CISCN历年misc复现

[CISCN 2023 初赛]被加密的生产流量

题目描述

某安全部门发现某涉密工厂生产人员偷偷通过生产网络传输数据给不明人员，通过技术手段截获出一段通讯流量，但是其中的关键信息被进行了加密，请你根据流量包的内容，找出被加密的信息。

下载附件

过滤关键字

modbus && frame.len == 66

tcp追踪流

拼接得MMYWMX3GNEYWOXZRGAYDA===

解码

解码得c1f_fi1g_1000

[CISCN 2018]Picture

下载附件

binwalk图片存在东西

foremost提取

打开文件

发现是base编码，base解码

发现存在pk文件

下载附件，010修改文件头

解压压缩包

发现有密码，旁边有提示

[Python 2.7]
>>> ▆▆▆

Traceback (most recent call last):
  File "<pyshell#0>", line 1, in <module>
    ▆▆▆
ZeroDivisionError: ▆▆▆▆▆▆▆▆▆▆▆▆▆▆▆▆▆▆▆▆▆▆▆▆▆▆▆▆▆▆ <- password ;)
>>> 

一看就是0整除报错

integer division or modulo by zero

解压压缩包

打开code文件

uuencode解码

[CISCN 2022 初赛]ez_usb

工具一把梭

得到一串数字

526172211a0700Cf907300000d00000000000000c4527424943500300000002A0000000235b9f9b0530778b5541d3308c50020000000666c61672E747874B9Ba0132357642f3aFC000b092c229d6e994167c055eA78708b271fFC042ae3d251e65536F9Ada5087c77406b67d0E631668476607a86e844dC81AA2c72c714a348d10c43D7B00400700

看着很眼熟，rar十六进制文件

下载保存rar文件，解压rar压缩包

发现有密码，继续中工具里找

压缩包密码就是35c535765e50074a

解压压缩包，打开文本找到flag

[CISCN 2023 初赛]pyshell

题目描述

题目内容：flag在/flag

开启环境

沙箱逃逸

exp:

from pwn import *
r = remote('node5.anna.nssctf.cn', 25898)
r.sendlineafter(b'>>',b"'/flag'")
r.sendlineafter(b'>>',b"open(_)")
r.sendlineafter(b'>>',b"_.read")
r.sendlineafter(b'>>',b"_()")
print(r.recvline())
r.interactive()

运行得到flag

[CISCN 2022 东北]Conversion

下载附件

凯撒解码 偏移6

hex解码

base32解码

base85解码

[CISCN 2022 初赛]everlasting_night

下载附件，通过stegsolve查看图片alpha通道2，发现一串字符 f78dcd383f1b574b

考虑lsb隐写加密码，直接b神工具一把梭

改后缀解压压缩包

发现有密码，010查看图片

png文件末尾十六进制尝试是md5编码，somd5解码

解压压缩包，010查看无后缀文件

发现是png文件，改后缀发现打开看不了，尝试后缀改.data，用gimp打开调整宽352

[CISCN 2021初赛]robot

TCP追踪发现有坐标痕迹

保存整条流量为txt

坐标画图exp:

from PIL import Image
import re

reg = re.compile(r'Value\.\[(\d+),(\d+),(\d+)\]')

with open('data.txt','r') as f:
    data = reg.findall(f.read())
    # print(data)
    # print(len(data))

img = Image.new('1', (400, 400))
for i in data:
    xy = (int(i[0]), int(i[1]))
    img.putpixel(xy, 1)
img.save("md5flag.png")

运行查看图片

md5加密

flag{d4f1fb80bc11ffd722861367747c0f10}

[CISCN 2023 初赛]国粹

下载附件

查看题目.png

按编号排序 1-42，将a图片和k图片进行拼接，a图片每个花色与k的每个花色一一对应，按万字牌、筒字牌、条字牌、花色种类的顺序排序1-42，得到多组坐标

查看另外两个文件

a.png和k.png代表x轴和y轴

exp:

import matplotlib.pyplot as plt

x_coords = [1, 1, 1, 1, 2, 2, 2, 2, 2, 2, 2, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4,
            5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7,
            7, 7, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 9, 9, 9, 9, 9, 9, 10, 10, 12, 12, 12, 12, 13, 13, 13, 13, 13,
            13, 13, 13, 13, 13, 13, 13, 13, 13, 14, 14, 14, 14, 14, 14, 14, 14, 15, 15, 15, 15, 15, 15, 15, 16, 16, 16,
            16, 16, 16, 16, 16, 17, 17, 17, 17, 17, 17, 17, 17, 18, 18, 18, 18, 18, 19, 19, 19, 19, 19, 19, 19, 19, 19,
            19, 19, 19, 19, 19, 19, 19, 19, 20, 20, 22, 22, 22, 22, 22, 22, 22, 22, 22, 22, 22, 22, 23, 23, 23, 23, 23,
            23, 23, 23, 23, 23, 23, 23, 23, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 25, 25, 25, 25, 25, 25, 25, 25, 25,
            25, 25, 26, 26, 26, 26, 26, 26, 26, 26, 26, 26, 27, 27, 27, 27, 27, 27, 27, 27, 27, 27, 27, 28, 28, 28, 28,
            28, 28, 28, 28, 28, 28, 28, 28, 28, 29, 29, 29, 29, 29, 31, 31, 31, 31, 31, 31, 32, 32, 32, 32, 32, 32, 32,
            32, 32, 32, 32, 32, 32, 32, 32, 33, 33, 33, 33, 33, 33, 33, 33, 33, 33, 33, 34, 34, 34, 34, 34, 34, 34, 34,
            34, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 36, 36, 36, 36, 36, 36, 36, 37, 37, 37, 37, 37, 37, 37, 37,
            37, 38, 38, 38, 38, 38, 38, 38, 38, 38, 38, 38, 38, 38, 38, 38, 38, 38, 39, 39, 39]
y_coords = [4, 5, 10, 30, 3, 4, 5, 6, 10, 29, 30, 3, 4, 10, 16, 17, 22, 23, 24, 25, 29, 30, 2, 3, 4, 5, 10, 15, 16, 18,
            21, 22, 24, 25, 29, 30, 3, 4, 10, 15, 17, 18, 19, 20, 22, 25, 28, 29, 3, 4, 10, 15, 16, 18, 19, 21, 22, 25,
            29, 3, 4, 10, 11, 12, 13, 15, 18, 19, 22, 23, 24, 25, 29, 30, 3, 4, 11, 12, 15, 16, 17, 18, 19, 20, 25, 29,
            30, 21, 22, 24, 25, 30, 31, 23, 24, 22, 23, 24, 25, 2, 3, 4, 5, 9, 10, 11, 12, 13, 16, 17, 18, 19, 24, 25,
            2, 5, 6, 9, 12, 19, 23, 24, 5, 9, 12, 18, 19, 22, 23, 4, 5, 9, 12, 17, 18, 23, 23, 24, 3, 4, 9, 12, 16, 17,
            24, 25, 3, 9, 12, 16, 25, 3, 4, 5, 6, 9, 10, 11, 12, 16, 17, 18, 19, 21, 22, 23, 24, 25, 10, 11, 3, 4, 5, 6,
            10, 11, 12, 17, 18, 19, 24, 25, 3, 6, 7, 9, 10, 16, 17, 19, 20, 22, 23, 24, 25, 3, 6, 7, 9, 10, 16, 19, 20,
            24, 25, 3, 6, 7, 10, 11, 12, 16, 19, 20, 20, 24, 25, 3, 6, 7, 12, 13, 16, 19, 20, 24, 25, 3, 6, 7, 9, 12,
            13, 16, 19, 20, 24, 25, 3, 4, 6, 9, 10, 11, 12, 16, 17, 19, 20, 24, 25, 4, 5, 17, 18, 19, 10, 11, 12, 13,
            25, 31, 4, 5, 6, 10, 11, 12, 13, 17, 18, 19, 23, 24, 25, 26, 32, 3, 4, 6, 7, 12, 16, 17, 23, 23, 24, 26, 32,
            6, 7, 11, 16, 17, 23, 24, 26, 32, 6, 11, 12, 17, 18, 19, 23, 24, 25, 26, 33, 5, 12, 13, 4, 5, 13, 16, 19, 20,
            25, 26, 32, 4, 5, 6, 7, 9, 10, 11, 12, 13, 16, 17, 18, 19, 24, 25, 31, 32, 23, 24, 31]

print(len(x_coords))
print(len(y_coords))

plt.scatter(x_coords, y_coords)

plt.title("Scatter Plot")
plt.xlabel("X-axis")
plt.ylabel("Y-axis")

plt.show()

运行得到flag

flag{202305012359}

[CISCN 2021初赛]running_pixel

下载附件

查看文件

gif分离

ps查看图片，背景是(247,247,247)

部分图片有小白点，背景是(233,233,233)

提取所有图片像素

exp:

from PIL import Image
import time
import os

res = Image.new("L", (400, 400), 255)
i = 0
files = os.listdir('4')
for file in files:
    img = Image.open(f"4/{file}").convert("RGB")

    for x in range(img.size[0]):
        for y in range(img.size[1]):
            p = img.getpixel((x, y))
            if p == (233, 233, 233):
                print(i, x, y)
                res.putpixel((y, x), 0)
                # res.save(f"res-{i}.png")
    i += 1
res.save("res.png")

得到图片

CISCN{12504d0f-9de1-4b00-87a5-a5fdd0986a00}

[CISCN 2022 初赛]babydisk

下载附件,diskgenius挂载磁盘文件发现音频文件

音频考虑deepsond解密，发现有密码

deepsond2john破解密码

破解密码为feedback ，查看key.txt

恢复磁盘文件

SECRET文件挂载

得到spiral文件

翻译名字是螺旋

010查看文件发现是pk压缩包

螺旋矩阵解密

from struct import pack

file = open('spiral.zip', 'rb').read()
rotate = 0
match = ((0, 1), (1, 0), (0, -1), (-1, 0))
wall = [0, 86, 86, 0]
sets = (1, -1, -1, 1)
matrix = []
for i in range(87):
    list = []
    for o in range(87):
        list.append(0)
    matrix.append(list)

x = 0
y = 0

for i in file:
    matrix[y][x] = i
    x += match[rotate][1]
    y += match[rotate][0]

    if x > wall[1] or x < wall[3] or y > wall[2] or y < wall[0]:
        x -= match[rotate][1]
        y -= match[rotate][0]
        wall[rotate] += sets[rotate]
        rotate = (rotate + 1) % 4
        x += match[rotate][1]
        y += match[rotate][0]

file3 = open('out.zip', 'wb')
for i in matrix:
    for o in i:
        file3.write(pack('B', o))
file3.close()

运行得到

螺旋排序

最后整理为flag{701fa9fe-63f5-410b-93d4-119f96965be6}

[CISCN 2022 东北]听说这是一个二维码

下载附件，010查看音频文件

发现base编码解码

二次解码

得到密码:ThisI5Passw0rd

Sound from deep –> 来自深处的声音，想到工具DeepSound，拖到工具中，提示输入密码，密码为ThisI5Passw0rd

查看流量文件，发现ip地址只有0和255，我只能想到二维码01

将流量包ip提取变成二进制

exp:

import pyshark

cap = pyshark.FileCapture("./flag.pcap")

bin_str = ""
for c in cap:
    if (bin := c.ip.dst_host.split(".")[-2]) == "0":
        bin_str += bin
    elif bin == "255":
        bin_str += "1"

with open("flag.txt", "w") as f:
    f.write(bin_str)

运行得到

二进制转二维码调整宽高

查看目录里的二维码

扫描二维码

[CISCN 2021初赛]tiny traffic

http导出文件

gzip 解压文件

发现是flag格式

有两个br文件，安装brotli, 解压，发现secret没有变化，test解压得到protobuf文件，猜测是要用protoc反序列化

编译python

protoc test –python_out=./

用这个对secret进行反序列化，把test_pb2.py和反序列化代码放在一个文件夹

exp：

import test_pb2
file = open("secret", "rb")
a = test_pb2.PBResponse()
a.ParseFromString(file.read())
print(a)

运行

拼接字符串脚本

exp:

import test_pb2

file = open("secret", "rb")

a = test_pb2.PBResponse()
a.ParseFromString(file.read())

print(a)

p = ""
p += hex(a.flag_part_convert_to_hex_plz)[2:]
p += a.dataList[0].flag_part
p += a.dataList[1].flag_part
p += hex(a.flag_part_plz_convert_to_hex)[2:]
p += a.flag_last_part

print(p)

运行得到flag

[CISCN 2023 初赛]puzzle

下载附件

拼图但不知道宽高

exp:

import os
files = os.listdir('C:\\Users\\23831\\Desktop\\tmp4\\')
size = []
for file in files:
    with open('C:\\Users\\23831\\Desktop\\tmp4\\'+file,'rb') as fr:
        data = fr.read()
    x = int.from_bytes(data[6:8],'little') #读入tmp文件的自带坐标
    y = int.from_bytes(data[8:10],'little')#little意思为小数据类型，即储存数据时前面的数据储存在高位
    width = int.from_bytes(data[0x12:0x16],'little') #读入图片宽度
    height = 100
    size.append([(y,x),(height,width)]) #以（文件坐标位置）（文件像素大小）为一组数据写入size数组中
sorted_size = sorted(size,key=lambda x:x[0]) #按照第一位进行排序,即（y,x）排序
img_height = sorted_size[-1][0][0] + sorted_size[-1][1][0] #对最后一张图片的像素和坐标进行相加处理，得到最终拼图的宽和高
img_width = sorted_size[-1][0][1] + sorted_size[-1][1][1]
print(img_height,img_width)

运行得到图片正常宽高 4000 7200

对图片进行拼接

exp:

from PIL import Image,ImageOps
import os
exp = Image.open('C:\\Users\\23831\\Desktop\\tmp4\\99765296563.bmp')
image = Image.new(exp.mode,(7200, 4000)) #mode函数保留原本图片文件的色彩格式
files = os.listdir('C:\\Users\\23831\\Desktop\\tmp4\\')
for file in files:
    with open('C:\\Users\\23831\\Desktop\\tmp4\\'+file,'rb') as fr:
        data = fr.read()
    x = int.from_bytes(data[6:8],'little')#读取tmp坐标
    y = int.from_bytes(data[8:10],'little')
    height=int.from_bytes(data[0x16:0x1A],'little',signed=True) # signed：选True、Flase表示是否要区分二进制的正负数含义。即是否要对原二进制数进行原码反码 补码操作
    img = Image.open("C:\\Users\\23831\\Desktop\\tmp4\\" + file)
    if height < 0:
        img=ImageOps.flip(img)
        print('已翻转：',file)
    image.paste(img,(x,y))
image.save('C:\\Users\\23831\\Desktop\\flag.bmp')

运行得到完整图片

lsb隐写

得到第一部分flag:flag{f1R5T_part_1s_LSB_sTeG0_

高度被修改，想着高度有正负，猜测是二进制，提取宽高

exp:

import os
from Crypto.Util.number import long_to_bytes
files = os.listdir('C:\\Users\\23831\\Desktop\\tmp4\\')
s=[]
for file in files:
    with open('C:\\Users\\23831\\Desktop\\tmp4\\'+file,'rb') as fr:
        data = fr.read()
    x = int.from_bytes(data[6:8],'little')#读取tmp坐标
    y = int.from_bytes(data[8:10],'little')
    height=int.from_bytes(data[0x16:0x1A],'little',signed=True)
    bindata='0' if height<0 else '1' #将高度数据转换为二进制的0，1
    s.append([(y,x),bindata])
s=sorted(s,key=lambda x:x[0])#存入数据组，按坐标进行排序
b_flag=''
for i in s:
    b_flag+=i[1]#读入二进制数据
print(long_to_bytes(int(b_flag,2)))#输出第二部分flag

运行得到第二部分flag：2nd_paRT_15_reVeRSe_bMp_

以及摩斯密码:.–. .- -..

摩斯密码解码

pad一般指pad()函数，即填充函数

考虑到bmp文件特性，bmp是按⾏绘制的，每⾏数据都需要为4的倍数，当像素数据不满⾜这个条件时，会⾃动填充相应字节的0。而在这道题中出题人很明显修改了这个填充的值，我们需要把这个值按照拼图的排列方式提取出来。

exp:

import os
files = os.listdir('C:\\Users\\23831\\Desktop\\tmp4\\')
my_data = []
for file in files:
    with open('C:\\Users\\23831\\Desktop\\tmp4\\'+file,'rb') as fr:
        data = fr.read()
    x = int.from_bytes(data[6:8],'little')
    y = int.from_bytes(data[8:10],'little')
    width = int.from_bytes(data[0x12:0x16],'little',signed=True)
    padding_size = 0 if 4- 3*width%4 == 4 else 4- 3*width%4 #计算填充字节
    img_data_size = 3*width#计算数据字节
    length = len(data[54:])#⽂件头占54字节
    img_data = data[54:]
    padding_data = b''#声明是二进制字符串
    for i in range(img_data_size,length,padding_size+img_data_size):
        padding_data += img_data[i:i+padding_size]
    my_data.append([(y,x),padding_data])#先排横坐标，再排纵坐标
sorted_data = sorted(my_data,key=lambda x:x[0])#按拼图顺序排序
padding_msg = b''
for v in sorted_data:
    padding_msg += v[1]
with open('C:\\Users\\23831\\Desktop\\c_flag.jpg','wb') as fw:
    fw.write(padding_msg)

运行得到图片

组合最后flag为flag{f1R5T_part_1s_LSB_sTeG0_2nd_paRT_15_reVeRSe_bMp_3rd_parT_
1s_paddINGINGING}

[CISCN 2021初赛]隔空传话

下载附件得到文本

pdu解码

前四行内容:

+8615030442000：hello,bob!what is the flag?

+10086：the first part of the flag is the first 8 digits of your phone number

+8615030442000：那其他部分呢

+8615030442000：看看你能从这些数据里发现什么？w465

得到第一部分flag:15030442000

1. 第二段flag是后面的pdu解码后，然后根据时间去排序，然后就能够组成一张图片，也就是图片的hex被分开很多段了，然后一段一段通过PDU发送，然后根据时间去进行排序。

exp：

from time import strptime,mktime
from smspdu.codecs import GSM
from binascii import unhexlify
with open('data2.txt') as f:
    lines = f.readlines()
    mydic = {}
    for line in lines:
        Year = '20' + line[34:36][::-1]
        Month = line[36:38][::-1]
        Day = line[38:40][::-1]
        Hour = line[40:42][::-1]
        Minute = line[42:44][::-1]
        Second = line[44:46][::-1]
        time = '{}-{}-{} {}:{}:{}'.format(Year, Month, Day, Hour, Minute, Second)
        timestamp = int(mktime(strptime(time, r"%Y-%m-%d %H:%M:%S")))
        mydic[lines.index(line)] = timestamp
    mydic = sorted(mydic.items(), key=lambda item: item[1], reverse=False)
    with open('flag.png','wb') as f:
        for line_num in mydic:
            line_num = line_num[0]
            pducode = lines[line_num][50:330]
            data = GSM.decode(pducode)
            if len(data) == 160:
                f.write(unhexlify(data))
            else:
                pass

得到图片

修改宽高得到第二部分flag

flag{15030442_b586_4c9e_b436_26def12293e4}

[CISCN 2022 东北]涂色板

下载附件，文件与 0x20 异或后得到 jpg 文件

steghide隐写，爆破密码

for num in {0001..9999}; do steghide extract -sf xor.jpg -p $num -xf $num.txt; done

密码1235

问题

暴力算法算邻接矩阵

exp:

matrix = [
    [0, 1, 0, 0, 0, 1, 1, 0],
    [1, 0, 1, 0, 0, 0, 0, 0],
    [0, 1, 0, 1, 1, 0, 0, 0],
    [0, 0, 1, 0, 1, 0, 0, 0],
    [0, 0, 1, 1, 0, 1, 0, 1],
    [1, 0, 0, 0, 1, 0, 1, 1],
    [1, 0, 0, 0, 0, 1, 0, 0],
    [0, 0, 0, 0, 1, 1, 0, 0]
]
color = [0, 0, 0, 0, 0, 0, 0, 0]
total = 0

for i in range(1, 6):
    color[0] = i
    for j in range(1, 6):
        color[1] = j
        for k in range(1, 6):
            color[2] = k
            for l in range(1, 6):
                color[3] = l
                for m in range(1, 6):
                    color[4] = m
                    for n in range(1, 6):
                        color[5] = n
                        for o in range(1, 6):
                            color[6] = o
                            for p in range(1, 6):
                                color[7] = p
                                flag = 1
                                for q in range(8):
                                    for r in range(8):
                                        if matrix[q][r] == 1:
                                            if color[q] == color[r]:
                                                flag = 0
                                                break
                                if flag:
                                    total += 1
print(total)

运行得到最后结果为27540

md5加密

最后flag为flag{f10424d2b1cbf840765291e98f4ea293}

[CISCN 2022 东北]pixel

下载附件

压缩包密码就是 258523871198

解压压缩包得到dat文件，使用b神工具查看文件是什么类型

改后缀zip

看旁边有提示，是二进制，二进制转字符串

exp：

  import libnum

a = 0b10110010110111101110101010111110100001101100001011011100110111001101111011101000101111101100110011010010110111001100100010111110110100101110100

print(libnum.n2s(a))

运行得到密码 You_Cannot_find_it

解压压缩包

PixelJihad 隐写