104, 84, 113, 105, 116, 89, 204, 126, 226, 184, 105, 64, 89, 53, 225, 101, 71, 180, 57, 71, 105, 85, 69, 174, 75, 51, 28, 188, 235, 170, 52, 105, 116, 114, 24, 179]
í`E:@? eTÐshteiaiTG:tKwttG~Tgi¨iEheKà¼rKeGeÍ~K3¥qiEteYs@m:hEDür ì:sh´7hÏir:teEKG::TK:eTGE6tesist~3KrK@EBGðYYeteSeE:G3:rsY@hTYÜzE@rY3Y3³¦:~~GEEGfEeEEe3beYhtY¿hh3s8e~tE@]¯T¤er¹eKY3h8:iihTG:Irs~+Yh35i:skhtèr3K3öhUYt0Et}-º®s@°ttÞ{@hKrKHEph::!ñ~hteir·h@ÏKG3Ks: §siàtNeEt3tiiaðKrsG±hÏìYYKEhtYKëTKseiT¿rGK~rösYYEKehK5~G±Tthsdà@ss@hÁ1t¿@ÿûhTqitYÌ~â¸i@Y5áeG´9GiUE®K3¼ëª4itr³
from collections import CounterList = ['í', '`', 'E', ':', '@', '?', 't', 'e', 'T', 'Ð', 's', 'x15', 'h', 't', 'e', 'i', 'a', 'i', 'x9f', 'T', 'G', ':', 't', 'K', 'w', 't', 'x1f', 't', 'G', '~', 'T', 'g', 'i', 'x8f', '¨', 'i', 'E', 'h', 'e', 'K', 'à', '¼', 'r', 'K', 'e', 'x84', 'G', 'e', 'Í', '~', 'K', 'x92', '3', '¥', 'x80', 'q', 'i', 'x98', 'E', 't', 'e', 'Y', 's', 'x9a', 'x16', '@', 'm', 'x8d', ':', 'h', 'E', 'D', 'ü', 'r', 't', 'ì', ':', 's', 'h', '´', '7', 'h', 'Ï', 'i', 'r', ':', 't', 'e', 'E', 'K', 'G', ':', ':', 'T', 'K', ':', 'e', 'T', 'G', 'E', '6', 't', 'e', 's', 'i', 's', 't', '~', '3', 'K', 'r', 'K', '@', 'E', 'B', 'G', 'ð', 'Y', 'Y', 'e', 't', 'e', 'S', 'e', 'E', ':', 'G', '3', ':', 'r', 's', 'Y', '@', 'h', 'T', 'Y', 'Ü', 'z', 'E', '@', 'r', 'Y', '3', 'Y', '3', '³', '¦', ':', '~', '~', 'G', 'E', 'E', 'G', 'f', 'E', 'x95', 'e', 'E', 'E', 'e', '3', 'b', 'e', 'Y', 'x0b', 'h', 't', 'Y', '¿', 'h', 'h', '3', 's', '8', 'e', '~', 'x05', 't', 'x1f', 'x92', 'E', '@', ']', '¯', 'T', '¤', 'e', 'r', '¹', 'e', 'K', 'Y', '3', 'h', '8', ':', 'i', 'i', 'h', 'T', 'G', ':', 'I', 'r', 's', '~', '+', 'x1b', 'Y', 'h', '3', '5', 'i', ':', 's', 'k', 'h', 't', 'è', 'r', '3', 'K', 'Y', 'x08', 'x1c', '3', 'ö', 'h', 'U', 'Y', 't', '0', 'E', 't', '}', '-', 'º', '®', 's', '@', '°', 't', 't', 'x1f', 'Þ', '{', '@', 'x14', 'h', 'K', 'r', 'K', 'H', 'x98', 'E', 'p', 'h', ':', ':', 'x97', '!', 'ñ', '~', 'h', 't', 'e', 'i', 'r', '·', 'h', '@', 'Ï', 'K', 'G', '3', 'K', '¥', 'x08', 's', ':', 'x00', '§', 's', 'i', 'à', 'x8e', 't', 'N', 'e', 'E', 't', '3', 't', 'i', 'i', 'a', 'ð', 'K', 'r', 's', 'G', '±', 'h', 'Ï', 'ì', 'Y', 'Y', 'x8d', 'K', 'E', 'h', 't', 'Y', 'K', 'ë', 'T', 'K', 's', 'e', 'i', 'T', 'x9c', 'x0b', '¿', 'x92', 'r', 'G', 'K', '~', 'r', 'ö', 's', 'Y', 'x81', 'Y', 'E', 'K', 'e', 'h', 'K', '5', '~', 'G', '±', 'T', 't', 'h', 's', 'd', 'à', '@', 's', 'x10', 's', '@', 'h', 'Á', '1', 't', '¿', '@', 'ÿ', 'û', 'h', 'T', 'q', 'i', 't', 'Y', 'Ì', '~', 'â', '¸', 'i', '@', 'Y', '5', 'á', 'e', 'G', '´', '9', 'G', 'i', 'U', 'E', '®', 'K', '3', 'x1c', '¼', 'ë', 'ª', '4', 'i', 't', 'r', 'x18', '³']List = Counter(List)print(List)# Counter({'t': 25, 'h': 24, 'e': 23, 'K': 22, 'E': 21, 'Y': 20, 'i': 19, 's': 18, ':': 17, 'G': 16, 'r': 15, '3': 14, '@': 13, 'T': 12, '~': 11, 'x1f': 3, 'à': 3, 'x92': 3, 'Ï': 3, '¿': 3, '5': 3, 't': 2, 'a': 2, '¼': 2, '¥': 2, 'q': 2, 'x98': 2, 'x8d': 2, 'ì': 2, '´': 2, 'ð': 2, '³': 2, 'x0b': 2, '8': 2, 'x08': 2, 'x1c': 2, 'ö': 2, 'U': 2, '®': 2, '±': 2, 'ë': 2, 'í': 1, '`': 1, '?': 1, 'Ð': 1, 'x15': 1, 'x9f': 1, 'w': 1, 'g': 1, 'x8f': 1, '¨': 1, 'x84': 1, 'Í': 1, 'x80': 1, 'x9a': 1, 'x16': 1, 'm': 1, 'D': 1, 'ü': 1, '7': 1, '6': 1, 'B': 1, 'S': 1, 'Ü': 1, 'z': 1, '¦': 1, 'f': 1, 'x95': 1, 'b': 1, 'x05': 1, ']': 1, '¯': 1, '¤': 1, '¹': 1, 'I': 1, '+': 1, 'x1b': 1, 'k': 1, 'è': 1, '0': 1, '}': 1, '-': 1, 'º': 1, '°': 1, 'Þ': 1, '{': 1, 'x14': 1, 'H': 1, 'p': 1, 'x97': 1, '!': 1, 'ñ': 1, '·': 1, 'x00': 1, '§': 1, 'x8e': 1, 'N': 1, 'x9c': 1, 'x81': 1, 'd': 1, 'x10': 1, 'Á': 1, '1': 1, 'ÿ': 1, 'û': 1, 'Ì': 1, 'â': 1, '¸': 1, 'á': 1, '9': 1, 'ª': 1, '4': 1, 'x18': 1})
theKEYis:Gr3@T~，成功拿到key，可以解密flag.crypto文件了，这里考察了一个叫做Encrypt的软件，直接拖进去输密码解密得到flag.txt
# -*- coding: utf-8 -*-# @Project: Hello Python# @File : 21-unciode打印# @Author : Tr0jAn <[email protected]># @Date : 2020-12-13code = "💙📟😽😂🍳✉💞📟💞🍸🌀📑🐮🏉😔🐶🌀🍨👈🌴🚅🌼🍸💙💾📥🍑🍑💇"code = code.lower().replace("&#", "0").replace(";", "").split("0x")for i in code[1:]:print(chr(int(i, 16)), end="")# 💙📟😽😂🍳✉💞📟💞🍸🌀📑🐮🏉😔🐶🌀🍨👈🌴🚅🌼🍸💙💾📥🍑🍑💇
base100，codemoji，emoji-aes以及Emoji Cipher等解emoji加密的脚本，逐个尝试发现是codemoji加密，解密得到flag
本文始发于微信公众号（Timeline Sec）：祥云杯2020 线下一血Misc分享
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论