[MRCTF2020]Hello_ misc

解压得一个png图片和一个flag.rar

图片拖入010editor

选择带zip头的这段蓝色全部复制，file-new-new Hex File，黏贴到新文件，另存为为1.zip

要密码,线索中断（当然try to restore it.png，隐藏了zip压缩包，可以用binwalk 、foremost分离。）

再去看图片是否隐写

方法一使用StegSolve查看隐写

Release StegSolve 1.4 · Giotino/stegsolve · GitHub

上面是stegslove 1.4版本下载地址，支持图片拖放

方法二使用Zsteg查看隐写

使用zsteg it.png命令看到有zip和lsb隐写

分别使用

zsteg -e "extradata:0" > 2.zip

zsteg it.png -E "b1,r,lsb,xy" > at.png

提取zip和png

图片转文字 - 图片转Excel表格 - PDF转Word - 白描网页版

!@#$%67*()-+

用这个密码解压flag.rar提示密码错误

去解压之前用010edittor从图片手工提取的zip分卷压缩文件成功，得到一个out.txt

这是啥，使用TTl解密,哪下面的博客用过的脚本解密

[SWPU2019]Network-CSDN博客

import binascii

binary_dict = {

'63': '00',

'127': '01',

'191': '10',

'255': '11'

}

with open('out.txt', 'r') as f:

binary_str = ''.join(binary_dict.get(num.rstrip(), '') for num in f)

number = ''.join(chr(int(binary_str[i:i+8], 2)) for i in range(0, len(binary_str), 8))

print("Binary String:", binary_str)

print("Decoded Number:", number)

下面是要输出的文件的，没有用注释掉

#data = binascii.unhexlify(number)

#with open('pass1.txt', 'wb') as f2:

f2.write(data)

拿0ac1fe6b77be5dbe作为密码去解压flag.zip

解压发现是word，改为docx后缀，打开

改色看到内容

import base64

要解码的字符串

encoded_str = '''MTEwMTEwMTExMTExMTEwMDExMTEwMTExMTExMTExMTExMTExMTExMTExMTExMTExMTAxMTEwMDAwMDAxMTExMTExMTExMDAxMTAx

MTEwMTEwMTEwMDAxMTAxMDExMTEwMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTAxMTExMTExMTExMTExMTEwMTEwMDEx

MTEwMDAwMTAxMTEwMTExMDExMTEwMTExMTExMTAwMDExMTExMTExMTExMDAxMDAxMTAxMTEwMDAwMDExMTExMDAwMDExMTExMTEx

MTEwMTEwMTAwMDAxMTExMDExMTEwMTExMTExMDExMTAxMTExMTExMTEwMTEwMTEwMTAxMTExMTExMTAwMTEwMTExMTExMTExMTEx

MTEwMTEwMTAxMTExMTExMDExMTEwMTExMTAxMDExMTAxMTExMTExMTEwMTEwMTEwMTAxMTAxMTExMTAwMTEwMTExMTExMTExMTEx

MTEwMTEwMTAwMDAxMTAwMDAwMTEwMDAwMDAxMTAwMDExMTAwMDAwMTEwMTEwMTEwMTAxMTEwMDAwMDAxMTExMDAwMDExMTExMTEx'''

按行分割字符串

lines = encoded_str.split('\n')

逐行解码并打印

for line in lines:

decoded_str = base64.b64decode(line).decode()

decoded_str = decoded_str.replace('1', ' ')

print(decoded_str)

或者把word里那几行base64拷贝出另存为3.txt，使用下面脚本

mport base64

with open('3.txt', 'r', encoding='utf-8') as file:

for line in file:

line = line.encode('utf-8').decode('unicode_escape')

line = base64.b64decode(line).decode('utf-8')

#print(line)

decoded_line = line.replace('1',' ').replace('0','o')

print( decoded_line)

He1Lo_mi5c~

flag{He1Lo_mi5c~}