NCTF2022 Misc Offical WriteUp

Misc

Signin

描述一眼丁真，玩过游戏或者看过电视剧的都会想到一段秘籍：上上下下左右左右ba

直接输入就能拿到flag，直接人眼ocr

NCTF{VVe1c0m3_T0_NCTF_2022!!!}

qrssssssss

（被非预期了，好烦

非预期解：时间排序后扫码再手动去除冗余数据得到大致的flag，然后爆破

预期：这题是通过二维码data-masking的顺序来排flag里字符顺序的，大致是：L0~7 M0~7 Q0~7 H0~7

搜了一大圈没搜到好用的脚本，于是手动写了一个识别的，具体就是识别右边标记位的黑白顺序然后比对一下

exp如下

from PIL import Image
from pyzbar.pyzbar import decode
import os

def maskanalysis(img):
    sign=''
    for ii in range(510,670,20):
        pi=img.getpixel((ii,170))
        if(pi==0):
            sign+='1'
        if(pi==255):
            sign+='0'
    return sign

def scanqr(img):
    decocdeQR = decode(img)
    return decocdeQR[0].data.decode('ascii')

qrlist=os.listdir(rC:\Users\16334\Desktop\qrssssssss_revenge)
flag=[0]*32
masklist=['11000100','11110011','10101010','10011101','00101111','00011000','01000001','01110110','00010010','00100101','01111100','01001011','11111001','11001110','10010111','10100000','01011111','01101000','00110001','00000110','10110100','10000011','11011010','11101101','10001001','10111110','11100111','11010000','01100010','01010101','00001100','00111011']
for i in qrlist:
    img=Image.open(rC:\Users\16334\Desktop\qrssssssss_revenge\{}.format(i))
    qrmask=maskanalysis(img)
    for j in range(32):
        if(masklist[j]==qrmask):
            flag[j]=scanqr(img)

print(''.join(flag))

masklist就是手动识别的掩码标记位，用的pyzbar和PIL实现扫码

NCTF{737150-eeb-465-e91-110a8fb}

qrssssssss_revenge

exp同qrssssssss

NCTF{62130783efd44b3692b4ddbecf}

炉边聚会

网上搜索一下炉石传说编码规则这样的就可以搜到这样一篇文章，看懂了就能做出来

fflag=['10001100','00000110','10011110','00000101','11001000','00000110','10111100','00000101','11001110','00001001','11010000','00000101','11110010','00000111','11001010','00000111','11110100','00001000','10001000','00001001','10010000','00001000','10111110','00000110','10001000','00001001','11010110','00001000','11001100','00001000','11110010','00000111','10110110','00000111','10011110','00000101','11100000','00000011','11101000','00000111','11110010','00000111','10110110','00000111','10111110','00000110','11100000','00000011','11100000','00000011','11100000','00000011','10110110','00000111','10111100','00000101','10010010','00001001','11001100','00001000','11001100','00001000','11111010','00000110','10110110','00000111','11110100','00001000','10011010','00001000','10111010','00000100','10010000','00001000','10001000','00001001','11110110','00000100','11100010','00001001','00000000','00000000']
for i in range(40):
    flag=fflag[2*i+1]+fflag[2*i][1:-1]+fflag[2*i][-1]
    fla=int(flag,2)
    fl=fla//10
    print(chr(fl),end='')

（其实还有另一种解法

python甚至有一个库叫hearthstone，这是我万万没有想到的，直接拿来用就行

from hearthstone.deckstrings import Deck

deck = Deck.from_deckstring('AAEDAZoFKIwGngXIBrwFzgnQBfIHygf0CIgJkAi+BogJ1gjMCPIHtgeeBeAD6AfyB7YHvgbgA+AD4AO2B7wFkgnMCMwI+ga2B/QImgi6BJAIiAn2BOIJAAA=')

for card in deck.cards:
    flag_part = int(card[0] / 10)
    print(chr(flag_part), end='')

NCTF{HearthStone_C0de_S000_FunnY_ri9ht?}

zystego

一眼丁真，图片尾部藏着一个压缩包，分析一下发现是真加密，拿去爆破得到密码是114514，直接就能拿到一个假flag（（（（

另一个文件something则是pgp的私钥，之后有用

再回到图片本身，结合宽高仔细看看可以判断出右边多出来3列像素，这里是解题的关键，于是提取出来看看，横着读它三通道

from PIL import Image, ImageDraw
import struct
width = 515
height = 512
img=Image.open(rC:\Users\16334\Desktop\fd.png)
a=[]
for i in range(height):
    for j in range(width-3,width):
        pi=img.getpixel((j,i))
        for k in range(3):
            a.append(pi[k])
print(a)

这里可能有一点点的脑洞，可以发现这些数的个位都是5或0，容易联系到二进制，所以可以写个脚本转一下

from PIL import Image, ImageDraw
import struct
width = 515
height = 512
img=Image.open(rC:\Users\16334\Desktop\fd.png)
a=[]
for i in range(height):
    for j in range(width-3,width):
        pi=img.getpixel((j,i))
        for k in range(3):
            a.append(pi[k])
for i in a:
    j=i%10
    if(j==5):
        print(1,end='')
    else:
        print(0,end='')

提取出来的二进制直接每8位转字符，就可以得到盲水印脚本以及pgp加密的口令：%$#%$#jhgasdfg76342t

import secret

丁真 = np.float32(cv2.imread(rC:\Users\16334\Desktop\fadian.png, 1))

for i in range(64):
    for j in range(64):
        芝士 = randint(0,2)
        小马珍珠 = 丁真[:, :, 芝士]
        雪豹 = cv2.dct(小马珍珠[8*i:8*i+8, 8*j:8*j+8])
        if(secret[i*64+j] == '1'):
            雪豹[7,7] = 20
        elif(secret[i*64+j] == '0'):
            雪豹[7,7] = -20
        小马珍珠[8*i:8*i+8, 8*j:8*j+8] = cv2.idct(雪豹)
        丁真[:, :, 芝士] = 小马珍珠

cv2.imwrite(rC:\Users\16334\Desktop\fd.png, 丁真)
#a gift for you : %$#%$#jhgasdfg76342t

简单替换一下变量名就可以大致看出水印的逻辑，这里给出原脚本

from random import randint
import numpy as np
from math import *
import cv2

img = np.float32(cv2.imread(rC:\Users\16334\Desktop\fadian.png, 1))
secret=open(rC:\Users\16334\Desktop\secret.txt).read()

for i in range(64):
    for j in range(64):
        cho = randint(0,2)
        imgch = img[:, :, cho]
        dctt = cv2.dct(imgch[8*i:8*i+8, 8*j:8*j+8])
        if(secret[i*64+j] == '1'):
            dctt[7,7] = 20
        elif(secret[i*64+j] == '0'):
            dctt[7,7] = -20
        imgch[8*i:8*i+8, 8*j:8*j+8] = cv2.idct(dctt)
        img[:, :, cho] = imgch

cv2.imwrite(rC:\Users\16334\Desktop\fd.png, img)

大致就是先把原图分成若干8x8的块，然后在这个块上随机选择rgb通道中的一个进行dct变换，然后根据secret.txt里是1还是0来改变dct矩阵右下角的值，然后合并进原图，最后保存

于是可以写出个简单的exp

import numpy as np
from math import *
import cv2

img = np.float32(cv2.imread(rC:\Users\16334\Desktop\fd.png, 1))

for i in range(64):
    for j in range(64):
        for k in range(3):
            imgg=img[:, :, k]
            dctt = cv2.dct(imgg[8*i:8*i+8, 8*j:8*j+8])
            if (dctt[7,7] >= 10):
                print('1',end='')
            elif(dctt[7,7]

由于dct逆变换会导致一些损失，所以判断的地方选择了与10和-10进行比较

将得到的结果转一下就能得到一个压缩包了

利用上面得到的pgp私钥和口令直接解密就可以得到flag力

NCTF{zys_1s_s0_V3g3T@13lE_qwq}