ctf：[GDOUCTF 2023]Magic of Encoding

每日一练：NSSCTF | 在线CTF平台

打开附件发现是一大堆字母，看到结尾2个等号，于是base64解码得到了一堆：

flag{Xd_fake_flag_xD}find_me_if_you_canfind_me_if_you_canflag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}find_me_if_you_canfind_me_if_you_canflag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}find_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canflag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}find_me_if_you_canfind_me_if_you_canflag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{not_the_correct_flag_lol}
flag{not_the_correct_flag_lol}
flag{not_the_correct_flag_lol}
flag{not_the_correct_flag_lol}flag{not_the_correct_flag_lol}flag{not_the_correct_flag_lol}flag{not_the_correct_flag_lol}flag{not_the_correct_flag_lol}flag{not_the_correct_flag_lol}flag{not_the_correct_flag_lol}flag{not_the_correct_flag_lol}flag{not_the_correct_flag_lol}flag{not_the_correct_flag_lol}flag{not_the_correct_flag_lol}flag{not_the_correct_flag_lol}flag{not_the_correct_flag_lol}flag{not_the_correct_flag_lol}flag{not_the_correct_flag_lol}flag{not_the_correct_flag_lol}flag{not_the_correct_flag_lol}flag{not_the_correct_flag_lol}flag{not_the_correct_flag_lol}flag{not_the_correct_flag_lol}flag{not_the_correct_flag_lol}flag{not_the_correct_flag_lol}flag{not_the_correct_flag_lol}flag{not_the_correct_flag_lol}flag{not_the_correct_flag_lol}flag{not_the_correct_flag_lol}flag{not_the_correct_flag_lol}flag{not_the_correct_flag_lol}flag{not_the_correct_flag_lol}flag{not_the_correct_flag_lol}flag{not_the_correct_flag_lol}flag{not_the_correct_flag_lol}flag{Xd_fake_flag_xD}find_me_if_you_canfind_me_if_you_canflag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}find_me_if_you_canfind_me_if_you_canflag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}find_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canflag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}find_me_if_you_canfind_me_if_you_canflag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}find_me_if_you_canfind_me_if_you_canflag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}find_me_if_you_canfind_me_if_you_canflag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}find_me_if_you_canfind_me_if_you_canflag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}find_me_if_you_canfind_me_if_you_canflag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}find_me_if_you_canflag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}find_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canflag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}find_me_if_you_canflag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}find_me_if_you_canflag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}flag{Xd_fake_flag_xD}find_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canflag{not_the_correct_flag_lol}
flag{not_the_correct_flag_lol}
flag{not_the_correct_flag_lol}
flag{not_the_correct_flag_lol}flag{not_the_correct_flag_lol}flag{not_the_correct_flag_lol}flag{not_the_correct_flag_lol}flag{not_the_correct_flag_lol}flag{not_the_correct_flag_lol}flag{not_the_correct_flag_lol}flag{not_the_correct_flag_lol}flag{not_the_correct_flag_lol}flag{not_the_correct_flag_lol}flag{not_the_correct_flag_lol}flag{not_the_correct_flag_lol}flag{not_the_correct_flag_lol}flag{not_the_correct_flag_lol}flag{not_the_correct_flag_lol}flag{not_the_correct_flag_lol}flag{not_the_correct_flag_lol}flag{not_the_correct_flag_lol}flag{not_the_correct_flag_lol}flag{not_the_correct_flag_lol}flag{not_the_correct_flag_lol}flag{not_the_correct_flag_lol}flag{not_the_correct_flag_lol}flag{not_the_correct_flag_lol}flag{not_the_correct_flag_lol}flag{not_the_correct_flag_lol}flag{not_the_correct_flag_lol}flag{not_the_correct_flag_lol}flag{not_the_correct_flag_lol}flag{not_the_correct_flag_lol}flag{not_the_correct_flag_lol}flag{not_the_correct_flag_lol}find_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canfind_me_if_you_canflag{Xd_fake_flag_xD}find_me_if_you_canPK

 （其实实际很长，但是复制过来就是这样），看到结尾有个PK，说明它实际上是个压缩包。

里面有一堆fakeflag和find_me_if_you_can，没什么用。于是我们把这些假的flag都翻译为对应的base64编码形式然后在原文中对应，再把这些全部删掉（记事本的全部替换），就能得到最终的附件应该为：

UEsDBBQACAAIAAZUilYAAAAAAAAAACUAAAAVACAATWFnaWMgb2YgRW5jb2RpbmcudHh0VVQNAAdNkTNkTpEzZE2RM2R1eAsAAQT1AQAABBQAAABLy0lMr84wKDCOrzQojc/JzDZOiS/JSI33NUnPTI43L8pMzq7lAgBQSwcIjmX6WicAAAAlAAAAUEsBAhQDFAAIAAgABlSKVo5l+lonAAAAJQAAABUAIAAAAAAAAAAAAKSBAAAAAE1hZ2ljIG9mIEVuY29kaW5nLnR4dFVUDQAHTZEzZE6RM2RNkTNkdXgLAAEE9QEAAAQUAAAAUEsFBgAAAAABAAEAYwAAAIoAAAAAAA==

 看最后的部分开头是UEs，这是一个经过Base64编码的UE格式（Universal Extractor format）的压缩文件内容。UEs是Universal Extractor的签名，通常用于表示一个被压缩的文件或一组文件。这也验证了之前看到的PK代表为压缩包。

于是我们把它解压缩解码，代码附上（AI）：
 

import base64
import zipfile
import io

# 你提供的Base64编码字符串
encoded_string = "UEsDBBQACAAIAAZUilYAAAAAAAAAACUAAAAVACAATWFnaWMgb2YgRW5jb2RpbmcudHh0VVQNAAdNkTNkTpEzZE2RM2R1eAsAAQT1AQAABBQAAABLy0lMr84wKDCOrzQojc/JzDZOiS/JSI33NUnPTI43L8pMzq7lAgBQSwcIjmX6WicAAAAlAAAAUEsBAhQDFAAIAAgABlSKVo5l+lonAAAAJQAAABUAIAAAAAAAAAAAAKSBAAAAAE1hZ2ljIG9mIEVuY29kaW5nLnR4dFVUDQAHTZEzZE6RM2RNkTNkdXgLAAEE9QEAAAQUAAAAUEsFBgAAAAABAAEAYwAAAIoAAAAAAA=="
# 解码Base64字符串
decoded_data = base64.b64decode(encoded_string)

# 使用BytesIO创建一个内存中的文件对象
with io.BytesIO(decoded_data) as bio:
    try:
        # 使用zipfile模块打开这个内存中的文件对象
        with zipfile.ZipFile(bio, 'r') as zip_ref:
            # 打印ZIP文件中的所有文件名
            print("ZIP文件内的文件列表：")
            zip_ref.printdir()

            # 提取所有文件到当前工作目录
            extract_path = './extracted_files'
            zip_ref.extractall(extract_path)
            print(f"文件已成功解压到 {extract_path}")
    except zipfile.BadZipFile:
        print("解码后的数据不是一个有效的ZIP文件。")

就能在当前文件夹里找到提取文件

点开那个extracted file

 ok，得到flag，注意改一下前缀。

总的来说，这道题思路和意图很直接，没有太多拐弯抹角的地方，就是有点麻烦，就看你能不能想到把附件中多余的那些内容删掉，再看出来实际上是个压缩包。我个人认为一般看到了PK就是压缩包，别问为什么，我也不知道。