buuctf

大白 | png圖片改高度
png圖片改高度
[外鏈圖片轉存失敗(img-PojN2D3v-1567086301372)(evernotecid://74A3E6DA-E009-4797-AA60-5DEED9FE4F7A/appyinxiangcom/23464203/ENResource/p2321)]
基礎破解 | archpr爆破
你竟然趕我走 | 打開
010editor打開 最后面flag
ningen | easy
binwalk
foremost
爆破
LSB | ss
[外鏈圖片轉存失敗(img-3ZEH1eki-1567086301372)(evernotecid://74A3E6DA-E009-4797-AA60-5DEED9FE4F7A/appyinxiangcom/23464203/ENResource/p2322)]
[外鏈圖片轉存失敗(img-73OkHr5k-1567086301373)(evernotecid://74A3E6DA-E009-4797-AA60-5DEED9FE4F7A/appyinxiangcom/23464203/ENResource/p2323)]
save bin
二維碼掃描
rar | archpr爆破
qr | 二維碼掃描
烏鎮峰會種圖 | 記事本打開
wireshark | 導出http對象
導出http對象
搜索flag
[外鏈圖片轉存失敗(img-yRdrxVGS-1567086301373)(evernotecid://74A3E6DA-E009-4797-AA60-5DEED9FE4F7A/appyinxiangcom/23464203/ENResource/p2324)]
找到password
文件中的秘密 | 右鍵屬性
假如給我三天光明
盲文
wav文件
audacity打開
摩爾斯密碼
來首歌吧 | 摩爾斯密碼
鏡子里面的世界 | ss
[外鏈圖片轉存失敗(img-hwXdn7em-1567086301374)(evernotecid://74A3E6DA-E009-4797-AA60-5DEED9FE4F7A/appyinxiangcom/23464203/ENResource/p2325)]
愛因斯坦
binwalk
foremost
圖片屬性
this_is_not_password
為解壓密碼
小明的保險箱
binwalk
foremost
爆破四位數字密碼
FLAG
ss打開
[外鏈圖片轉存失敗(img-KTNksaov-1567086301375)(evernotecid://74A3E6DA-E009-4797-AA60-5DEED9FE4F7A/appyinxiangcom/23464203/ENResource/p2326)]
save bin
解壓縮 一個elf文件
ida打開看到hctf
strings 1 | grep “hctf”
easycap
追蹤tcp流
被嗅探的流量
導出http對象
一個php文件 實際上不是php 用010editor打開 十六進制視圖
flag
梅花香之苦寒來
010editor打開 后面很多0-9 a-f
with open('1.txt','r') as h:
    h=h.read()
bb = ''
tem=''
for i in range(0,len(h),2):
    tem='0x'+h[i]+h[i+1]
    tem=int(tem,base=16)
    bb += (chr(tem))

with open('2.txt','w') as ff:
 ff.write(bb)
1234567891011
[外鏈圖片轉存失敗(img-YNWznUSR-1567086301375)(evernotecid://74A3E6DA-E009-4797-AA60-5DEED9FE4F7A/appyinxiangcom/23464203/ENResource/p2327)]
with open('2.txt','r') as f:
 f = f.read()
b = open('3.txt','w')
for i in f.split('\n'):
 b.write(i.lstrip('(').rstrip(')').replace(',',' ')+'\n')
12345
[外鏈圖片轉存失敗(img-bveFTjxS-1567086301375)(evernotecid://74A3E6DA-E009-4797-AA60-5DEED9FE4F7A/appyinxiangcom/23464203/ENResource/p2328)]
gnuplot
plot ‘3.txt’
https://tu.sioe.cn/gj/huidu/
灰度處理
后門查殺
d盾掃一下
[外鏈圖片轉存失敗(img-whpjC0No-1567086301376)(evernotecid://74A3E6DA-E009-4797-AA60-5DEED9FE4F7A/appyinxiangcom/23464203/ENResource/p2329)]
snake
binwalk
foremost
base64
https://blog.csdn.net/zz_Caleb/article/details/91973626
http://serpent.online-domain-tools.com/
[外鏈圖片轉存失敗(img-Xyvb5Jvq-1567086301376)(evernotecid://74A3E6DA-E009-4797-AA60-5DEED9FE4F7A/appyinxiangcom/23464203/ENResource/p2330)]
a = '''C T F { w h o _ k n e w _ s e r
p e n t _ c i p h e r _ e x i s
t e d } .'''
print a.replace(' ','').replace(' ','').replace('\n','')
1234
荷蘭寬帶數據泄露
RouterPassView
打開
搜索username
九連環
binwalk
foremost
steghide info xx.jpg
steghide extract -sf xx.jpg
ko.txt
解壓
另外一個世界
記事本打開
最后010
八個一組 轉字符
import binascii

a = '''01101011
01101111
01100101
01101011
01101010
00110011
01110011'''
b = ''
for ii in a.split('\n'):
 b += chr(int(ii,2))
print b
12345678910111213
神秘龍卷風
爆破
++++++.>+++++++++++++
ook
brainfuck
https://www.splitbrain.org/services/ook
面具下的flag
binwalk
foremost
7z解壓vmdk
7z x filename
https://www.splitbrain.org/services/ook
刷新過的圖片
F5-steganography
java Extract ./Misc.jpg -e misc
得到一個壓縮包 偽加密直接解壓
穿越時空的思念
audacity 打開
摩爾斯密碼
Mysterious ✨
輸入
122xyz
od也應該可以
webshell后門
d盾掃描
隱藏的鑰匙
記事本
搜索flag
數據包中的線索
導出http對象
由開頭”/9j/”，可知以下數據為jpg圖片，“/9j/”經base64解碼后結果為“\xff \xd8 \xff”，該三字節為jpg文件的開頭三字節，所以可推斷出以下文件為jpg文件。
data:image/jpeg;base64,
瀏覽器
菜刀666
導出http對象
壓縮包 需要密碼
圖片 畫着密碼
https://4hou.win/wordpress/?paged=2&cat=1023
喵喵喵
ss得到png
[外鏈圖片轉存失敗(img-BSze7Mml-1567086301376)(evernotecid://74A3E6DA-E009-4797-AA60-5DEED9FE4F7A/appyinxiangcom/23464203/ENResource/p2331)]
[外鏈圖片轉存失敗(img-thOxtvcm-1567086301377)(evernotecid://74A3E6DA-E009-4797-AA60-5DEED9FE4F7A/appyinxiangcom/23464203/ENResource/p2332)]
修改高度
[外鏈圖片轉存失敗(img-hvbdSnNI-1567086301377)(evernotecid://74A3E6DA-E009-4797-AA60-5DEED9FE4F7A/appyinxiangcom/23464203/ENResource/p2333)]
win10畫圖 反色
掃描二維碼
下載一個壓縮包
只能用winrar解壓
ntfstreamseditor掃描
pyc文件
https://tool.lu/pyc/
反編譯 得到加密腳本和c 逆向
def decrypt(c):
    c = c[::-1]
    flag = ''
    for i in range(len(c)):
        if i%2 == 0:
            s = int(c[i])-10
        else:
            s = int(c[i])+10
        s = chr(s^i)
        flag += s
    return flag
1234567891011
弱口令
壓縮包打開 注釋中不可見字符
復制到sublime text3 全選 顯示摩爾斯密碼
解碼 轉大寫
解壓
lsb隱寫
lsb.py
蜘蛛俠呀 ✨
時間隱寫
https://coxxs.me/642
http://yulige.top/?p=236
tshark -r out.pcap -T fields -e data >out.txt
lines = open("out00.txt",'rb').readlines()
files = open("out01.txt","wb")
for line in lines:
 files.write(line.strip().decode('hex'))
files.close()
12345

import base64
lines = open("out0.txt",'rb').readlines()
file1 = open("new",'wb')
result = ''
for line in lines[4:-4]:
 result += line[9:].strip()
file1.write(base64.b64decode(result))

'''
result = ''
lines = open("out.txt",'rb').readlines()
print lines[4:-4]
'''
1234567891011121314
a = open("out01.txt",'rb').readlines()
file1 = open("result1",'wb')
for i in range(len(a)):
 bb = a[i].strip()
 if bb == a[i-1].strip():
  continue
 file1.write(bb+'\n')
1234567
解壓  flag.gif
identify -format “%T” flag.gif
[外鏈圖片轉存失敗(img-W46ai2jZ-1567086301377)(evernotecid://74A3E6DA-E009-4797-AA60-5DEED9FE4F7A/appyinxiangcom/23464203/ENResource/p2334)]
明顯的二進制了，把20換0，把50換1.
binary轉hex轉ascii碼
# coding:utf-8
import binascii
import hashlib
# import base64
# lines = open('result1.txt','rb').readlines()
# file = open('file','wb')
# flag = ''
# for line in lines[1:-1]:
#  flag += line[9:]
# file.write(base64.b64decode(flag))

a = open("11",'r')
b = a.read().replace("“",'').replace("”","").replace("20",'0').replace("50",'1').replace('6','')

bb = binascii.unhexlify(hex(int(b,2))[2:-1])
print 'flag{'+hashlib.md5(bb).hexdigest()+'}'
12345678910111213141516
identify -format “%s %T \n” flag.gif
我愛Linux
https://www.cnblogs.com/puluotiya/p/5462114.html
https://www.cnblogs.com/harmonica11/p/11365782.html
python序列化文件的數據
將FF D9后保存出來，將序列化文件讀出來
import pickle
with open('q', 'rb') as f:
    f= pickle.load(f)
data = list()
for i in range(len(f)):
    tem = [' ']*100
    data.append(tem)
for i, j in enumerate(f):
    for m in j:
        data[i][m[0]] = m[1]
for i in data:
    print(''.join(i))
123456789101112
[外鏈圖片轉存失敗(img-gNVt98SV-1567086301378)(evernotecid://74A3E6DA-E009-4797-AA60-5DEED9FE4F7A/appyinxiangcom/23464203/ENResource/p2335)]
usb ✨
https://wenku.baidu.com/view/b7889b64783e0912a2162aa4.html
rar文件結構
[外鏈圖片轉存失敗(img-swFxOcqG-1567086301378)(evernotecid://74A3E6DA-E009-4797-AA60-5DEED9FE4F7A/appyinxiangcom/23464203/ENResource/p2336)]
[外鏈圖片轉存失敗(img-69v6RI79-1567086301380)(evernotecid://74A3E6DA-E009-4797-AA60-5DEED9FE4F7A/appyinxiangcom/23464203/ENResource/p2337)]
https://blog.csdn.net/like98k/article/details/79533536
https://blog.csdn.net/qq_36609913/article/details/78578406
https://www.mygeocachingprofile.com/codebreaker.vigenerecipher.aspx
mappings = { 0x04:"A",  0x05:"B",  0x06:"C", 0x07:"D", 0x08:"E", 0x09:"F", 0x0A:"G",  0x0B:"H", 0x0C:"I",  0x0D:"J", 0x0E:"K", 0x0F:"L", 0x10:"M", 0x11:"N",0x12:"O",  0x13:"P", 0x14:"Q", 0x15:"R", 0x16:"S", 0x17:"T", 0x18:"U",0x19:"V", 0x1A:"W", 0x1B:"X", 0x1C:"Y", 0x1D:"Z", 0x1E:"1", 0x1F:"2", 0x20:"3", 0x21:"4", 0x22:"5",  0x23:"6", 0x24:"7", 0x25:"8", 0x26:"9", 0x27:"0", 0x28:"\n", 0x2a:"[DEL]",  0X2B:"    ", 0x2C:" ",  0x2D:"-", 0x2E:"=", 0x2F:"[",  0x30:"]",  0x31:"\\", 0x32:"~", 0x33:";",  0x34:"'", 0x36:",",  0x37:"." }
nums = []
keys = open('usbdata.txt')
for line in keys:
    if line[0]!='0' or line[1]!='0' or line[3]!='0' or line[4]!='0' or line[9]!='0' or line[10]!='0' or line[12]!='0' or line[13]!='0' or line[15]!='0' or line[16]!='0' or line[18]!='0' or line[19]!='0' or line[21]!='0' or line[22]!='0':
 continue
    nums.append(int(line[6:8],16))
keys.close()
output = ""
for n in nums:
    if n == 0 :
        continue
    if n in mappings:
        output += mappings[n]
    else:
        output += '[unknown]'
print 'output :\n' + output

 

output :
KEYXINAN
[Finished in 0.1s]

123456789101112131415161718192021222324
binwalk xxx
foremost xxx
tshark -r key.pcap -T fields -e usb.capdata > usbdata.txt
ci{v3erf_0tygidv2_fc0}
fa{i3eei_0llgvgn2_sc0}
柵欄
flag{vig3ne2e_is_c00l}
sqltest  未完成
import requests
import os
import urllib
import re
oo = []
pp = []
a = os.listdir('.')
for ii in a:
 vv = open(ii,'r')
 if "This's Title!" in vv.read() and 'ascii(substr(((select concat_ws(char(94), flag)' in urllib.unquote(ii):
  oo.append(urllib.unquote(ii))
for ii in oo:
 # print ii
 # print ii[ii.find('>')+1:]
 print re.findall(r', (.*?),',ii)[1]
123456789101112131415
被劫持的神秘禮物
http過濾
追蹤tcp流
import hashlib
print hashlib.md5('adminaadminb').hexdigest()
————————————————
版權聲明：本文為CSDN博主「mo0rain」的原創文章，遵循 CC 4.0 BY-SA 版權協議，轉載請附上原文出處鏈接及本聲明。
原文鏈接：https://blog.csdn.net/qq_41173457/article/details/100147514