『杂项』Invoke-PSImage取证

其本质上使用的是图片隐写技术中相对简单的最低有效位隐写（LSB）的方式进行数据隐藏，采用嵌入的方式，将有效的shellcode隐藏到每个像素点中的两个颜色通道中的四个低位中去。

for ($counter = 0; $counter -lt ($rgbValues.Length)/3; $counter++) {            if ($counter -lt $payload.Length){                $paybyte1 = [math]::Floor($payload[$counter]/16)                $paybyte2 = ($payload[$counter] -band 0x0f)                $paybyte3 = ($randb[($counter+2)%109] -band 0x0f)            } else {                $paybyte1 = ($randb[$counter%113] -band 0x0f)                $paybyte2 = ($randb[($counter+1)%67] -band 0x0f)                $paybyte3 = ($randb[($counter+2)%109] -band 0x0f)            }            $rgbValues[($counter*3)] = ($rgbValues[($counter*3)] -band 0xf0) -bor $paybyte1            $rgbValues[($counter*3+1)] = ($rgbValues[($counter*3+1)] -band 0xf0) -bor $paybyte2            $rgbValues[($counter*3+2)] = ($rgbValues[($counter*3+2)] -band 0xf0) -bor $paybyte3        }

from PIL import Imagedef solove_png(image_path):    img = Image.open(image_path)    width, height = img.size    extract_data = bytearray()    for y in range(height):        for x in range(width):            pixels = img.getpixel((x, y))            extract_byte = (pixels[1] & 0x0F) | ((pixels[2] & 0x0F) << 4)            extract_data.append(extract_byte)    return extract_dataimage_path = "flag.png"data = solove_png(image_path)with open('1.bin', 'wb') as f:    f.write(data)