GKCTF2021部分wp

男娘i 2022-10-10 12:46 225阅读 0赞

***Misc***

### 签到 ###

过滤http流量,找到cat /f4g的流量，再追踪http流，可以发现末尾有一串16进制数:  
![在这里插入图片描述][20210628144147169.png]

拿到这串十六进制数去解码，在base64解码得到:  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzkyMzEzNg_size_16_color_FFFFFF_t_70]  
我们可以看到这串“==QIhM0QDN0Q”的顺序反了,由此猜测我们要把这串编码全部反着来：

a="wIDIgACIgACIgAyIK0wIjMyIjMyIjMyIjMyIjMyIjMyIjMyIjMyIjMyIjMyIjMyIjMyIjMiCNoQD"
    b="jMyIjMyIjMyIjMyIjMyIjMyIjMyIjMyIjMyIjoQDjACIgACIgACIggDM6EDM6AjMgAzMtMDMtEjM"
    c="t0SLt0SLt0SLt0SLt0SLt0SLt0SLt0SLt0SLt0SLt0SLt0SLt0SLt0SLt0iCNMyIjMyIjMyIjMyI"
    d="6AjMgAzMtMDMtEjMwIjO0eZ62ep5K0wKrQWYwVGdv5EItAiM1Aydl5mK6M6jlfpqnrQDt0SLt0SL"
    e="t0SLt0SLt0SLt0SLt0SLt0SLt0SLt0SLt0SLt0SLt0SLt0SLt0SLK0AIdZavo75mlvlCNMTM6EDM"
    f="z0yMw0SMyAjM6Q7lpb7lmrQDrsCZhBXZ09mTg0CIyUDI3VmbqozoPW+lqeuCN0SLt0SLt0SLt0SL"
    g="sxWZld1V913e7d2ZhFGbsZmZg0lp9iunbW+Wg0lp9iunbW+Wg0lp9iunbW+WK0wMxoTMwoDMyACM"
    h="DN0QDN0QDlWazNXMx0Wbf9lRGRDNDN0ard0Rf9VZl1WbwADIdRampDKilvFIdRampDKilvVKpM2Y"
    j="==QIhM0QDN0Q"
    print(a[::-1])
    print(b[::-1])
    print(c[::-1])
    print(d[::-1])
    print(e[::-1])
    print(f[::-1])
    print(g[::-1])
    print(h[::-1])
    print(j[::-1])

得到的base64编码再次解码，最后处理一下即可得到flag

### apng ###

分解apng，从中找到四张二维码进行一些操作后扫码得到flag  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzkyMzEzNg_size_16_color_FFFFFF_t_70_pic_center]  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzkyMzEzNg_size_16_color_FFFFFF_t_70_pic_center 1]  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzkyMzEzNg_size_16_color_FFFFFF_t_70_pic_center 2]

### execl骚操作 ###

Excel中发现有部分格子被隐藏了信息 1 ，于是联想到可能是张二维码，将其标注 1 的填充黑色  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzkyMzEzNg_size_16_color_FFFFFF_t_70 1]  
发现是汉信码，利用工具中国编码APP扫描得到flag

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzkyMzEzNg_size_16_color_FFFFFF_t_70 2]

[20210628144147169.png]: /images/20221005/41df1becbd6f40399e808921ccb18a4d.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzkyMzEzNg_size_16_color_FFFFFF_t_70]: /images/20221005/c4d5541519dc4362bac833b012f520ab.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzkyMzEzNg_size_16_color_FFFFFF_t_70_pic_center]: /images/20221005/2e33022f1a194dd19328c98bf7ea91e4.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzkyMzEzNg_size_16_color_FFFFFF_t_70_pic_center 1]: /images/20221005/cd1560a1359b4a0c961b31cc4b8c07b4.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzkyMzEzNg_size_16_color_FFFFFF_t_70_pic_center 2]: /images/20221005/ae5acabd9f6a4e51b20a579d69e40b79.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzkyMzEzNg_size_16_color_FFFFFF_t_70 1]: /images/20221005/08787a7c6b514ccdb186b2b3c72ada5e.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzkyMzEzNg_size_16_color_FFFFFF_t_70 2]: /images/20221005/3b6aeb606567439bb4b202cf61e66b2c.png