{"id":313,"date":"2024-05-28T11:41:10","date_gmt":"2024-05-28T03:41:10","guid":{"rendered":"https:\/\/zysgmzb.club\/?p=313"},"modified":"2024-05-28T13:15:03","modified_gmt":"2024-05-28T05:15:03","slug":"rctf2024-%e4%ba%ac%e4%b8%9cctf2024-%e7%9a%84%e4%b8%80%e7%82%b9%e7%82%b9wp","status":"publish","type":"post","link":"https:\/\/zysgmzb.club\/index.php\/archives\/313","title":{"rendered":"RCTF2024 & \u4eac\u4e1cCTF2024 \u7684\u4e00\u70b9\u70b9wp"},"content":{"rendered":"
\n

\u5468\u672b\u6253\u4e86\u6253RCTF\u548c\u4eac\u4e1cctf\uff0c\u611f\u89c9\u9898\u90fd\u8fd8\u53ef\u4ee5\uff0c\u5c31\u662f\u91cf\u592a\u5c11\u4e86\uff0c\u53d1\u4e2awp\u73a9\u73a9<\/p>\n<\/blockquote>\n

RCTF<\/h2>\n

FindAHacker<\/h3>\n

(\u96ea\u6b87\u7684\u5929\u624d\u60f3\u6cd5<\/p>\n

pslist\u53d1\u73b0idap64\u8fdb\u7a0b<\/p>\n

dump\u4e0b\u6765\u62d6gimp\u968f\u4fbf\u8c03\u8c03<\/p>\n

\"\"<\/p>\n

\u731c\u6d4b\u4e0a\u4e0b\u4e24\u4e2axor\u53d1\u73b0\u5168\u662f\u660e\u6587\uff0c\u6700\u540e\u5305\u4e0aRCTF{}<\/p>\n

\"\"<\/p>\n

sec-image<\/h3>\n

\u6bcf\u5f20\u56fe\u520640x40\uff0c\u7136\u540e\u4e2d\u95f4\u768412*14\u662f\u8981\u6ce8\u610f\u7684\u5730\u65b9\uff0c\u6bcf\u4e00\u5f20\u91cc\u9762\u90fd\u5199\u4e86\u56db\u4e2a\u5b57\u7b26\uff0c\u7b2c\u4e00\u5f20\u56fe\u91cc\u53ef\u4ee5\u6a21\u7cca\u7684\u770b\u5230RCTF\u5b57\u6837<\/p>\n

\"\"<\/p>\n

\u91cc\u9762\u518d\u52062x2\uff0c\u5de6\u4e0a\u89d2\u4ee3\u8868\u7b2c\u4e00\u4e2a\u5b57\u7b26\uff0c\u53f3\u4e0a\u89d2\u4ee3\u8868\u7b2c\u4e8c\u4e2a\uff0c\u4ee5\u6b64\u7c7b\u63a8<\/p>\n

Exp<\/p>\n

from PIL import Image\n\nORIGINAL_WIDTH, ORIGINAL_HEIGHT = 800, 800\nSUB_IMAGE_SIZE = 20\n\ndef check_left_top(sub_image):\n    box = (4, 4, 16, 18)\n    sub_sub_image = sub_image.crop(box)\n    result = ""\n    for yy in range(0, 14, 2):\n        for xx in range(0, 12, 2):\n            result += "1" if (sub_sub_image.getpixel((xx, yy)) %\n                              2 == 0) else "0"\n    if ("0" not in result):\n        return True\n    return False\n\ndef check_right_top(sub_image):\n    box = (4, 4, 16, 18)\n    sub_sub_image = sub_image.crop(box)\n    result = ""\n    for yy in range(0, 14, 2):\n        for xx in range(0, 12, 2):\n            result += "1" if (sub_sub_image.getpixel((xx+1, yy)) %\n                              2 == 0) else "0"\n    if ("0" not in result):\n        return True\n    return False\n\ndef check_left_bottom(sub_image):\n    box = (4, 4, 16, 18)\n    sub_sub_image = sub_image.crop(box)\n    result = ""\n    for yy in range(0, 14, 2):\n        for xx in range(0, 12, 2):\n            result += "1" if (sub_sub_image.getpixel((xx, yy+1)) %\n                              2 == 0) else "0"\n    if ("0" not in result):\n        return True\n    return False\n\ndef check_right_bottom(sub_image):\n    box = (4, 4, 16, 18)\n    sub_sub_image = sub_image.crop(box)\n    result = ""\n    for yy in range(0, 14, 2):\n        for xx in range(0, 12, 2):\n            result += "1" if (sub_sub_image.getpixel((xx+1, yy+1)) %\n                              2 == 0) else "0"\n    if ("0" not in result):\n        return True\n    return False\n\nfor pic in range(10):\n    img_left_top = Image.new("L", (40, 40), 'white')\n    img_right_top = Image.new("L", (40, 40), 'white')\n    img_left_bottom = Image.new("L", (40, 40), 'white')\n    img_right_bottom = Image.new("L", (40, 40), 'white')\n    image = Image.open(f'.\/test\/flag{pic}.png').convert('L')\n    res = ""\n    for y in range(0, ORIGINAL_HEIGHT, SUB_IMAGE_SIZE):\n        for x in range(0, ORIGINAL_WIDTH, SUB_IMAGE_SIZE):\n            box = (x, y, x + SUB_IMAGE_SIZE, y + SUB_IMAGE_SIZE)\n            sub_image = image.crop(box)\n            if (check_left_top(sub_image)):\n                img_left_top.putpixel((x\/\/20, y\/\/20), 0)\n            if (check_right_top(sub_image)):\n                img_right_top.putpixel((x\/\/20, y\/\/20), 0)\n            if (check_left_bottom(sub_image)):\n                img_left_bottom.putpixel((x\/\/20, y\/\/20), 0)\n            if (check_right_bottom(sub_image)):\n                img_right_bottom.putpixel((x\/\/20, y\/\/20), 0)\n    img_left_top.save(f".\/out\/{pic}_0_0.png")\n    img_right_top.save(f".\/out\/{pic}_0_1.png")\n    img_left_bottom.save(f".\/out\/{pic}_1_0.png")\n    img_right_bottom.save(f".\/out\/{pic}_1_1.png")<\/code><\/pre>\n
\u7ed3\u679c<\/p>\n
\"\"<\/p>\n
gogogo<\/h3>\n
pslist\u53d1\u73b0\u4e00\u5806\u7684firefox\uff0c\u4e8e\u662f\u53bbdump\u4e86places.sqlite\u5e76\u53d1\u73b0\u4e86\u91cc\u9762\u7684\u767e\u5ea6\u7f51\u76d8\u5730\u5740\uff0c\u63d0\u53d6\u7801\u5219\u5728\u526a\u5207\u677f\u91cc<\/p>\n
https:\/\/pan.baidu.com\/s\/1ZllFd8IK-oHvTCYl61_7Kw\n\u63d0\u53d6\u7801\uff1acwqs<\/code><\/pre>\n
\u4e0b\u8f7d\u4e0b\u6765\u6587\u4ef6\u540d\u662fpwd=?\uff0c\u4e8e\u662f\u53bb\u5185\u5b58\u91cc\u5168\u5c40\u641c\u7d22pwd=\uff0c\u53d1\u73b0\u4e86\u4e00\u4e2ab\u7ad9\u7528\u6237\u7684\u540d\u5b57\uff0c\u7136\u540e\u5bc6\u7801\u4e3a\u5176uid<\/p>\n
\"\"<\/p>\n
\u89e3\u5f00\u538b\u7f29\u5305\u540e\u518d\u89e3\u952e\u76d8\u6d41\u91cf\uff0c\u7ed3\u679c\u5982\u4e0b<\/p>\n
niuo ybufmefhui kjqillxdjwmi uizebuui\ndvoo\nudpn uibuui jqybdm vegeyisi\nvemeuoll jxysgowodmnkderf dbmzfa hkhkdazi\nzvjnybufme hkwjdeggma\nna mimajqueviig\nkyllda doqisl ba\npnynqrpn\nqrxcxxzimu<\/code><\/pre>\n
\u7ed3\u5408\u6d41\u91cf\u5305\u540dlqld\u8fdb\u884c\u201c\u5408\u7406\u8111\u6d1e\u201d\u540e\u731c\u6d4b\u53ef\u80fd\u662f\u8fde\u8d77\u6765\u6253\u6216\u8005\u662f\u8fde\u8d77\u6765\u8bfb\uff0c\u5c1d\u8bd5\u540e\u53d1\u73b0\u4e3a\u53cc\u62fc\u8f93\u5165\uff0c\u624b\u6253\u7ed3\u679c\u5982\u4e0b<\/p>\n
\u4f60\u8bf4 \u6709\u4ec0\u4e48\u65b9\u5f0f \u770b\u8d77\u6765\u50cf\u52a0\u5bc6\n\u662f\u8fd9\u4e0d\u662f \u5bf9\u54e6\n\u53cc\u62fc \u662f\u4e0d\u662f \u5c31\u6709\u70b9 \u8fd9\u4e2a\u610f\u601d\n\u8fd9\u4e48\u8bf4\u6765 \u501f\u7528\u8fc7\u6211\u7535\u8111\u7684\u4eba \u90fd\u6ca1\u6cd5 \u597d\u597d\u6253\u5b57\n\u6700\u8fd1\u6709\u4ec0\u4e48 \u597d\u73a9\u7684\u8ddf\u5988 \u90a3 \u5bc6\u7801\u5c31\u8bbe\u7f6e\u6210\n\u5feb\u6765\u6253 \u593a\u65d7\u8d5b \u5427\n\u62fc\u97f3\u5168\u62fc \u5168\u5c0f\u5199\u5b57\u6bcd<\/code><\/pre>\n
\u56e0\u6b64\u5f97\u5230\u5bc6\u7801\u4e3akuailaidaduoqisaiba\uff0c\u89e3\u5f00\u538b\u7f29\u5305\u62ff\u5230flag\uff0c\u53ef\u4ee5\u8bf4\u662f\u5f88\u5957\u9898\u4e86<\/p>\n
\u4eac\u4e1cctf<\/h2>\n
flag_video_version<\/h3>\n
udp12345\u7aef\u53e3\u4f20\u5947\u602a\u534f\u8bae\uff0c\u548c\u53bb\u5e74\u4e00\u6837<\/p>\n
\u5f00\u5934\u4f20\u4e86\u4e2asdp.txt\uff0c\u7b80\u5355\u4e86\u89e3\u4e00\u4e0b\uff0c\u5f97\u77e5\u662fsdp\u534f\u8bae\uff0c\u5e76\u4e14\u8fd9\u91cc\u662fH264\u7f16\u7801<\/p>\n
\u5bf9\u7740udp\u6d41\u53f3\u952e\u9009decode as\uff0c\u7136\u540e\u9009rtp\u5c31\u53ef\u4ee5\u6e05\u6670\u7684\u770b\u5230\u534f\u8bae\u683c\u5f0f\u4e86<\/p>\n
\"\"<\/p>\n
\u540c\u65f6\u53ef\u4ee5\u6e05\u695a\u7684\u770b\u5230\u8fd8\u5206\u5e8f\u5217\u53f7<\/p>\n
\u5148\u5168\u90e8\u63d0\u53d6\u51fa\u6765<\/p>\n
tshark -r challenge.pcapng -T fields -Y "udp" -e data.data | sed '\/^\\s*$\/d' > 1.txt<\/code><\/pre>\n
\u7136\u540e\u6839\u636ewireshark\u7684\u89e3\u6790\u63d0\u7eaf\uff0c\u518d\u6309\u7167\u5e8f\u5217\u53f7\u8fdb\u884c\u6392\u5e8f<\/p>\n
f = open("1.txt").readlines()\n\nall = {}\nfor i in f:\n    ii = i.strip()\n    seq = int(ii[4:8], 16)\n    data = ii[24:]\n    all[seq] = data\n\nwith open("out.mp4", "wb")as out:\n    for i in range(1246):\n        out.write(bytes.fromhex(all[i]))<\/code><\/pre>\n
\u5c31\u5f97\u5230flag\u4e86<\/p>\n","protected":false},"excerpt":{"rendered":"
\u5468\u672b\u6253\u4e86\u6253RCTF\u548c\u4eac\u4e1cctf\uff0c\u611f\u89c9\u9898\u90fd\u8fd8\u53ef\u4ee5\uff0c\u5c31\u662f\u91cf\u592a\u5c11\u4e86\uff0c\u53d1\u4e2awp\u73a9\u73a9 RCTF FindAHacker (\u96ea\u6b87\u7684\u5929\u624d\u60f3\u6cd5 pslist\u53d1\u73b0idap64\u8fdb\u7a0b dump\u4e0b\u6765\u62d6gimp\u968f\u4fbf\u8c03\u8c03 \u731c\u6d4b\u4e0a\u4e0b\u4e24\u4e2axor\u53d1\u73b0\u5168\u662f\u660e\u6587\uff0c\u6700\u540e\u5305\u4e0aRCTF{} sec-image \u6bcf\u5f20\u56fe\u520640×40\uff0c\u7136\u540e\u4e2d\u95f4\u768412*14\u662f\u8981\u6ce8\u610f\u7684\u5730\u65b9\uff0c\u6bcf\u4e00\u5f20\u91cc\u9762\u90fd\u5199\u4e86\u56db\u4e2a\u5b57\u7b26\uff0c\u7b2c\u4e00\u5f20\u56fe\u91cc\u53ef\u4ee5\u6a21\u7cca\u7684\u770b\u5230RCTF\u5b57\u6837 \u91cc\u9762\u518d\u52062x […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-313","post","type-post","status-publish","format-standard","hentry","category-wp"],"_links":{"self":[{"href":"https:\/\/zysgmzb.club\/index.php\/wp-json\/wp\/v2\/posts\/313","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/zysgmzb.club\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/zysgmzb.club\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/zysgmzb.club\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/zysgmzb.club\/index.php\/wp-json\/wp\/v2\/comments?post=313"}],"version-history":[{"count":2,"href":"https:\/\/zysgmzb.club\/index.php\/wp-json\/wp\/v2\/posts\/313\/revisions"}],"predecessor-version":[{"id":315,"href":"https:\/\/zysgmzb.club\/index.php\/wp-json\/wp\/v2\/posts\/313\/revisions\/315"}],"wp:attachment":[{"href":"https:\/\/zysgmzb.club\/index.php\/wp-json\/wp\/v2\/media?parent=313"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/zysgmzb.club\/index.php\/wp-json\/wp\/v2\/categories?post=313"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/zysgmzb.club\/index.php\/wp-json\/wp\/v2\/tags?post=313"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}