adworld_misc_4

[TOC]

Steganography

Keyword

格式为QCTF{xxxxxxx}

工具题

livz/cloacked-pixel: LSB steganography and detection

注意是python2环境噢。

1
python2 lsb.py extract 2ec5f2fe4139477781bb61070b8470a6.png 1.txt lovekfc

得到1.txt

1
PVSF{vVckHejqBOVX9C1c13GFfkHJrjIQeMwf}

Keyword Cipher密码

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
import string

def decode_nihilist_cipher():
    txt = 'PVSF{vVckHejqBOVX9C1c13GFfkHJrjIQeMwf}'
    table = 'LOVEKFCABDGHIJMNPQRSTUWXY'
    flag = ''

    for i in txt:
        if i in string.ascii_lowercase:
            # 在table的小写版本中查找索引
            index = table.lower().index(i)
            # 使用相同索引的ASCII小写字母替换
            flag += string.ascii_lowercase[index]
            continue
        if i in string.ascii_uppercase:
            # 在table的大写版本中查找索引
            index = table.upper().index(i)
            # 使用相同索引的ASCII大写字母替换
            flag += string.ascii_uppercase[index]
            continue
        # 非字母字符直接保留
        flag += i
    
    return flag

result = decode_nihilist_cipher()
print(f"{result}")

QCTF{cCgeLdnrIBCX9G1g13KFfeLNsnMRdOwf}

picture2

质量一般

pngcheck直接报错，根本不是png

HxD看一下发现是jpg，改了

binwalk分离出一个小的zlib数据，base64解码看到了PK，于是to hex再保存，改一下文件头即可，需要密码

1
2
3
4
5
6
7
8
[Python 2.7]
>>> ▆▆▆

Traceback (most recent call last):
  File "<pyshell#0>", line 1, in <module>
    ▆▆▆
ZeroDivisionError: ▆▆▆▆▆▆▆▆▆▆▆▆▆▆▆▆▆▆▆▆▆▆▆▆▆▆▆▆▆▆ <- password ;)
>>>

注意到文件的注释，密码是integer division or modulo by zero

解密得到code

1
2
3
4
begin 644 key.txt
G0TE30TY[,C,X.$%&,C@Y,T5".#5%0C%"-#,Y04)&1C8Q-S,Q.49]
`
end

随波逐流一把梭，是UUEncode。

可得CISCN{2388AF2893EB85EB1B439ABFF617319F}

test.pyc

flag格式为flag{}

1
uncompyle6 e4453dcdab2b4e50a83b7aef231e8650.pyc > e4453dcdab2b4e50a83b7aef231e8650.py

反编译得到

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
# uncompyle6 version 3.9.3
# Python bytecode version base 2.7 (62211)
# Decompiled from: Python 3.12.7 | packaged by conda-forge | (main, Oct  4 2024, 16:05:46) [GCC 13.3.0]
# Embedded file name: test.py
# Compiled at: 2016-10-19 09:08:27

-- Stacks of completed symbols:
START ::= |- stmts . 
and ::= expr . JUMP_IF_FALSE_OR_POP expr COME_FROM
and ::= expr . jmp_false expr \e_come_from_opt
and ::= expr . jmp_false expr come_from_opt
assert ::= assert_expr . jmp_true LOAD_ASSERT RAISE_VARARGS_1
assert2 ::= assert_expr . jmp_true LOAD_ASSERT expr CALL_FUNCTION_1 RAISE_VARARGS_1
assert_expr ::= expr . 
assert_expr_and ::= assert_expr . jmp_false expr
assert_expr_or ::= assert_expr . jmp_true expr
assign ::= expr . DUP_TOP designList
assign ::= expr . store
assign2 ::= expr . expr ROT_TWO store store
assign3 ::= expr . expr expr ROT_THREE ROT_TWO store store store
aug_assign1 ::= expr . expr inplace_op ROT_FOUR STORE_SLICE+3
aug_assign1 ::= expr . expr inplace_op ROT_THREE STORE_SLICE+1
aug_assign1 ::= expr . expr inplace_op ROT_THREE STORE_SLICE+2
aug_assign1 ::= expr . expr inplace_op ROT_THREE STORE_SUBSCR
aug_assign1 ::= expr . expr inplace_op ROT_TWO STORE_SLICE+0
aug_assign1 ::= expr . expr inplace_op store
aug_assign2 ::= expr . DUP_TOP LOAD_ATTR expr inplace_op ROT_TWO STORE_ATTR
bin_op ::= expr . expr binary_operator
buildclass ::= LOAD_CONST . expr mkfunc CALL_FUNCTION_0 BUILD_CLASS
call ::= expr . CALL_FUNCTION_0
call_stmt ::= expr . POP_TOP
classdefdeco1 ::= expr . classdefdeco1 CALL_FUNCTION_1
classdefdeco1 ::= expr . classdefdeco2 CALL_FUNCTION_1
compare_chained ::= expr . compared_chained_middle ROT_TWO POP_TOP \e__come_froms
compare_chained ::= expr . compared_chained_middle ROT_TWO POP_TOP _come_froms
compare_single ::= expr . expr COMPARE_OP
delete ::= expr . DELETE_ATTR
delete_subscript ::= expr . expr DELETE_SUBSCR
expr ::= LOAD_CONST . 
expr_jitop ::= expr . JUMP_IF_TRUE_OR_POP
expr_jt ::= expr . jmp_true
if_exp ::= expr . jmp_false expr JUMP_ABSOLUTE expr
if_exp ::= expr . jmp_false expr JUMP_FORWARD expr COME_FROM
if_exp_lambda ::= expr . jmp_false expr return_if_lambda return_stmt_lambda LAMBDA_MARKER
if_exp_not ::= expr . jmp_true expr _jump expr COME_FROM
if_exp_not_lambda ::= expr . jmp_true expr return_if_lambda return_stmt_lambda LAMBDA_MARKER
if_exp_true ::= expr . JUMP_FORWARD expr COME_FROM
import ::= LOAD_CONST . LOAD_CONST alias
import_from ::= LOAD_CONST . LOAD_CONST IMPORT_NAME importlist POP_TOP
import_from_star ::= LOAD_CONST . LOAD_CONST IMPORT_NAME IMPORT_STAR
importmultiple ::= LOAD_CONST . LOAD_CONST alias imports_cont
mkfuncdeco ::= expr . mkfuncdeco CALL_FUNCTION_1
mkfuncdeco ::= expr . mkfuncdeco0 CALL_FUNCTION_1
print_items_nl_stmt ::= expr . PRINT_ITEM \e_print_items_opt PRINT_NEWLINE_CONT
print_items_nl_stmt ::= expr . PRINT_ITEM print_items_opt PRINT_NEWLINE_CONT
print_items_stmt ::= expr . PRINT_ITEM \e_print_items_opt
print_items_stmt ::= expr . PRINT_ITEM print_items_opt
print_nl_to ::= expr . PRINT_NEWLINE_TO
print_to ::= expr . print_to_items POP_TOP
print_to_nl ::= expr . print_to_items PRINT_NEWLINE_TO
raise_stmt1 ::= expr . RAISE_VARARGS_1
raise_stmt2 ::= expr . expr RAISE_VARARGS_2
raise_stmt3 ::= expr . expr expr RAISE_VARARGS_3
ret_and ::= expr . JUMP_IF_FALSE_OR_POP return_expr_or_cond COME_FROM
ret_or ::= expr . JUMP_IF_TRUE_OR_POP return_expr_or_cond COME_FROM
return ::= return_expr . RETURN_VALUE
return_expr ::= expr . 
return_expr_lambda ::= return_expr . RETURN_VALUE_LAMBDA
return_expr_lambda ::= return_expr . RETURN_VALUE_LAMBDA LAMBDA_MARKER
slice0 ::= expr . DUP_TOP SLICE+0
slice0 ::= expr . SLICE+0
slice1 ::= expr . expr DUP_TOPX_2 SLICE+1
slice1 ::= expr . expr SLICE+1
slice2 ::= expr . expr DUP_TOPX_2 SLICE+2
slice2 ::= expr . expr SLICE+2
slice3 ::= expr . expr expr DUP_TOPX_3 SLICE+3
slice3 ::= expr . expr expr SLICE+3
subscript ::= expr . expr BINARY_SUBSCR
subscript2 ::= expr . expr DUP_TOPX_2 BINARY_SUBSCR
testfalse ::= expr . jmp_false
testtrue ::= expr . jmp_true
unary_convert ::= expr . UNARY_CONVERT
unary_not ::= expr . UNARY_NOT
unary_op ::= expr . unary_operator
with ::= expr . SETUP_WITH POP_TOP \e_suite_stmts_opt POP_BLOCK LOAD_CONST COME_FROM_WITH WITH_CLEANUP END_FINALLY
with ::= expr . SETUP_WITH POP_TOP suite_stmts_opt POP_BLOCK LOAD_CONST COME_FROM_WITH WITH_CLEANUP END_FINALLY
with_as ::= expr . SETUP_WITH store \e_suite_stmts_opt POP_BLOCK LOAD_CONST COME_FROM_WITH WITH_CLEANUP END_FINALLY
with_as ::= expr . SETUP_WITH store suite_stmts_opt POP_BLOCK LOAD_CONST COME_FROM_WITH WITH_CLEANUP END_FINALLY
yield ::= expr . YIELD_VALUE
Instruction context:
-> 
 L.   1         0  LOAD_CONST               '=cWbihGfyMzNllzZ'
                   3  NOP              
                   4  NOP              
                   5  NOP              
                   6  LOAD_CONST               '0cjZzMW'
                   9  LOAD_CONST               'N5cTM4Y'
                  12  LOAD_CONST               'jYygTOy'
                  15  LOAD_CONST               'cmNycWNyYmM1Ujf'
                  18  BINARY_ADD       
                  19  STORE_NAME            0  'str'

直接拼接字符串

1
=cWbihGfyMzNllzZ0cjZzMWN5cTM4YjYygTOycmNycWNyYmM1Ujf

很明显先reverse再base64，

1
~552f25g26g2982b681795c3f74g9e732|hbmg

再反转，是ASCII Casear，密钥1.

1
2
3
4
5
key = 1
cipher = "gmbh|237e9g47f3c597186b2892g62g52f255"
plain = ''.join([chr(ord(c) - key) for c in cipher])
flag = f"{{{plain}}}"
print(flag)

flag{126d8f36e2b486075a1781f51f41e144}

Avatar

一个恐怖份子上传了这张照片到社交网络。里面藏了什么信息?

工具题，outguess

安装方法参考https://0xmouise.github.io/2025/09/16/OutGuess%20%E5%AE%89%E8%A3%85%E4%B8%8E%E9%97%AE%E9%A2%98%E6%8E%92%E6%9F%A5%E6%8C%87%E5%8D%97%EF%BC%88Kali%20Linux%20%E7%8E%AF%E5%A2%83%EF%BC%89/index.html

1
2
outguess -r 035bfaa85410429495786d8ea6ecd296.jpg -t flag.txt
cat flag.txt

flag是We should blow up the bridge at midnight

qr-easy

直接看官wp吧，挺难的。

SECCON{PSwIQ9d9GjKTdD8H}

message

答辩

give_you_flag

菜狗找到了文件中的彩蛋很开心，给菜猫发了个表情包

随波逐流一把梭，分帧，49.png发现二维码，截图去掉无关背景，加定位符自动解码

flag{e7d478cf6b915f50ab1277f78502a2c5}

stegano

题目有问题

坚持60s

菜狗发现最近菜猫不爱理他，反而迷上了菜鸡

有点意思，strings搜索不到，于是反编译了

1
java -jar jd-gui.jar

在PlaneGameFrame.class下发现：

flag{RGFqaURhbGlfSmlud2FuQ2hpamk=}

base64解码可得flag{DajiDali_JinwanChiji}

gif

菜狗截获了一张菜鸡发给菜猫的动态图，却发现另有玄机

题目还行

很多jpg，黑白黑白的，一开始还以为是二维码，不过数量不够

直接01就行

01100110011011000110000101100111011110110100011001110101010011100101111101100111011010010100011001111101

转Hex转ASCII即flag{FuN_giF}

掀桌子

菜狗截获了一份报文如下c8e9aca0c6f2e5f3e8c4efe7a1a0d4e8e5a0e6ece1e7a0e9f3baa0e8eafae3f9e4eafae2eae4e3eaebfaebe3f5e7e9f3e4e3e8eaf9eaf3e2e4e6f2，生气地掀翻了桌子(╯°□°）╯︵ ┻━┻

显然Hex太大，减去0x80即可

1
2
3
4
hex = "c8e9aca0c6f2e5f3e8c4efe7a1a0d4e8e5a0e6ece1e7a0e9f3baa0e8eafae3f9e4eafae2eae4e3eaebfaebe3f5e7e9f3e4e3e8eaf9eaf3e2e4e6f2"
bytes_data = bytes.fromhex(hex)
decoded = bytes([b ^ 0x80 for b in bytes_data])
print(decoded)

得到Hi, FreshDog! The flag is: hjzcydjzbjdcjkzkcugisdchjyjsbdfr，flag{hjzcydjzbjdcjkzkcugisdchjyjsbdfr}

双色块

意义不大，可参考https://blog.csdn.net/2402_87950092/article/details/156432220

ewm

答辩中的答辩

crc

答辩

Time_losing

同上

catnim

catnim

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
from pwn import *
import re

def nim_optimal_move(piles):
    xor_all = 0
    for p in piles:
        xor_all ^= p
    if xor_all == 0:
        # 必败态，随便取一个石子
        for i, p in enumerate(piles):
            if p > 0:
                return i, 1  # 取1个
        return None
    # 必胜态
    for i, p in enumerate(piles):
        target = p ^ xor_all
        if target < p:
            return i, p - target
    return None

def main():
    conn = remote('61.147.171.105', 56541)
    
    print(conn.recvuntil('(Y/N)?').decode())
    conn.sendline('N')
    
    while True:
        try:
            data = conn.recvuntil('where:').decode()
            print(data)
            
            # 解析石子堆
            if 'Now pile:' in data:
                piles_str = data.split('Now pile:')[1].split('where:')[0]
                piles = list(map(int, re.findall(r'\d+', piles_str)))
            else:
                # 可能是AI行动后的输出，再收一次
                data2 = conn.recvuntil('where:', timeout=2).decode()
                print(data2)
                piles = list(map(int, re.findall(r'\d+', data2.split('Now pile:')[1])))
            
            print(f"当前石子堆: {piles}")
            
            # 计算最优走法
            move = nim_optimal_move(piles)
            if move is None:
                print("无解")
                break
            
            heap_idx, take = move
            # 题目使用0-based索引
            print(f"发送: {heap_idx} {take}")
            conn.sendline(f"{heap_idx} {take}")
            
            # 接收响应
            resp = conn.recvline(timeout=2).decode()
            print(f"响应: {resp}")
            
            if "flag" in resp.lower():
                print("找到flag!")
                print(resp)
                # 继续接收剩余输出
                print(conn.recvall(timeout=2).decode())
                break
                
        except EOFError:
            print("连接结束")
            try:
                print(conn.recvall(timeout=2).decode())
            except:
                pass
            break
        except Exception as e:
            print(f"错误: {e}")
            break
    
    conn.close()

if __name__ == '__main__':
    main()

cyberpeace{30719ab44cab56aeaf22a8126283e0a3}

miao~

猫猫真的很可爱捏~

jpg，foremost得到音频，频谱隐写了CatCTF，疑似密钥

工具题

DeepSound

https://gitcode.com/open-source-toolkit/e746d/?utm_source=tools_gitcode&index=top&type=card&uuid_tt_dd=10_18658958940-1766417359606-988113&from_id=141944208&from_link=7f9d205bef721a7b0219600578f476e3

分离出flag.txt，得到

1
~呜喵喵喵喵呜呜啊呜啊呜喵呜呜~喵啊喵啊喵啊呜喵呜~~~喵~呜喵啊喵啊喵喵喵呜呜~呜~呜喵呜呜啊啊~呜啊喵啊呜喵呜呜啊~喵~呜呜喵喵~喵喵喵呜呜呜喵~呜喵呜呜啊~呜啊啊喵啊呜喵呜呜喵~喵~呜喵呜~~喵喵喵呜啊呜啊喵呜喵呜呜啊~呜啊啊喵啊呜~啊喵~~喵~呜呜喵喵喵喵喵喵呜啊呜呜~呜喵呜呜~喵~喵啊喵啊呜~~啊啊~喵~呜呜喵喵啊喵喵喵呜呜呜呜~呜喵呜呜~呜啊~啊喵啊呜~~啊啊~喵~呜呜喵喵呜喵喵喵呜啊喵呜喵呜喵呜呜啊呜啊啊啊喵啊呜喵喵呜啊~喵~呜喵呜喵喵喵喵喵呜啊喵喵呜呜喵呜呜~喵~啊啊喵啊呜~~啊啊~喵~呜喵呜~啊喵喵喵呜呜~喵啊呜喵呜呜啊啊呜喵啊喵啊呜~呜~喵~喵~呜呜喵喵喵喵喵喵呜啊喵喵啊呜喵呜呜~呜呜呜啊喵啊呜喵呜啊喵啊

随波逐流一把梭，当兽音译者解码可得CatCTF{d0_y0u_Hate_c4t_ba3k1ng_?_M1ao~}

Forensics

mysql

我们在Mysql数据库中存放了flag，但是黑客已经把它删除了。你能找回来flag吗？

这题目有点意思但是可以秒

1
2
3
grep -r -a "flag"
#  -r 表示当前目录下递归搜索
# -a 表示二进制文件当作文本处理

搜索结果可见flag。flag即71e55075163d5c6410c0d9eae499c977

Disk

这题还可

需要先下载FTK挂载vmdk，在flag0.txt-flag3.txt可以发现有一个ads文件，提取一下01字符串

1
2
3
4
0110011001101100011000010110011101
1110110011010001000100010100110101
1111001100010110111001011111010001
0000110001011100110110101101111101

flag{4DS_1n_D1sk}

Cat_Jump

你说的对，但是Cat_Jump是由CatCTF自主研发的一款Linux小游戏。游戏发生在一个被称作「虚拟机」的幻想世界，在这里，被神选中的人将被授予「cat_jump」，导引进入系统。你将扮演一只名为「OpenCore」的神秘角色，在自由的旅行中邂逅性格各异、能力独特的出题人，和他们一起击败强敌，找回失散的Flag——同时，逐步发掘「Cat_Jump」的真相。

emm，直接grep

1
2
3
4
5
6
7
8
9
10
11
grep -r -a "CatCTF{"
^[[O2.img:echo CatCTF{EFI_1sv3ry_funn9} | openssl aes-128-cbc -pbkdf2 -base64 -k cat_jump
2.img:echo CatCTF{EFI_1sv3ry_funn9} | openssl aes-128-cbc -pbkdf2 -base64 -k /sys/firmware/efi/efivars/CatCTF-7c436110-ab2a-4bbb-a880-fe41995c9f82
2.img:echo CatCTF{EFI_1sv3ry_f/**
2.img:echo CatCTF{EFI_1sv3ry_funn9} | openssl aes-128-cbc -k cat_jump -base64
2.img:echo CatCTF{EFI_1sv3ry_funn9} | openssl aes-128-cbc -k cat_jump -pbkdf2 -base64
^[[I^[[Ocat_jump_clean.vmdk:echo CatCTF{EFI_1sv3ry_funn9} | openssl aes-128-cbc -k cat_jump -base64
cat_jump_clean.vmdk:echo CatCTF{EFI_1sv3ry_funn9} | openssl aes-128-cbc -k cat_jump -pbkdf2 -base64
cat_jump_clean.vmdk:echo CatCTF{EFI_1sv3ry_funn9} | openssl aes-128-cbc -pbkdf2 -base64 -k cat_jump
cat_jump_clean.vmdk:echo CatCTF{EFI_1sv3ry_funn9} | openssl aes-128-cbc -pbkdf2 -base64 -k /sys/firmware/efi/efivars/CatCTF-7c436110-ab2a-4bbb-a880-fe41995c9f82
cat_jump_clean.vmdk:echo CatCTF{EFI_1sv3ry_f/**

CatCTF{EFI_1sv3ry_funn9}