BaseCTF week3 （web&misc 部分）wp

BaseCTF week3

杂项

[Week3] 白丝上的flag

描述：某出题人赠送大家flag时遭遇了信号干扰, 幸好我们在不知名小网站找到了写入flag前的图片, 尝试还原信息吧!

提示：flag是单色

附件：

#task.pyfrom PIL import Image
from random import randint
import sys

defez_add(a,b,c,d):global iv
    h =(a+b+c+d+iv)%256
    e = b
    f = c
    g = d
    iv =(b+c+d+iv)%256return e,f,g,h

defconfuse(data):
    r,g,b,a = data
    for _ inrange(8):
        r,g,b,a = ez_add(r,g,b,a)return r,g,b,a

defconfuse_image(flag):global iv
    iv = flag.getpixel((1,1))[0]
    img = Image.new('RGBA',(flag.width, flag.height))for w inrange(img.width):for h inrange(img.height):
            img.putpixel((w, h), confuse(flag.getpixel((w,h))))return img

if __name__ =='__main__':
    iv =0
    flag = Image.open("./de_image.png")
    img = confuse_image(flag)
    img.save("en_image.png")

解密思路:

1. 逆向 confuse 函数: 由于 confuse 函数是对像素进行简单的加法运算，我们可以通过逆向运算来解密。
2. 单色图像特点: 单色图像的每个像素的 RGB 值都相同，我们可以利用这个特点来简化解密过程。

脚本：

from PIL import Image

defez_sub(h, e, f, g):global iv
    a =(h - e - f - g - iv)%256
    iv =(e + f + g + iv)%256return a

defunconfuse(data):
    r, g, b, a = data
    for _ inrange(8):
        r = ez_sub(r, g, b, a)return r, g, b, a

defunconfuse_image(img):global iv
    iv = img.getpixel((1,1))[0]
    flag = Image.new('RGBA',(img.width, img.height))for w inrange(img.width):for h inrange(img.height):
            flag.putpixel((w, h), unconfuse(img.getpixel((w, h))))return flag

if __name__ =='__main__':
    iv =0
    img = Image.open("en_image.png")
    flag = unconfuse_image(img)
    flag.save("de_image_decrypted.png")

得到de_image_decrypted.png，使用Stegsolve.jar查看

red plane 0

发现flag

BaseCTF{there_1s_the_flag@}

[Week3] 纯鹿人

附件：

cGFzc3dvcmTvvJppa3VuaWt1bg==

base64解码
password：ikunikun

这里我一开始的思路就是将文档中的表情包保存下来使用WinHex打开，并没用什么发现，然后搜索发现可能是使用jphs，但是最后发现不行

没用思路就暂时放弃了

后面就是在群里看见有人讨论上周

[Week2]哇！珍德食泥鸭

的另一种解法

于是我试着将文档改为zip后缀，发现

将其丢尽WinHex编辑器中得到

使用foremost进行分离得到一个新的zip文件，密码为

ikunikun

，即可得到flag

CTF-MISC隐写总结_ctf mp4隐写-CSDN博客

[Week3] 我要吃火腿！

附件：

#我要吃火腿！.txt

~呜嗷嗷嗷嗷呜啊嗷呜~呜嗷呜呜~嗷~嗷啊嗷啊呜嗷嗷嗷呜~嗷~呜嗷嗷~~嗷嗷嗷呜啊呜啊~呜嗷呜呜~嗷呜啊啊嗷啊呜嗷呜~呜~嗷~呜嗷~~啊嗷嗷嗷呜啊呜啊啊呜嗷呜呜~嗷嗷嗷啊嗷啊呜嗷呜~~~嗷~呜呜嗷呜~嗷嗷嗷呜呜~嗷啊呜嗷呜呜~嗷~~啊嗷啊呜嗷嗷~嗷~嗷~呜呜嗷~嗷嗷嗷嗷呜呜嗷啊~呜嗷呜呜~嗷嗷嗷啊嗷啊呜嗷嗷啊呜~嗷~呜呜呜~~嗷嗷嗷呜啊呜啊嗷呜嗷呜呜~呜啊~啊嗷啊呜~~啊啊~嗷~呜呜嗷呜呜嗷嗷嗷呜啊嗷~嗷呜嗷呜呜~嗷嗷~啊嗷啊呜嗷嗷嗷嗷~嗷~呜嗷嗷啊~嗷嗷嗷呜呜嗷嗷~呜嗷呜呜~嗷呜啊啊嗷啊呜嗷呜嗷嗷~嗷~呜呜呜嗷~嗷嗷嗷呜啊呜嗷~呜嗷呜呜~呜~嗷啊嗷啊呜嗷呜~~~嗷~呜嗷~~啊嗷嗷嗷呜啊嗷啊呜呜嗷呜呜~嗷嗷嗷啊嗷啊呜嗷嗷呜~~嗷~呜呜嗷呜嗷嗷嗷嗷呜呜嗷~嗷呜嗷呜呜啊呜嗷呜啊嗷啊呜啊啊呜呜~嗷~呜嗷嗷~~嗷嗷嗷呜呜嗷嗷~呜嗷呜呜啊嗷呜~啊嗷啊呜~嗷啊~~嗷~呜呜嗷呜~嗷嗷嗷呜啊嗷呜嗷呜嗷呜呜~嗷呜嗷啊嗷啊呜~~啊啊~嗷~呜呜嗷嗷呜嗷嗷嗷呜啊呜~嗷呜嗷呜呜~呜啊~啊嗷啊呜嗷嗷嗷嗷~嗷~呜呜呜嗷啊嗷嗷嗷呜呜嗷嗷~呜嗷呜呜啊呜呜嗷啊嗷啊呜~嗷啊~~嗷~呜嗷~啊啊嗷嗷嗷呜呜呜嗷~呜嗷呜呜~呜~~啊嗷啊呜~呜~~~嗷~呜嗷呜呜~嗷嗷嗷呜呜嗷~~呜嗷呜呜啊嗷呜~啊嗷啊呜~呜啊~~嗷~呜呜呜呜~嗷嗷嗷呜呜呜啊呜呜嗷呜呜啊呜啊嗷啊嗷啊呜~嗷呜~~嗷~呜嗷嗷~~嗷嗷嗷呜呜呜嗷~呜嗷呜呜~呜~~啊嗷啊呜~呜嗷呜~嗷~呜嗷啊嗷~嗷嗷嗷呜呜~嗷嗷呜嗷呜呜呜啊嗷呜啊嗷啊呜~嗷啊~~嗷~呜嗷嗷~~嗷嗷嗷呜呜嗷嗷~呜嗷呜呜啊嗷呜~啊嗷啊呜啊啊呜呜~嗷~呜嗷嗷~~嗷嗷嗷呜呜嗷嗷~呜嗷呜呜啊嗷呜~啊嗷啊呜~嗷啊~~嗷~呜呜呜呜啊嗷嗷嗷呜啊嗷~嗷呜嗷呜呜~呜啊~啊嗷啊呜嗷嗷嗷~~嗷~呜嗷嗷~~嗷嗷嗷呜啊嗷嗷啊呜嗷呜呜~呜呜~啊嗷啊呜嗷嗷嗷嗷~嗷~呜呜嗷~呜嗷嗷嗷呜呜嗷啊~呜嗷呜呜~嗷嗷嗷啊嗷啊呜嗷嗷啊呜~嗷~呜呜呜~~嗷嗷嗷呜啊呜啊嗷呜嗷呜呜~呜啊~啊嗷啊呜~~啊啊~嗷~呜呜嗷呜呜嗷嗷嗷呜啊嗷~嗷呜嗷呜呜~嗷嗷~啊嗷啊呜嗷嗷嗷嗷~嗷~呜嗷嗷啊~嗷嗷嗷呜呜嗷嗷~呜嗷呜呜啊嗷~啊啊嗷啊呜嗷呜~呜~嗷~呜呜嗷嗷呜嗷嗷嗷呜呜嗷啊啊呜嗷呜呜啊嗷嗷嗷啊嗷啊呜~嗷啊~~嗷~呜呜嗷嗷嗷嗷嗷嗷呜啊呜呜啊呜嗷呜呜啊嗷呜~啊嗷啊呜嗷嗷嗷呜~嗷~呜嗷呜啊呜嗷嗷嗷呜嗷啊~呜呜嗷呜呜啊嗷呜~啊嗷啊呜~嗷啊~~嗷~呜嗷嗷~~嗷嗷嗷呜呜嗷嗷~呜嗷呜呜啊嗷呜~啊嗷啊呜~嗷啊~~嗷~呜嗷嗷~~嗷嗷嗷呜呜嗷嗷~呜嗷呜呜~嗷啊~啊嗷啊呜嗷嗷~嗷~嗷~呜呜呜嗷~嗷嗷嗷呜啊嗷呜嗷呜嗷呜呜啊嗷呜~啊嗷啊呜~呜啊嗷~嗷~呜嗷嗷~~嗷嗷嗷呜啊嗷呜呜呜嗷呜呜~呜嗷嗷啊嗷啊呜嗷呜~~~嗷~呜呜嗷呜嗷嗷嗷嗷呜啊嗷呜嗷呜嗷呜呜~呜啊呜啊嗷啊呜嗷呜~呜~嗷~呜呜嗷嗷嗷嗷嗷嗷呜啊呜~嗷呜嗷呜呜啊嗷~~啊嗷啊呜嗷嗷嗷呜~嗷~呜嗷嗷~呜嗷嗷嗷呜啊呜呜呜呜嗷呜呜~嗷~嗷啊嗷啊呜嗷嗷~嗷~嗷~呜呜嗷嗷~嗷嗷嗷呜呜嗷啊~呜嗷呜呜啊嗷嗷嗷啊嗷啊呜~嗷呜嗷~嗷~呜~啊啊呜嗷嗷嗷呜嗷啊~呜呜嗷呜呜啊嗷呜~啊嗷啊呜~嗷啊~~嗷~呜嗷嗷~~嗷嗷嗷呜呜嗷嗷~呜嗷呜呜~嗷~呜啊嗷啊呜嗷嗷啊啊~嗷~呜呜呜嗷呜嗷嗷嗷呜呜嗷嗷~呜嗷呜呜~嗷嗷嗷啊嗷啊呜~嗷啊~~嗷~呜呜嗷啊嗷嗷嗷嗷呜啊嗷嗷呜呜嗷呜呜啊嗷呜~啊嗷啊呜嗷呜~呜~嗷~呜呜嗷嗷嗷嗷嗷嗷呜啊嗷嗷呜呜嗷呜呜~嗷~啊啊嗷啊呜嗷嗷嗷嗷~嗷~呜嗷嗷呜~嗷嗷嗷呜啊嗷~~呜嗷呜呜~嗷~嗷啊嗷啊呜嗷嗷啊呜~嗷~呜嗷嗷呜~嗷嗷嗷呜啊嗷呜~呜嗷呜呜~嗷啊嗷啊嗷啊呜嗷呜~~~嗷~呜呜嗷嗷嗷嗷嗷嗷呜呜嗷~嗷呜嗷呜呜啊嗷嗷嗷啊嗷啊呜~呜呜呜~嗷~呜~啊啊呜嗷嗷嗷呜呜嗷嗷~呜嗷呜呜啊嗷呜~啊嗷啊呜~嗷啊~~嗷~呜嗷嗷~~嗷嗷嗷呜呜嗷嗷~呜嗷呜呜啊嗷呜~啊嗷啊呜~嗷啊~~嗷~呜嗷嗷~~嗷嗷嗷呜啊嗷呜~呜嗷呜呜~嗷啊嗷啊嗷啊呜嗷呜~~~嗷~呜呜嗷嗷嗷嗷嗷嗷呜呜~~啊呜嗷呜呜~嗷嗷嗷啊嗷啊呜~~啊嗷~嗷~呜嗷嗷~~嗷嗷嗷呜呜~嗷呜呜嗷呜呜啊呜呜嗷啊嗷啊呜~嗷啊~~嗷~呜呜嗷呜~嗷嗷嗷呜啊嗷呜嗷呜嗷呜呜~嗷呜嗷啊嗷啊呜~~啊啊~嗷~呜呜嗷嗷呜嗷嗷嗷呜啊呜~嗷呜嗷呜呜~呜啊~啊嗷啊呜嗷嗷嗷嗷~嗷~呜呜呜嗷啊嗷嗷嗷呜呜~~啊呜嗷呜呜~嗷嗷嗷啊嗷啊呜~嗷啊~~嗷~呜嗷嗷呜嗷嗷嗷嗷呜呜嗷嗷~呜嗷呜呜啊呜啊啊啊嗷啊呜~~啊嗷~嗷~呜~啊啊呜嗷嗷嗷呜嗷啊~呜呜嗷呜呜啊嗷呜~啊嗷啊呜~嗷啊~~嗷~呜嗷嗷~~嗷嗷嗷呜呜嗷嗷~呜嗷呜呜~呜~啊啊嗷啊呜嗷嗷呜嗷~嗷~呜呜呜嗷~嗷嗷嗷呜啊嗷啊~呜嗷呜呜啊嗷呜~啊嗷啊呜嗷嗷啊啊~嗷~呜呜呜~~嗷嗷嗷呜啊嗷啊嗷呜嗷呜呜~嗷呜呜啊嗷啊呜~嗷嗷~~嗷~呜呜嗷~啊嗷嗷嗷呜啊呜啊嗷呜嗷呜呜~呜啊~啊嗷啊呜嗷呜啊~~嗷~呜呜呜呜嗷嗷嗷嗷呜啊呜呜~呜嗷呜呜啊~呜啊啊嗷啊呜嗷嗷嗷呜~嗷~呜呜嗷啊嗷嗷嗷嗷呜啊嗷~~呜嗷呜呜~嗷~嗷啊嗷啊呜~嗷呜~~嗷~呜嗷嗷~~嗷嗷嗷呜呜嗷啊啊呜嗷呜呜~呜~啊啊嗷啊呜嗷嗷~呜~嗷~呜嗷嗷呜啊嗷嗷嗷呜呜嗷~嗷呜嗷呜呜啊嗷呜~啊嗷啊呜嗷嗷~嗷~嗷~呜呜呜嗷啊嗷嗷嗷呜呜嗷嗷~呜嗷呜呜~嗷~呜啊嗷啊呜~呜呜呜~嗷~呜~啊啊呜嗷嗷嗷呜呜嗷嗷~呜嗷呜呜啊嗷呜~啊嗷啊呜~嗷啊~~嗷~呜嗷嗷~~嗷嗷嗷呜呜嗷嗷~呜嗷呜呜啊嗷呜~啊嗷啊呜~嗷啊~~嗷~呜嗷嗷~~嗷嗷嗷呜啊嗷啊呜呜嗷呜呜啊嗷呜呜啊嗷啊呜嗷呜嗷啊~嗷~呜呜呜嗷呜嗷嗷嗷呜啊嗷~嗷呜嗷呜呜~呜啊~啊嗷啊呜嗷嗷嗷嗷~嗷~呜嗷嗷呜~嗷嗷嗷呜啊嗷呜~呜嗷呜呜~嗷啊嗷啊嗷啊呜嗷呜~~~嗷~呜呜嗷嗷嗷嗷嗷嗷呜呜嗷~嗷呜嗷呜呜呜啊嗷呜啊嗷啊呜啊啊呜呜~嗷~呜呜呜呜~嗷嗷嗷呜啊嗷嗷啊呜嗷呜呜~呜啊呜啊嗷啊呜~~啊啊~嗷~呜呜呜呜啊嗷嗷嗷呜啊嗷~嗷呜嗷呜呜~呜啊~啊嗷啊呜嗷嗷嗷~~嗷~呜嗷~~啊嗷嗷嗷呜啊嗷啊~呜嗷呜呜~嗷啊嗷啊嗷啊呜嗷嗷啊嗷~嗷~呜嗷嗷呜~嗷嗷嗷呜呜嗷啊啊呜嗷呜呜啊啊~~啊嗷啊呜嗷嗷~嗷~嗷~呜呜嗷~嗷嗷嗷嗷呜啊嗷嗷啊呜嗷呜呜~呜啊呜啊嗷啊呜嗷嗷呜~~嗷~呜嗷嗷~呜嗷嗷嗷呜啊嗷~呜呜嗷呜呜~呜呜~啊嗷啊呜嗷嗷嗷啊~嗷~呜嗷嗷呜啊嗷嗷嗷呜呜嗷~~呜嗷呜呜啊嗷呜~啊嗷啊呜~嗷嗷啊~嗷~呜嗷啊呜~嗷嗷嗷呜啊嗷呜嗷呜嗷呜呜~嗷呜嗷啊嗷啊呜~嗷啊呜~嗷~呜呜嗷啊呜嗷嗷嗷呜啊呜嗷~呜嗷呜呜~嗷~啊啊嗷啊呜~嗷嗷啊~嗷~呜嗷嗷啊嗷啊

解码网站：兽音译者在线编码解码 - 兽音翻译咆哮体加密解密 (iiilab.com)

defxor_with_ham(input_file, output_file):
    ham_bytes =[0x48,0x61,0x6D]withopen(input_file,'rb')as f:
        data =bytearray(f.read())for i inrange(len(data)):
        data[i]^= ham_bytes[i %3]withopen(output_file,'wb')as f:
        f.write(data)

xor_with_ham('Hamorl.jpg','Ham.jpg')

解密脚本

defxor_with_ham_decrypt(input_file, output_file):
    ham_bytes =[0x48,0x61,0x6D]withopen(input_file,'rb')as f:
        data =bytearray(f.read())for i inrange(len(data)):
        data[i]^= ham_bytes[i %3]withopen(output_file,'wb')as f:
        f.write(data)# 使用函数解密
xor_with_ham_decrypt('Ham.jpg','Hamorl.jpg')

得到Hamorl.jpg

不过还是损坏的，修改文件头为

ffd8ffe1

保存即可

到这里就不会了，试了很大种方法

看了官方wp，真的绷不住了

之前用binwalk看了一下以为没啥，结果foremost有了（可恶

SSTV

MMSSTV & RX-SSTV 两款图像解码软件 安装文件下载 - 悟透 - 博客园 (cnblogs.com)

Virtual Audio Cable - Downloads (muzychenko.net)

[三、音频隐写Audacity、deepsound、dtmf2num、MMSSTV、虚拟声卡、MP3Stego]-CSDN博客

[Week3] Base revenge

描述：Not just Base
附件：

VGl0bGU6IFRoZSBFbmlnbWF0aWMgQ29kZSBvZiBNaXNjIEJhc2U2NE==
R3JlZXRpbmdzLCBwdXp6bGUgZW50aHVzaWFzdHMgYW5kIGNvZGVicmVha2VycyBhbGlrZSEgVG9kYXks
d2UgZGVsdmUgaW50byB0aGUgcmVhbG0gb2YgdGhlIGVuaWdtYXRpYyBNaXNjIEJhc2U2NCy=
YSBjcnlwdG9ncmFwaGljIHB1enpsZSB0aGF0IGNoYWxsZW5nZXMgdGhlIGtlZW5lc3QgbWluZHMu
QXJlIHlvdSByZWFkeSB0byBlbWJhcmsgb24gYSBqb3VybmV5IG9mIGRlY29kaW5nIGFuZCBkaXNjb3Zlcnk/
SW1hZ2luZSB5b3Vyc2VsZiBpbiB0aGUgbWlkc3Qgb2YgYSBkaWdpdGFsIGxhYnlyaW50aCy=
d2hlcmUgc3RyaW5ncyBvZiBjaGFyYWN0ZXJzIGhvbGQgc2VjcmV0cyB3YWl0aW5nIHRvIGJlIHVudmVpbGVkLm==
TWlzYyBCYXNlNjQgaXMgbm90IHlvdXIgb3JkaW5hcnkgY2lwaGVy4oCUaXQgY29uY2VhbHMgbWVzc2FnZXP=
aW4gcGxhaW4gc2lnaHQsIGF3YWl0aW5nIHRob3NlIHdpdGggdGhlIHJpZ2h0IHRvb2xz
YW5kIHNraWxscyB0byBkZWNpcGhlciBpdHMgY29kZS6=
QXMgeW91IHVucmF2ZWwgdGhlIGxheWVycyBvZiBNaXNjIEJhc2U2NCwgZWFjaCBkZWNvZGVkIG1lc3NhZ2V=
cmV2ZWFscyBhIGZyYWdtZW50IG9mIGEgbGFyZ2VyIHB1enpsZS5=
UGVyaGFwcyBpdCdzIGEgcmlkZGxlLCBhIHBpZWNlIG9mIHRyaXZpYSwgb3IgZXZlbiBhIHBsYXlmdWwgY2hhbGxlbmdlLl==
VGhlIGJlYXV0eSBvZiBNaXNjIEJhc2U2NCBsaWVzIG5vdCBvbmx5IGluIGl0cyBjb21wbGV4aXR5
YnV0IGFsc28gaW4gaXRzIGFiaWxpdHkgdG8gZW5nYWdlIGFuZCBpbnRyaWd1ZS5=
Rm9yIHRob3NlIG5ldyB0byB0aGUgd29ybGQgb2YgY3J5cHRvZ3JhcGh5LCBmZWFyIG5vdCG=
TWlzYyBCYXNlNjQgd2VsY29tZXMgYmVnaW5uZXJzIHdpdGggb3BlbiBhcm1zLB==
b2ZmZXJpbmcgYSBnYXRld2F5IGludG8gdGhlIHdvcmxkIG9mIGNvZGVzIGFuZCBjaXBoZXJzLk==
V2l0aCBhIGJpdCBvZiBwYXRpZW5jZSBhbmQgYSB3aWxsaW5nbmVzcyB0byB0aGluayBvdXRzaWRlIHRoZSBib3gs
eW91IHRvbyBjYW4gam9pbiB0aGUgcmFua3Mgb2Ygc2Vhc29uZWQgY29kZWJyZWFrZXJzLh==
SW1hZ2luZSB0aGUgdGhyaWxsIG9mIGNyYWNraW5nIGEgcGFydGljdWxhcmx5IHN0dWJib3JuIGNvZGUs
d2hlcmUgZWFjaCBjb3JyZWN0IGRlY29kaW5nIGJyaW5ncyB5b3UgY2xvc2VyIHRvIHRoZSBoZWFydE==
b2YgdGhlIHB1enpsZS5=
VGhlIHNhdGlzZmFjdGlvbiBvZiBzZWVpbmcgbGV0dGVycyBhbmQgbnVtYmVycyB0cmFuc2Zvcm2=
aW50byBjb2hlcmVudCB3b3JkcyBhbmQgc2VudGVuY2VzIGlzIHVucGFyYWxsZWxlZOKAlE==
YSB0ZXN0YW1lbnQgdG8geW91ciBwZXJzZXZlcmFuY2UgYW5kIGFuYWx5dGljYWwgcHJvd2Vzcy7=
SW4gdGhlIHJlYWxtIG9mIE1pc2MgQmFzZTY0LCBjcmVhdGl2aXR5IHJlaWducyBzdXByZW1lLl==
QXMgeW91IGVuY291bnRlciBkaWZmZXJlbnQgcHV6emxlcywgeW91J2xsIGZpbmQgeW91cnNlbGY=
dGhpbmtpbmcgaW4gbmV3IHdheXMsIGV4cGxvcmluZyB2YXJpb3VzIHRlY2huaXF1ZXMs
YW5kIGhvbmluZyB5b3VyIHByb2JsZW0tc29sdmluZyBza2lsbHMu
RWFjaCBzb2x2ZWQgcHV6emxlIGJlY29tZXMgYSBiYWRnZSBvZiBob25vcuKAlG==
YSB0ZXN0YW1lbnQgdG8geW91ciBkZWRpY2F0aW9uIGFuZCBhYmlsaXR5
dG8gbmF2aWdhdGUgdGhlIGludHJpY2F0ZSBwYXRocyBvZiBjcnlwdG9ncmFwaHku
QnV0IGJld2FyZSwgZm9yIE1pc2MgQmFzZTY0IGlzIG5vdCB3aXRob3V0IGl0cyBjaGFsbGVuZ2VzLk==
U29tZSBwdXp6bGVzIG1heSBzZWVtIGluc2NydXRhYmxlIGF0IGZpcnN0IGdsYW5jZSy=
cmVxdWlyaW5nIG5vdCBvbmx5IHRlY2huaWNhbCBrbm93bGVkZ2V=
YnV0IGFsc28gYSBkYXNoIG9mIGludHVpdGlvbm==
YW5kIGEga2VlbiBleWUgZm9yIHBhdHRlcm5zLt==
SXQncyBhIHRlc3Qgb2Ygd2l0IGFuZCBkZXRlcm1pbmF0aW9u4oCU
YSBwdXp6bGUgdGhhdCByZXdhcmRzIHRob3NlIHdobyBhcmUgd2lsbGluZ2==
dG8gcmlzZSB0byB0aGUgb2NjYXNpb24u
U28sIGZlbGxvdyBhZHZlbnR1cmVycywgYXJlIHlvdSByZWFkeX==
dG8gdGFrZSBvbiB0aGUgY2hhbGxlbmdlIG9mIE1pc2MgQmFzZTY0P0==
TGV0IGVhY2ggZW5jb2RlZCBzdHJpbmcgYmUgYSBzdGVwcGluZyBzdG9uZR==
aW4geW91ciBxdWVzdCBmb3Iga25vd2xlZGdlIGFuZCBkaXNjb3Zlcnku
V2hvIGtub3dzIHdoYXQgc2VjcmV0cyBhd2FpdCB0aG9zZSB3aG8gZGFyZU==
dG8gdmVudHVyZSBpbnRvIHRoZSB3b3JsZCBvZiBjcnlwdGljIHB1enpsZXM/
RW1icmFjZSB0aGUgdGhyaWxsIG9mIHRoZSBjaGFzZSz=
dGhlIGpveSBvZiBkZWNpcGhlcmluZyy=
YW5kIHRoZSBzYXRpc2ZhY3Rpb24gb2YgdW5yYXZlbGluZyBhIG15c3Rlcnku
SW4gdGhlIHJlYWxtIG9mIE1pc2MgQmFzZTY0LF==
ZXZlcnkgcHV6emxlIHNvbHZlZCBicmluZ3MgeW91IGNsb3Nlcj==
dG8gdW5yYXZlbGluZyB0aGUgdWx0aW1hdGUgcXVlc3Rpb246
d2hhdCBoaWRkZW4gdHJlYXN1cmVzIGxpZSBiZW5lYXRo
dGhlIHN1cmZhY2Ugb2YgZWFjaCBlbmNvZGVkIG1lc3NhZ2U/
Sm9pbiB1cyBvbiB0aGlzIGpvdXJuZXkgb2YgZXhwbG9yYXRpb24gYW5kIGludHJpZ3VlLk==
TGV0IE1pc2MgQmFzZTY0IGJlIHlvdXIgZ3VpZGV=
dG8gYSB3b3JsZCB3aGVyZSBjdXJpb3NpdHkga25vd3Mgbm8gYm91bmRz
YW5kIGV2ZXJ5IHB1enpsZSBzb2x2ZWQgaXMgYSB0cml1bXBo
b2YgdGhlIGh1bWFuIGludGVsbGVjdC5=
SGFwcHkgZGVjb2Rpbmch
VGl0bGU6IFRoZSBFbmlnbWF0aWMgQ29kZSBvZiBNaXNjIEJhc2U2NH==
R3JlZXRpbmdzLCBwdXp6bGUgZW50aHVzaWFzdHMgYW5kIGNvZGVicmVha2VycyBhbGlrZSEgVG9kYXks
d2UgZGVsdmUgaW50byB0aGUgcmVhbG0gb2YgdGhlIGVuaWdtYXRpYyBNaXNjIEJhc2U2NCx=
YSBjcnlwdG9ncmFwaGljIHB1enpsZSB0aGF0IGNoYWxsZW5nZXMgdGhlIGtlZW5lc3QgbWluZHMu
QXJlIHlvdSByZWFkeSB0byBlbWJhcmsgb24gYSBqb3VybmV5IG9mIGRlY29kaW5nIGFuZCBkaXNjb3Zlcnk/
SW1hZ2luZSB5b3Vyc2VsZiBpbiB0aGUgbWlkc3Qgb2YgYSBkaWdpdGFsIGxhYnlyaW50aCx=
d2hlcmUgc3RyaW5ncyBvZiBjaGFyYWN0ZXJzIGhvbGQgc2VjcmV0cyB3YWl0aW5nIHRvIGJlIHVudmVpbGVkLk==
TWlzYyBCYXNlNjQgaXMgbm90IHlvdXIgb3JkaW5hcnkgY2lwaGVy4oCUaXQgY29uY2VhbHMgbWVzc2FnZXM=
aW4gcGxhaW4gc2lnaHQsIGF3YWl0aW5nIHRob3NlIHdpdGggdGhlIHJpZ2h0IHRvb2xz
YW5kIHNraWxscyB0byBkZWNpcGhlciBpdHMgY29kZS5=
QXMgeW91IHVucmF2ZWwgdGhlIGxheWVycyBvZiBNaXNjIEJhc2U2NCwgZWFjaCBkZWNvZGVkIG1lc3NhZ2V=
cmV2ZWFscyBhIGZyYWdtZW50IG9mIGEgbGFyZ2VyIHB1enpsZS5=
UGVyaGFwcyBpdCdzIGEgcmlkZGxlLCBhIHBpZWNlIG9mIHRyaXZpYSwgb3IgZXZlbiBhIHBsYXlmdWwgY2hhbGxlbmdlLn==
VGhlIGJlYXV0eSBvZiBNaXNjIEJhc2U2NCBsaWVzIG5vdCBvbmx5IGluIGl0cyBjb21wbGV4aXR5
YnV0IGFsc28gaW4gaXRzIGFiaWxpdHkgdG8gZW5nYWdlIGFuZCBpbnRyaWd1ZS5=
Rm9yIHRob3NlIG5ldyB0byB0aGUgd29ybGQgb2YgY3J5cHRvZ3JhcGh5LCBmZWFyIG5vdCF=
TWlzYyBCYXNlNjQgd2VsY29tZXMgYmVnaW5uZXJzIHdpdGggb3BlbiBhcm1zLJ==
b2ZmZXJpbmcgYSBnYXRld2F5IGludG8gdGhlIHdvcmxkIG9mIGNvZGVzIGFuZCBjaXBoZXJzLn==
V2l0aCBhIGJpdCBvZiBwYXRpZW5jZSBhbmQgYSB3aWxsaW5nbmVzcyB0byB0aGluayBvdXRzaWRlIHRoZSBib3gs
eW91IHRvbyBjYW4gam9pbiB0aGUgcmFua3Mgb2Ygc2Vhc29uZWQgY29kZWJyZWFrZXJzLl==
SW1hZ2luZSB0aGUgdGhyaWxsIG9mIGNyYWNraW5nIGEgcGFydGljdWxhcmx5IHN0dWJib3JuIGNvZGUs
d2hlcmUgZWFjaCBjb3JyZWN0IGRlY29kaW5nIGJyaW5ncyB5b3UgY2xvc2VyIHRvIHRoZSBoZWFydE==
b2YgdGhlIHB1enpsZS4=
VGhlIHNhdGlzZmFjdGlvbiBvZiBzZWVpbmcgbGV0dGVycyBhbmQgbnVtYmVycyB0cmFuc2Zvcm2=
aW50byBjb2hlcmVudCB3b3JkcyBhbmQgc2VudGVuY2VzIGlzIHVucGFyYWxsZWxlZOKAlE==
YSB0ZXN0YW1lbnQgdG8geW91ciBwZXJzZXZlcmFuY2UgYW5kIGFuYWx5dGljYWwgcHJvd2Vzcy5=
SW4gdGhlIHJlYWxtIG9mIE1pc2MgQmFzZTY0LCBjcmVhdGl2aXR5IHJlaWducyBzdXByZW1lLk==
QXMgeW91IGVuY291bnRlciBkaWZmZXJlbnQgcHV6emxlcywgeW91J2xsIGZpbmQgeW91cnNlbGb=
dGhpbmtpbmcgaW4gbmV3IHdheXMsIGV4cGxvcmluZyB2YXJpb3VzIHRlY2huaXF1ZXMs
YW5kIGhvbmluZyB5b3VyIHByb2JsZW0tc29sdmluZyBza2lsbHMu
RWFjaCBzb2x2ZWQgcHV6emxlIGJlY29tZXMgYSBiYWRnZSBvZiBob25vcuKAlJ==
YSB0ZXN0YW1lbnQgdG8geW91ciBkZWRpY2F0aW9uIGFuZCBhYmlsaXR5
dG8gbmF2aWdhdGUgdGhlIGludHJpY2F0ZSBwYXRocyBvZiBjcnlwdG9ncmFwaHku
QnV0IGJld2FyZSwgZm9yIE1pc2MgQmFzZTY0IGlzIG5vdCB3aXRob3V0IGl0cyBjaGFsbGVuZ2VzLl==
U29tZSBwdXp6bGVzIG1heSBzZWVtIGluc2NydXRhYmxlIGF0IGZpcnN0IGdsYW5jZSw=
cmVxdWlyaW5nIG5vdCBvbmx5IHRlY2huaWNhbCBrbm93bGVkZ2X=
YnV0IGFsc28gYSBkYXNoIG9mIGludHVpdGlvbn==
YW5kIGEga2VlbiBleWUgZm9yIHBhdHRlcm5zLp==
SXQncyBhIHRlc3Qgb2Ygd2l0IGFuZCBkZXRlcm1pbmF0aW9u4oCU
YSBwdXp6bGUgdGhhdCByZXdhcmRzIHRob3NlIHdobyBhcmUgd2lsbGluZ2==
dG8gcmlzZSB0byB0aGUgb2NjYXNpb24u
U28sIGZlbGxvdyBhZHZlbnR1cmVycywgYXJlIHlvdSByZWFkeR==
dG8gdGFrZSBvbiB0aGUgY2hhbGxlbmdlIG9mIE1pc2MgQmFzZTY0P1==
TGV0IGVhY2ggZW5jb2RlZCBzdHJpbmcgYmUgYSBzdGVwcGluZyBzdG9uZZ==
aW4geW91ciBxdWVzdCBmb3Iga25vd2xlZGdlIGFuZCBkaXNjb3Zlcnku
V2hvIGtub3dzIHdoYXQgc2VjcmV0cyBhd2FpdCB0aG9zZSB3aG8gZGFyZX==
dG8gdmVudHVyZSBpbnRvIHRoZSB3b3JsZCBvZiBjcnlwdGljIHB1enpsZXM/
RW1icmFjZSB0aGUgdGhyaWxsIG9mIHRoZSBjaGFzZSw=
dGhlIGpveSBvZiBkZWNpcGhlcmluZyw=
YW5kIHRoZSBzYXRpc2ZhY3Rpb24gb2YgdW5yYXZlbGluZyBhIG15c3Rlcnku
SW4gdGhlIHJlYWxtIG9mIE1pc2MgQmFzZTY0LE==
ZXZlcnkgcHV6emxlIHNvbHZlZCBicmluZ3MgeW91IGNsb3Nlcj==
dG8gdW5yYXZlbGluZyB0aGUgdWx0aW1hdGUgcXVlc3Rpb246
d2hhdCBoaWRkZW4gdHJlYXN1cmVzIGxpZSBiZW5lYXRo
dGhlIHN1cmZhY2Ugb2YgZWFjaCBlbmNvZGVkIG1lc3NhZ2U/
Sm9pbiB1cyBvbiB0aGlzIGpvdXJuZXkgb2YgZXhwbG9yYXRpb24gYW5kIGludHJpZ3VlLj==
TGV0IE1pc2MgQmFzZTY0IGJlIHlvdXIgZ3VpZGU=
dG8gYSB3b3JsZCB3aGVyZSBjdXJpb3NpdHkga25vd3Mgbm8gYm91bmRz
YW5kIGV2ZXJ5IHB1enpsZSBzb2x2ZWQgaXMgYSB0cml1bXBo
b2YgdGhlIGh1bWFuIGludGVsbGVjdC6=
SGFwcHkgZGVjb2Rpbmch
VGl0bGU6IFRoZSBFbmlnbWF0aWMgQ29kZSBvZiBNaXNjIEJhc2U2NG==
R3JlZXRpbmdzLCBwdXp6bGUgZW50aHVzaWFzdHMgYW5kIGNvZGVicmVha2VycyBhbGlrZSEgVG9kYXks
d2UgZGVsdmUgaW50byB0aGUgcmVhbG0gb2YgdGhlIGVuaWdtYXRpYyBNaXNjIEJhc2U2NCz=
YSBjcnlwdG9ncmFwaGljIHB1enpsZSB0aGF0IGNoYWxsZW5nZXMgdGhlIGtlZW5lc3QgbWluZHMu
QXJlIHlvdSByZWFkeSB0byBlbWJhcmsgb24gYSBqb3VybmV5IG9mIGRlY29kaW5nIGFuZCBkaXNjb3Zlcnk/
SW1hZ2luZSB5b3Vyc2VsZiBpbiB0aGUgbWlkc3Qgb2YgYSBkaWdpdGFsIGxhYnlyaW50aCw=
d2hlcmUgc3RyaW5ncyBvZiBjaGFyYWN0ZXJzIGhvbGQgc2VjcmV0cyB3YWl0aW5nIHRvIGJlIHVudmVpbGVkLm==
TWlzYyBCYXNlNjQgaXMgbm90IHlvdXIgb3JkaW5hcnkgY2lwaGVy4oCUaXQgY29uY2VhbHMgbWVzc2FnZXN=
aW4gcGxhaW4gc2lnaHQsIGF3YWl0aW5nIHRob3NlIHdpdGggdGhlIHJpZ2h0IHRvb2xz
YW5kIHNraWxscyB0byBkZWNpcGhlciBpdHMgY29kZS4=
QXMgeW91IHVucmF2ZWwgdGhlIGxheWVycyBvZiBNaXNjIEJhc2U2NCwgZWFjaCBkZWNvZGVkIG1lc3NhZ2V=
cmV2ZWFscyBhIGZyYWdtZW50IG9mIGEgbGFyZ2VyIHB1enpsZS4=
UGVyaGFwcyBpdCdzIGEgcmlkZGxlLCBhIHBpZWNlIG9mIHRyaXZpYSwgb3IgZXZlbiBhIHBsYXlmdWwgY2hhbGxlbmdlLi==
VGhlIGJlYXV0eSBvZiBNaXNjIEJhc2U2NCBsaWVzIG5vdCBvbmx5IGluIGl0cyBjb21wbGV4aXR5
YnV0IGFsc28gaW4gaXRzIGFiaWxpdHkgdG8gZW5nYWdlIGFuZCBpbnRyaWd1ZS5=
Rm9yIHRob3NlIG5ldyB0byB0aGUgd29ybGQgb2YgY3J5cHRvZ3JhcGh5LCBmZWFyIG5vdCH=
TWlzYyBCYXNlNjQgd2VsY29tZXMgYmVnaW5uZXJzIHdpdGggb3BlbiBhcm1zLC==
b2ZmZXJpbmcgYSBnYXRld2F5IGludG8gdGhlIHdvcmxkIG9mIGNvZGVzIGFuZCBjaXBoZXJzLl==
V2l0aCBhIGJpdCBvZiBwYXRpZW5jZSBhbmQgYSB3aWxsaW5nbmVzcyB0byB0aGluayBvdXRzaWRlIHRoZSBib3gs
eW91IHRvbyBjYW4gam9pbiB0aGUgcmFua3Mgb2Ygc2Vhc29uZWQgY29kZWJyZWFrZXJzLl==
SW1hZ2luZSB0aGUgdGhyaWxsIG9mIGNyYWNraW5nIGEgcGFydGljdWxhcmx5IHN0dWJib3JuIGNvZGUs
d2hlcmUgZWFjaCBjb3JyZWN0IGRlY29kaW5nIGJyaW5ncyB5b3UgY2xvc2VyIHRvIHRoZSBoZWFydD==
b2YgdGhlIHB1enpsZS6=
VGhlIHNhdGlzZmFjdGlvbiBvZiBzZWVpbmcgbGV0dGVycyBhbmQgbnVtYmVycyB0cmFuc2Zvcm1=

give you a hint：{Gs1h_1h_nb_srmg}

对提示进行分析：

{Gs1h_1h_nb_srmg}

atbash在线解密：
{th1s_1s_my_hint}

上述base64解密发现没有什么有用的信息，提取出首写字母也没用

wp：base64隐写，第一次听说这个东西

使用

b64steg

隐写工具提取出来

Nicolas-yuan/b64steganography: b64隐写提取工具 (github.com)

脚本：

'''
Author: 拾柒
Date: 2020-11-12 21:17:24
LastEditTime: 2020-11-14 18:29:23
Description: Base64 steganography
''''''
隐写原理:
base64将二进制以6bit为一个字符编码进行重新编码，如果二进制长度为6的倍数，则编码无冗余,
若长度不是6的倍数，则存在2bit（或4bit）长度的二进制无法编码，此时需要填充长度为4bit（或2bit）的0完成编码，
而后填充长度为12bit（或6bit）的0表示前面的数据填充了几个0，用于解码，最后填充的0编码为‘=’,
此时可把长度为4bit（或2bit）的填充数据0替换为要隐写的数据二进制值，然后再编码完成隐写.
''''''
提取原理1：
base64根据等号数量判断隐写bit长度，读取等号前一个字符的base64编码，提取尾部对应长度的bit，组合后解码.
提取原理2：
base64隐写的数据对解密无影响，但隐写后加密的字符与未隐写加密的字符不一样，
差值(不能用ASCII码的差值，要用base64编码的差值)是隐写的二进制对应的十进制值.
使用方法：
cmd中输入“ python b64stegano.py [filename] [a,b]”
'''import sys
import base64

defto_bin(value, num):#十进制数据，二进制位宽
    bin_chars =""
    temp = value
    for i inrange(num):
        bin_char =bin(temp %2)[-1]
        temp = temp //2
        bin_chars = bin_char + bin_chars
    return bin_chars.upper()#输出指定位宽的二进制字符串

base64_dica={'A':'000000','B':'000001','C':'000010','D':'000011','E':'000100','F':'000101','G':'000110','H':'000111','I':'001000','J':'001001','K':'001010','L':'001011','M':'001100','N':'001101','O':'001110','P':'001111','Q':'010000','R':'010001','S':'010010','T':'010011','U':'010100','V':'010101','W':'010110','X':'010111','Y':'011000','Z':'011001','a':'011010','b':'011011','c':'011100','d':'011101','e':'011110','f':'011111','g':'100000','h':'100001','i':'100010','j':'100011','k':'100100','l':'100101','m':'100110','n':'100111','o':'101000','p':'101001','q':'101010','r':'101011','s':'101100','t':'101101','u':'101110','v':'101111','w':'110000','x':'110001','y':'110010','z':'110011','0':'110100','1':'110101','2':'110110','3':'110111','4':'111000','5':'111001','6':'111010','7':'111011','8':'111100','9':'111101','+':'111110','/':'111111'}#base64编码对应表,用于提取原理1

base64_dicb={'A':0,'B':1,'C':2,'D':3,'E':4,'F':5,'G':6,'H':7,'I':8,'J':9,'K':10,'L':11,'M':12,'N':13,'O':14,'P':15,'Q':16,'R':17,'S':18,'T':19,'U':20,'V':21,'W':22,'X':23,'Y':24,'Z':25,'a':26,'b':27,'c':28,'d':29,'e':30,'f':31,'g':32,'h':33,'i':34,'j':35,'k':36,'l':37,'m':38,'n':39,'o':40,'p':41,'q':42,'r':43,'s':44,'t':45,'u':46,'v':47,'w':48,'x':49,'y':50,'z':51,'0':52,'1':53,'2':54,'3':55,'4':56,'5':57,'6':58,'7':59,'8':60,'9':61,'+':62,'/':63}#base64编码对应表，用于提取原理2

hidebit =''#存储隐写的bit数据
m =''#存储结果
argvs = sys.argv#获取命令行参数
fc =open(argvs[1],'r')#打开文件
lines = fc.read().split('\n')#读取内容，并按行分割##################提取原理1if argvs[2]=='a':#判断每行是否有隐写数据，有读取存入hidebitfor line in lines:if line !='':if line[-1]=='=':#判断最后一个字符是不是‘=’，if line[-2]=='=':#判断倒数第二个字符是不是‘=’              
                        hidebit += base64_dica[line[-3]][2:]else:
                        hidebit += base64_dica[line[-2]][4:]else:pass###################提取原理2elif argvs[2]=='b':#判断每行是否有隐写数据，有计算差值后转为二进制存入hidebitfor line in lines:
        line_row = base64.b64encode(base64.b64decode(line)).decode('utf-8')if line !='':if line[-1]=='=':#判断最后一个字符是不是‘=’，if line[-2]=='=':#判断倒数第二个字符是不是‘=’
                    temp = to_bin(base64_dicb[line[-3]]-base64_dicb[line_row[-3]],4)
                    hidebit += temp
                else:
                    temp = to_bin(base64_dicb[line[-2]]-base64_dicb[line_row[-2]],2)
                    hidebit += temp
            else:pass#将二进制转化十进制，即ASCII码，再转化为字符for i inrange(0,len(hidebit),8):
    m +=chr(int(hidebit[i:i+8],2))print(m)

使用 python b64stegano.py stego.txt a 或 python b64stegano.py stego.txt b
即可得到隐写信息

JnUaAFMFImgANSEuAWYuBE9SyaYpC2ldBrU9

结合提示，使用atbash解码

这里在线网站解码出来的都是小写，所以写了个脚本

from string import ascii_lowercase, ascii_uppercase

defatbashAttack(plaintext:str):
    dir_atbash_lower = ascii_lowercase[::-1]
    dir_atbash_upper = ascii_uppercase[::-1]
    res =''for s in plaintext:if s.isupper():
            res += dir_atbash_upper[ascii_uppercase.index(s)]elif s.islower():
            res += dir_atbash_lower[ascii_lowercase.index(s)]else:
            res += s
    return res

plaintext ='JnUaAFMFImgANSEuAWYuBE9SyaYpC2ldBrU9'
ciphertext = atbashAttack(plaintext)print("Atbash解密结果:", ciphertext)

得到：

QmFzZUNURntZMHVfZDBfYV9HbzBkX2owYiF9

base64解码得到

BaseCTF{Y0u_d0_a_Go0d_j0b!}

[Week3] 这是一个压缩包

描述：不要只会用工具噢

附件：这是一个压缩包.zip

需要密码，WinHex打开发现

QmFzZUNURj8/Pz8/P0ZUQ2VzYUI=

base64解密：
BaseCTF??????FTCesaB

官方解：

中间缺少6位?，样式是对称的

利用python中zipfile，简单写个脚本爆破一下即可

hashcat也能解决

[https://hashcat.net/files/hashcat-5.1.0.7z]

import zipfile
zfile=zipfile.ZipFile("1.zip",'r')

for i in range(33,128):
    for j in range(33,128):
        for k in range(33,128):
            mask="BaseCTF"+chr(i)+chr(j)+chr(k)+chr(k)+chr(j)+chr(i)+"FTCesaB"
            try:
                zfile.extractall(pwd=mask.encode('utf-8'))
                print(mask)
                exit()
            except:
                pass
#BaseCTF_h11h_FTCesaB

[Week3] broken.mp4

描述：

破防时刻：录屏录到一半，断电关机了。签个到吧

BaseCTF Week2 讲解视频 (broken).mp4

附件：

不是，这真是一个签到题啊

光顾着做题确实没看第一个mp4的内容，确实想到了mp4文件会损坏，但是刚接触misc有很多东西确实没见过，又学到了

视频中的原文章

【视频图像篇】MP4受损视频修复方法（一）_untrunc-CSDN博客

github.com

得到录制2.mp4_fixed.mp4，打开得到flag

[Week3] 外星信号

描述：

在一次秘密任务中截获到了一段对话，地球人向地外发送了一段秘语，外星返回了一段外星信号，赶快来破译密码吧（flag小写）

提示：

嘶…音频播放时长和总时长不不对劲啊

附件：外星信号.mp3

摩尔斯电码音频解码器 – Morse Code Magic

得到：

THERE-IS-NO-FLAG-HERE-THERE-IS-NO-FLAG-HERE-THERE-IS-NO-FLAG-HERE-LET-US-GOBASECTF#2EBE6FDC-60DC-

得到flag的前半部分

BASECTF#2EBE6FDC-60DC-

foremost一下得到一个zip，解压得到flag.mp3

使用mmsstv即可得到flag

这里我用的是mmsstv是斜的，看群里说rx-sstv是正的，这里我就不用浪费时间了

发现含有摩斯密码，抄下来解码就行了

....-/----./.-/....-/-....-/.-/
----./----./..---/-....-/...-
-/-.../-.../-../...../-..../..-./
...--/..-./-../-----/-.../---
-.-

得到

49A4-A992-3BBD56F3FD0B%u3d

转为小写得到

BaseCTF{2ebe6fdc-60dc-49a4-a992-3bbd56f3fd0b}

web

[Week3] 滤个不停

描述：过滤这么多还怎么玩！等等…不对劲

靶机：

<?php
highlight_file(__FILE__);error_reporting(0);$incompetent=$_POST['incompetent'];$Datch=$_POST['Datch'];if($incompetent!=='HelloWorld'){die('写出程序员的第一行问候吧！');}//这是个什么东东？？？$required_chars=['s','e','v','a','n','x','r','o'];$is_valid=true;foreach($required_charsas$char){if(strpos($Datch,$char)===false){$is_valid=false;break;}}if($is_valid){$invalid_patterns=['php://','http://','https://','ftp://','file://','data://','gopher://'];foreach($invalid_patternsas$pattern){if(stripos($Datch,$pattern)!==false){die('此路不通换条路试试?');}}include($Datch);}else{die('文件名不合规 请重试');}?>
写出程序员的第一行问候吧！

第一个if是基操

$incompetent=$_POST['incompetent'];if($incompetent!=='HelloWorld'){die('写出程序员的第一行问候吧！');}

绕过：

incompetent=HelloWorld

第二个if语句要求Datch里面含有那些字符，

$Datch=$_POST['Datch'];//这是个什么东东？？？$required_chars=['s','e','v','a','n','x','r','o'];$is_valid=true;foreach($required_charsas$char){if(strpos($Datch,$char)===false){$is_valid=false;break;}}

strpos可以使用数组形式绕过

Datch[]=xxx

参考：

Bugku——strpos数组绕过_strpos绕过-CSDN博客

也可以使用

%0a

绕过，虽然这里用不到

这里由于$Datch涉及到了两个if语句

不能绕过，因为此时使用这个方法绕过时

$Datch

是一个数组，而

strpos

和

stripos

函数期望的是字符串参数。会出现警告信息。（调试）

第三个if语句

if($is_valid){$invalid_patterns=['php://','http://','https://','ftp://','file://','data://','gopher://'];foreach($invalid_patternsas$pattern){if(stripos($Datch,$pattern)!==false){die('此路不通换条路试试?');}}include($Datch);}else{die('文件名不合规 请重试');}

注意这里是

stripos

tips:

strpos系列函数

函数描述版本strpos查找字符串首次出现的位置PHP 4, PHP 5, PHP 7stripos查找字符串首次出现的位置（不区分大小写）PHP 5, PHP 7strrpos计算指定字符串在目标字符串中最后一次出现的位置PHP 4, PHP 5, PHP 7strripos计算指定字符串在目标字符串中最后一次出现的位置（不区分大小写）PHP 5, PHP 7mb_strpos查找字符串在另一个字符串中首次出现的位置PHP 4 >= 4.0.6, PHP 5, PHP 7strstr查找字符串的首次出现PHP 4, PHP 5, PHP 7stristrstrstr() 函数的忽略大小写版本PHP 4, PHP 5, PHP 7substr_count计算字串出现的次数PHP 4, PHP 5, PHP 7

mb* 相关的函数也可, 比如说mb_strpos是基于字符数执行一个多字节安全的 strpos() 操作。

到这里我发现行不通，于是回到第二个if条件，想着把把它们组成弄成一个不存在的后缀，然后解析时好像就会忽略这个后缀，但是下一个疑点又出来了，我不知目标网站中存在哪些文件

接着上网搜了一下nginx，发现

Nginx中的日志分两种，一种是error.log，一种是access.log。error.log可以配置成任意级别，默认级别是error，用来记录Nginx运行期间的处理流程相关的信息；access.log指的是访问日志，用来记录服务器的接入信息（包括记录用户的IP、请求处理时间、浏览器信息等）。

更好包含可以使用的字符，搜嘎

抓包传参，在ua中进行RCE，这里要发两次包
（我们写入的php代码会被解析从而进行RCE）

查看flag，这里我查看不了flag，重新开一下容器就解决了（同样发两次）

BaseCTF{2b693b60-a49b-4bf6-9798-565d0ef323f7}

参考：

ctfshow-web4（Nginx访问日志写shell） - 你呀你~ - 博客园 (cnblogs.com)

ctfshow-web4（文件包含&日志注入）_ctfshow web4-CSDN博客

[Week3] 玩原神玩的

描述：flag怎么被分解成$array了，不管了，原神，启动！

靶机：

<?php
highlight_file(__FILE__);error_reporting(0);include'flag.php';if(sizeof($_POST['len'])==sizeof($array)){ys_open($_GET['tip']);}else{die("错了！就你还想玩原神？❌❌❌");}functionys_open($tip){if($tip!="我要玩原神"){die("我不管，我要玩原神！😭😭😭");}dumpFlag();}functiondumpFlag(){if(!isset($_POST['m'])||sizeof($_POST['m'])!=2){die("可恶的QQ人！😡😡😡");}$a=$_POST['m'][0];$b=$_POST['m'][1];if(empty($a)||empty($b)||$a!="100%"||$b!="love100%".md5($a)){die("某站崩了？肯定是某忽悠干的！😡😡😡");}include'flag.php';$flag[]=array();for($ii=0;$ii<sizeof($array);$ii++){$flag[$ii]=md5(ord($array[$ii])^$ii);}echojson_encode($flag);} 错了！就你还想玩原神？❌❌❌

针对第一个flag，我们应该爆破出len的程度，一个一个试发现为45

len[]=0&len[]=1&len[]=2&len[]=3&len[]=4&len[]=5&len[]=6&len[]=7&len[]=8&len[]=9&len[]=10&len[]=11&len[]=12&len[]=13&len[]=14&len[]=15&len[]=16&len[]=17&len[]=18&len[]=19&len[]=20&len[]=21&len[]=22&len[]=23&len[]=24&len[]=25&len[]=26&len[]=27&len[]=28&len[]=29&len[]=30&len[]=31&len[]=32&len[]=33&len[]=34&len[]=35&len[]=36&len[]=37&len[]=38&len[]=39&len[]=40&len[]=41&len[]=42&len[]=43&len[]=44

使用hackerbar进行传参，因为BP里面输入不了中文

绕过最后两个if语句

发现只绕过了一个if语句，原来

%

是一个特殊字符，因为它用于表示百分号编码（也称为URL编码）。如果你要在URL中直接包含

%

，你需要对其进行编码。

%

的URL编码是

%25

。

成功绕过，回显得到

["3295c76acbf4caaed33c36b1b5fc2cb1","26657d5ff9020d2abefe558796b99584","73278a4a86960eeb576a8fd4c9ec6997","ec8956637a99787bd197eacd77acce5e","e2c420d928d4bf8ce0ff2ec19b371514","43ec517d68b6edd3015b3edc9a11367b","ea5d2f1c4608232e07d3aa3d998e5135","c8ffe9a587b126f152ed3d89a146b445","f457c545a9ded88f18ecee47145a72c0","03afdbd66e7929b125f8597834fa83a4","093f65e080a295f8076b1c5722a46aa2","03afdbd66e7929b125f8597834fa83a4","698d51a19d8a121ce581499d7b701668","d82c8d1619ad8176d665453cfb2e55f0","b53b3a3d6ab90ce0268229151c9bde11","9f61408e3afb633e50cdf1b20de6f466","7f39f8317fbdb1988ef4c628eba02591","07e1cd7dca89a1678042477183b7ac3f","a1d0c6e83f027327d8461063f4ac58a6","7f6ffaa6bb0b408017b62254211691b5","d67d8ab4f4c10bf22aa353e27879133c","9f61408e3afb633e50cdf1b20de6f466","e369853df766fa44e1ed0ff613f563bd","5fd0b37cd7dbbb00f97ba6ce92bf5add","67c6a1e7ce56d3d6fa748ab6d9af3fd7","3416a75f4cea9109507cacd8e2f2aefc","b53b3a3d6ab90ce0268229151c9bde11","1c383cd30b7c298ab50293adfecb7b18","3416a75f4cea9109507cacd8e2f2aefc","da4fb5c6e93e74d3df8527599fa62642","c8ffe9a587b126f152ed3d89a146b445","c0c7c76d30bd3dcaefc96f40275bdc0a","735b90b4568125ed6c3f678819b6e058","14bfa6bb14875e45bba028a21ed38046","fc490ca45c00b1249bbe3554a4fdf6fb","37693cfc748049e45d87b8c7d8b9aacd","37693cfc748049e45d87b8c7d8b9aacd","98f13708210194c475687be6106a3b84","3c59dc048e8850243be8079a5c74d079","fc490ca45c00b1249bbe3554a4fdf6fb","33e75ff09dd601bbe69f351039152189","4e732ced3463d06de0ca9a15b6153677","33e75ff09dd601bbe69f351039152189","c16a5320fa475530d9583c34fd356ef5","43ec517d68b6edd3015b3edc9a11367b"]

气死了气死了，这里一开始使用了python编写脚本，死活不对

发现

然后我就去试了试php，就可以了

脚本：

<?php$md5=["3295c76acbf4caaed33c36b1b5fc2cb1","26657d5ff9020d2abefe558796b99584","73278a4a86960eeb576a8fd4c9ec6997","ec8956637a99787bd197eacd77acce5e","e2c420d928d4bf8ce0ff2ec19b371514","43ec517d68b6edd3015b3edc9a11367b","ea5d2f1c4608232e07d3aa3d998e5135","c8ffe9a587b126f152ed3d89a146b445","f457c545a9ded88f18ecee47145a72c0","03afdbd66e7929b125f8597834fa83a4","093f65e080a295f8076b1c5722a46aa2","03afdbd66e7929b125f8597834fa83a4","698d51a19d8a121ce581499d7b701668","d82c8d1619ad8176d665453cfb2e55f0","b53b3a3d6ab90ce0268229151c9bde11","9f61408e3afb633e50cdf1b20de6f466","7f39f8317fbdb1988ef4c628eba02591","07e1cd7dca89a1678042477183b7ac3f","a1d0c6e83f027327d8461063f4ac58a6","7f6ffaa6bb0b408017b62254211691b5","d67d8ab4f4c10bf22aa353e27879133c","9f61408e3afb633e50cdf1b20de6f466","e369853df766fa44e1ed0ff613f563bd","5fd0b37cd7dbbb00f97ba6ce92bf5add","67c6a1e7ce56d3d6fa748ab6d9af3fd7","3416a75f4cea9109507cacd8e2f2aefc","b53b3a3d6ab90ce0268229151c9bde11","1c383cd30b7c298ab50293adfecb7b18","3416a75f4cea9109507cacd8e2f2aefc","da4fb5c6e93e74d3df8527599fa62642","c8ffe9a587b126f152ed3d89a146b445","c0c7c76d30bd3dcaefc96f40275bdc0a","735b90b4568125ed6c3f678819b6e058","14bfa6bb14875e45bba028a21ed38046","fc490ca45c00b1249bbe3554a4fdf6fb","37693cfc748049e45d87b8c7d8b9aacd","37693cfc748049e45d87b8c7d8b9aacd","98f13708210194c475687be6106a3b84","3c59dc048e8850243be8079a5c74d079","fc490ca45c00b1249bbe3554a4fdf6fb","33e75ff09dd601bbe69f351039152189","4e732ced3463d06de0ca9a15b6153677","33e75ff09dd601bbe69f351039152189","c16a5320fa475530d9583c34fd356ef5","43ec517d68b6edd3015b3edc9a11367b"];// 用于存储还原出的字符$flag='';for($i=0;$i<count($md5);$i++){for($j=0;$j<256;$j++){// 计算异或操作后的值$xor_result=$j^$i;// 计算MD5值$calculated_md5=md5($xor_result);// 如果计算出的MD5值与给定的MD5值匹配，则找到了正确的字符if($calculated_md5===$md5[$i]){$flag.=chr($j);break;}}}echo"Flag: ".$flag."\n";?>

BaseCTF{9614c897-f8c3-4e70-85eb-cdc4313f4364}