[XMAN2018排位賽]通行證

a2FuYmJyZ2doamx7emJfX19ffXZ0bGFsbg==
base64
kanbbrgghjl{zb____}vtlaln
柵欄密碼加密，每組7位
kzna{blnl_abj_lbh_trg_vg}
凱撒密碼，移位13
xman{oyay_now_you_get_it}

[XMAN2018排位賽]file

先用volatility測試了下，提示沒有推薦的操作系統

記錄下文件掛載+extundelete恢復文件的操作

mount掛載鏡像

掛載到mnt233文件夾下

mount 233.img mnt233

貓貓狗狗的照片，沒啥東西

取消掛載

umount -a 233.img

用extundelete恢復下刪除的文件

extundelete恢復文件

恢復所有文件

extundelete 233.img --restore-all

在同目錄生成RECOVERED_FILES文件夾，發現被刪除的文件，得到flag

[XMAN2018排位賽]AutoKey

鍵盤流量

直接用UsbKeyboardDataHacker跑一下

python UsbKeyboardDataHacker.py attachment.pcapng

可以得知是autokey加密

密文

mplrvffczeyoujfjkybxgzvdgqaurkxzolkolvtufblrnjesqitwahxnsijxpnmplshcjbtyhzealogviaaissplfhlfswfehjncrwhtinsmambvexo<DEL>pze<DEL>iz

處理一下密文，把<DEL>前面字母的刪去

處理后

mplrvffczeyoujfjkybxgzvdgqaurkxzolkolvtufblrnjesqitwahxnsijxpnmplshcjbtyhzealogviaaissplfhlfswfehjncrwhtinsmambvexpziz

autokey

爆破autokey使用方法看這篇文章里的內容

misc工具合集

https://www.cnblogs.com/LEOGG321/p/13735458.html

klen8得到可讀的語句

HELLOBOYSANDGIRLSYOUARESOSMARTTHATYOUCANFINDTHEFLAGTHATIHIDEINTHEKEYBOARDPACKAGEFLAGISJHAWLZKEWXHNCDHSLWBAQJTUQZDXZQPF

flag為FLAGIS后面的部分

[XMAN2018排位賽]ppap

流量分析

分析流量包

TCP流6發現可疑信息

保存成origin.data下來去010editor分析。wireshark里很卡

文件分成了三個部分，分別用一句話和~~~~分割

yaaaaaaaar, land ho!Hey wesley, you got that flag?Ayy, I got yer files right here, matey!

/9j/4AAQSkZJRgABAQAAAQABAAD/2wBDAAIBAQEBAQIBAQECAgICAgQDAgICAgUEBAMEBgUGBgYF......中間省略ANp1gR4ry3FNnC3T49fVNDgV7hQ66vYjtqfgWA4onj52Tx+P7+psawHHHOUlzw4qJsg//n1//9k=
↑↑↑解得jpg圖片

~~~~
UEsDBAoACQAAAOFTLkk/gs0NNAAAACgAAAAIABwAZmxhZy50eHRVVAkAA1aJ2Ve2h9xXdXgLAAEE
6AMAAAToAwAAYrToA9yED6vL2Axm/JqV6236iHl0zKXB4CdAaOW9O+8glqQHuFocXUiDWXHqA+VH
KkR0E1BLBwg/gs0NNAAAACgAAABQSwECHgMKAAkAAADhUy5JP4LNDTQAAAAoAAAACAAYAAAAAAAB
AAAAtIEAAAAAZmxhZy50eHRVVAUAA1aJ2Vd1eAsAAQToAwAABOgDAABQSwUGAAAAAAEAAQBOAAAA
hgAAAAAA
↑↑↑解得zip文件

And here be the map to the booty!

PD94bWwgdmVyc2lvbj0iMS4wIj8+CjxvcGVuY3Zfc3RvcmFnZT4KPGNhc2NhZGU+CiAgPHN0YWdl......中間省略ZT4KPC9vcGVuY3Zfc3RvcmFnZT4K
↑↑↑解得xml文檔

I don't understand, this isn't even a ma-Yarrrr, the booty be buried by that which the map points to! (no spaces and no caps)Ayy, now I be off. But remember, the factor of scales be 1.02, and the neighborly sorts be limited to 50! Lastly, if ye sail the seven seas, you do be a pirate!

分別對其進行base64處理

jpg圖片