2023西湖论剑复现

Misc

mp3

MP3stego分析一下，没有密码
binwalk分离出一张图片

分析觉得把黑白做01分离出来有东西
结果分离出一个压缩包，mp3解出的就是压缩包密码

import cv2  # h, w, c
import numpy
import matplotlib.pyplot as plt

img = cv2.imread("bjq.png", 1)
print("图像的形状,返回一个图像的(行数,列数,通道数):", img.shape)
print("图像的像素数目:", img.size)
print("图像的数据类型:", img.dtype)
# img = cv2.resize(img,(280,280))    可以改变图片的大小

fname = open("ngsu.txt", 'w')
fname.write("图像的形状,返回一个图像的(行数,列数,通道数):" + str(img.shape) + '\n')
fname.write("图像的像素数目:" + str(img.size) + '\n')
fname.write("图像的数据类型:" + str(img.dtype) + '\n')
Xlenth = img.shape[1]  # 图片列数454
Ylenth = img.shape[0]  # 图片行数439

a = 1
for i in range(Ylenth):
    # fname.write(str(a) + ':'+'\n')
    for j in range(Xlenth):
        if str(img[i][j][1]) == '0':
            fname.write('0')
        else:
            fname.write('1')
    # for j in range(Xlenth):
    #     fname.write(str(img[i][j])+' ')
    # a += 1
    # fname.write('\n')
fname.close()

cv2.imshow('image', img)
cv2.waitKey(0)
cv2.destroyAllWindows()

2lO,.j2lL000iZZ2[2222iWP,.ZQQX,2.[002iZZ2[2020iWP,.ZQQX,2.[020iZZ2[2022iWLNZQQX,2.[2202iW2,2.ZQQX,2.[022iZZ2[2220iWPQQZQQX,2.[200iZZ2[202iZZ2[2200iWLNZQQX,2.[220iZZ2[222iZZ2[2000iZZ2[2002iZZ2Nj2]20lW2]20l2ZQQX,2]202.ZW2]02l2]20,2]002.XZW2]22lW2]2ZQQX,2]002.XZWWP2XZQQX,2]022.ZW2]00l2]20,2]220.XZW2]2lWPQQZQQX,2]002.XZW2]0lWPQQZQQX,2]020.XZ2]20,2]202.Z2]00Z2]02Z2]2j2]22l2]2ZWPQQZQQX,2]022.Z2]00Z2]0Z2]2Z2]22j2]2lW2]000X,2]20.,2]20.j2]2W2]2W2]22ZQ-QQZ2]2020ZWP,.ZQQX,2]020.Z2]2220ZQ--QZ2]002Z2]220Z2]020Z2]00ZQW---Q--QZ2]002Z2]000Z2]200ZQ--QZ2]002Z2]000Z2]002ZQ--QZ2]002Z2]020Z2]022ZQ--QZ2]002Z2]000Z2]022ZQ--QZ2]002Z2]020Z2]200ZQ--QZ2]002Z2]000Z2]220ZQLQZ2]2222Z2]2000Z2]000Z2]2002Z2]222Z2]020Z2]202Z2]222Z2]2202Z2]220Z2]2002Z2]2002Z2]2202Z2]222Z2]2222Z2]2202Z2]2022Z2]2020Z2]222Z2]2220Z2]2002Z2]222Z2]2020Z2]002Z2]202Z2]2200Z2]200Z2]2222Z2]2002Z2]200Z2]2022Z2]200ZQN---Q--QZ2]200Z2]000ZQXjQZQ-QQXWXXWXj

根据文件名47，rot47解密

a=~[];a={___:++a,aaaa:(![]+"")[a],__a:++a,a_a_:(![]+"")[a],_a_:++a,a_aa:({}+"")[a],aa_a:(a[a]+"")[a],_aa:++a,aaa_:(!""+"")[a],a__:++a,a_a:++a,aa__:({}+"")[a],aa_:++a,aaa:++a,a___:++a,a__a:++a};a.a_=(a.a_=a+"")[a.a_a]+(a._a=a.a_[a.__a])+(a.aa=(a.a+"")[a.__a])+((!a)+"")[a._aa]+(a.__=a.a_[a.aa_])+(a.a=(!""+"")[a.__a])+(a._=(!""+"")[a._a_])+a.a_[a.a_a]+a.__+a._a+a.a;a.aa=a.a+(!""+"")[a._aa]+a.__+a._+a.a+a.aa;a.a=(a.___)[a.a_][a.a_];a.a(a.a(a.aa+"\""+a.a_a_+(![]+"")[a._a_]+a.aaa_+"\\"+a.__a+a.aa_+a._a_+a.__+"(\\\"\\"+a.__a+a.___+a.a__+"\\"+a.__a+a.___+a.__a+"\\"+a.__a+a._a_+a._aa+"\\"+a.__a+a.___+a._aa+"\\"+a.__a+a._a_+a.a__+"\\"+a.__a+a.___+a.aa_+"{"+a.aaaa+a.a___+a.___+a.a__a+a.aaa+a._a_+a.a_a+a.aaa+a.aa_a+a.aa_+a.a__a+a.a__a+a.aa_a+a.aaa+a.aaaa+a.aa_a+a.a_aa+a.a_a_+a.aaa+a.aaa_+a.a__a+a.aaa+a.a_a_+a.__a+a.a_a+a.aa__+a.a__+a.aaaa+a.a__a+a.a__+a.a_aa+a.a__+"}\\\"\\"+a.a__+a.___+");"+"\"")())();

JSfuck run一下或者F12

take_the_zip_easy

明文攻击

2b7d78f3 0ebcabad a069728c

导出HTTP流，发现一个flag压缩包（有密码），找到解密算法

<?php
function encode($D,$K){
    for($i=0;$i<strlen($D);$i++){
        $c = $K[$i+1&15];
        $D[$i] = $D[$i]^$c;
    }
    return $D;
}

$pass='air123';
$payloadName='payload';
$key='d8ea7326e6ec5916';
$data = 'J+5pNzMyNmU2mij7dMD/qHMAa1dTUh6rZrUuY2l7eDVot058H+AZShmyrB3w/OdLFa2oeH/jYdeYr09l6fxhLPMsLeAwg8MkGmC+Nbz1+kYvogF0EFH1p/KFEzIcNBVfDaa946G+ynGJob9hH1+WlZFwyP79y4/cvxxKNVw8xP1OZWE3';
$decode = encode(base64_decode($data),$key);
echo base64_encode(gzdecode($decode));
?>

即可得到flag

机你太美

npbk文件，导入夜神模拟器
打开后发现有pin码
连接adb shell到目录data/system删除相应文件

rm /data/system/locksettings.db
rm /data/system/locksettings.db-shm
rm /data/system/locksettings.db-wal
rm /data/system/gatekeeper.password.key
rm /data/system/gatekeeper.pattern.key

重启后发现很多压缩包和两张图片
第一张图片
第二张图片

用官方给的脚本

from PIL import Image

img = Image.open('solved.png').convert('RGBA')
a, b = img.size
flag = ''
for x in range(a):
    for y in range(b):
        pixel = img.getpixel((x, y))
        if x == 400:
            r, g, b, alpha = pixel
            if alpha == 251:
                flag += '0'
            elif alpha == 255:
                flag += '1'

print(flag)
# 0110010100110000001100010011010100110100001101000110000100111001001100110011001100110011011001010110011000110110001100100110000100110011011000010110000100110010001101110011001100110101001101110110010101100010001101010011001001100101011000010011100001100001

e01544a9333ef62a3aa27357eb52ea8a

Isolated Machine Memory Analysis

volatility工具

Web

扭转乾坤

删除data

参考

官方wp
2023西湖论剑wirteup