解压得一个png图片和一个flag.rar
图片拖入010editor
选择带zip头的这段蓝色全部复制，file-new-new Hex File，黏贴到新文件，另存为为1.zip
要密码,线索中断（当然try to restore it.png，隐藏了zip压缩包，可以用binwalk 、foremost分离。）
再去看图片是否隐写
方法一使用StegSolve查看隐写
Release StegSolve 1.4 · Giotino/stegsolve · GitHub
上面是stegslove 1.4版本下载地址，支持图片拖放
方法二使用Zsteg查看隐写
使用zsteg it.png命令看到有zip和lsb隐写
分别使用
zsteg -e "extradata:0" > 2.zip
zsteg it.png -E "b1,r,lsb,xy" > at.png
提取zip和png
图片转文字 - 图片转Excel表格 - PDF转Word - 白描网页版
!@#$%67*()-+
用这个密码解压flag.rar提示密码错误
去解压之前用010edittor从图片手工提取的zip分卷压缩文件成功，得到一个out.txt
这是啥，使用TTl解密,哪下面的博客用过的脚本解密
import binascii
binary_dict = {
'63': '00',
'127': '01',
'191': '10',
'255': '11'
}
with open('out.txt', 'r') as f:
binary_str = ''.join(binary_dict.get(num.rstrip(), '') for num in f)
number = ''.join(chr(int(binary_str[i:i+8], 2)) for i in range(0, len(binary_str), 8))
print("Binary String:", binary_str)
print("Decoded Number:", number)
下面是要输出的文件的，没有用注释掉
#data = binascii.unhexlify(number)
#with open('pass1.txt', 'wb') as f2:
f2.write(data)
拿0ac1fe6b77be5dbe作为密码去解压flag.zip
解压发现是word，改为docx后缀，打开
改色看到内容
import base64
要解码的字符串
encoded_str = '''MTEwMTEwMTExMTExMTEwMDExMTEwMTExMTExMTExMTExMTExMTExMTExMTExMTExMTAxMTEwMDAwMDAxMTExMTExMTExMDAxMTAx
MTEwMTEwMTEwMDAxMTAxMDExMTEwMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTAxMTExMTExMTExMTExMTEwMTEwMDEx
MTEwMDAwMTAxMTEwMTExMDExMTEwMTExMTExMTAwMDExMTExMTExMTExMDAxMDAxMTAxMTEwMDAwMDExMTExMDAwMDExMTExMTEx
MTEwMTEwMTAwMDAxMTExMDExMTEwMTExMTExMDExMTAxMTExMTExMTEwMTEwMTEwMTAxMTExMTExMTAwMTEwMTExMTExMTExMTEx
MTEwMTEwMTAxMTExMTExMDExMTEwMTExMTAxMDExMTAxMTExMTExMTEwMTEwMTEwMTAxMTAxMTExMTAwMTEwMTExMTExMTExMTEx
MTEwMTEwMTAwMDAxMTAwMDAwMTEwMDAwMDAxMTAwMDExMTAwMDAwMTEwMTEwMTEwMTAxMTEwMDAwMDAxMTExMDAwMDExMTExMTEx'''
按行分割字符串
lines = encoded_str.split('\n')
逐行解码并打印
for line in lines:
decoded_str = base64.b64decode(line).decode()
decoded_str = decoded_str.replace('1', ' ')
print(decoded_str)
或者把word里那几行base64拷贝出另存为3.txt，使用下面脚本
mport base64
with open('3.txt', 'r', encoding='utf-8') as file:
for line in file:
line = line.encode('utf-8').decode('unicode_escape')
line = base64.b64decode(line).decode('utf-8')
#print(line)
decoded_line = line.replace('1',' ').replace('0','o')
print( decoded_line)
He1Lo_mi5c~
flag{He1Lo_mi5c~}