Quá trình giải đề. Tiêu tốn 2 lon bò húc, 1 chai 0 độ và 1 vài chai Sting
string value = string.Concat(new string[]Vậy value sẽ được gán là gì?
{
this.apha[9].ToString(),
this.apha[44].ToString(),
this.apha[9].ToString(),
this.apha[44].ToString(),
this.apha[9].ToString(),
this.apha[34].ToString(),
this.apha[34].ToString(),
this.apha[39].ToString(),
this.apha[36].ToString(),
this.apha[33].ToString(),
this.apha[23].ToString(),
this.apha[26].ToString(),
this.apha[9].ToString(),
this.apha[2].ToString(),
this.apha[29].ToString(),
this.apha[43].ToString(),
this.apha[8].ToString(),
this.apha[24].ToString(),
this.apha[26].ToString()
});
{5p3nc3r_no0o0_st0p}
eJwL9QxxDnGrzjVJz0yOh5CuZalFleUZqUWpirUAsEsLdQ==Đưa vào hackbar trên firefox decode base64 thử thì được như sau:
UITCTF{m4gic_m4gic_Everywhere!}
captchaBài này thuộc catelogy stego (steganography) và ppc (Professional programming and coding)
We've got a rather strange png file. Very strange png. Something isn't right about it...
png
iVBORw0KGgoAAAANSUhEUgAAARAAAACDCAIAAADK7dMbAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAUfSURBVHhe7dhtYtowEEVR1sWCWA+rYTNdTOqRhTSjD6NHEmjSe37Z8kgaGV6T9PQBYBmBAQQEBhAQGEBAYAABgQEEBAYQEBhAQGAAAYEBBAQGEBAYQEBgAAGBAQQEBhAQGEBAYAABgQEEBAYQEBhAQGAAAYEBBAQGEBAYQEBgAAGBAQQEBhAQGEBAYAABgQEEBAYQEBhAQGAAAYEBBAQGEBAYQEBgAAGBAQQEBhAQGEBAYAABgQEEQmD+XM+n0+l8/ZPvB6zkcss3/53b5TQ4/fSdjMvf7zd9iOk7mw9j7/vzb3w9MOU9piZ6lqRvetf+2JKnJz6lJsDvO30nBOb7NV+ALzjaemAGn283JDe09qVpjr3u6YlPITDvNvxCut+JvuBoPyIwP8T4MATmdYZfyDcGpv37Zdjf5WbD5be0O3t0t8/xIw++OmGjsvym7ajlJq71lou3svP1tg/vlX3/SR0+X691s5V9Xc1msv6ITXTt28x8O1xkbyDfNLuOTBsert8049YfNjOzFW+rrG5qSu3Gyn1ZLdyq3FpW87CVY8uBGe1VX062N507tKf5Mkz2s7oVxmqZreTf5gNu/aPefD/p0p67zkKNa8GPhymzfdsJviZf+/UnbGapKOVhkdTNfmPj9+Gw60Ra576+2yqsU5dZaKaMzoVN3WS7HGw6WbE/3Dbi6/oC1Vpgmm3vuu3D8Wbd+cMuHsCV2eWolzE3cdLb+NXHvtqa7Wm6bcbdpOm+7km9mq0/5SaUS7dlUu5jA21Zb6l+1IG7dGPJ0oncNuNd3apW0K/YTxts/LCXQ8s/YUZH6Mbisf1je+LcOx6tOhDL7C6sMucmTnobdxBHm+YTe9rMdbfuMu7rntSr2fpzNiOdvly0zdT72EBb1pvXN33eX/+gmaYyOdw1bup3nWy61wyG4jbbSH3sO3zWd/wNk2/q43TmMu6b7k84NC6z0QendxMPeusXiRuOa7pxN2m6r93l21ozW//IPtstHlt297GBtqw3qXed57vScr5xE8PjFW7upky3i8mmhXWYRx8ebiuQ2upJgWmb6YbiscvjcGwbLV3bzcIJBntvxu8vcBMnvXXNpctmw1DjWFnuIJWUombfWDWpGax/xKa7HfPA/c515jfaJx3vZM3UijI59JjWce9+uz9fLm6eeqJU37+lw00zq8mjVhEKmjbsVmhq5CWByY3v0v8mlVOVB4fnqCvZVXU4yTQt1PrQuls0j4XHiTuBuT+sw7N/7rfR8h9um/p5xj0m6x/Yuw6F7iDhe1PGQ5MTsSKeJC/TfIibQTPSifZNS5916fGm7qCbunSp9i3Hx8d9PPSpwOCd7NMPsfjJvuCrvOClgXnNkbDqV+XlNwYm7db8qP9K8ads9fCAT0/8xx2f65N5ectLO9j0BYFJu3/66ysEBgCBAQQEBhAQGEBAYAABgQEEBAYQEBhAQGAAAYEBBAQGEBAYQEBgAAGBAQQEBhAQGEBAYAABgQEEBAYQEBhAQGAAAYEBBAQGEBAYQEBgAAGBAQQEBhAQGEBAYAABgQEEBAYQEBhAQGAAAYEBBAQGEBAYQEBgAAGBAQQEBhAQGEBAYAABgQEEBAYQEBhAQGAAAYEBBAQGEBAYQEBgAAGBAQQEBhAQGEBAYAABgQEEBAYQEBhAQGAAAYEBBAQGEBAYQEBgAAGBAQQEBhAQGEBAYAABgQEEBAYQEBhAQGAAAYEBBAQGEBAYQEBgAAGBAQQEBlj28fEX4wPz1G62YicAAAAASUVORK5CYII=Tiến hành decode và ghi vào file thôi :D
http://material.wargame.whitehat.vn/contests/9/steg200_f2f6d2f2773301a5246507e25225349d.jpg
from PIL import Imageimg = Image.open("SilentRuinsGrayscale.jpg")img2 = Image.open("steg200_f2f6d2f2773301a5246507e25225349d.jpg")pix = img.load()pix2 = img2.load()for i in xrange(img.size[0]):for j in xrange(img.size[1]):if pix[i,j]!=pix2[i,j]:pix2[i,j]=(0,0,0)else:pix2[i,j]=(255,255,255)img2.save("result.jpg")
WhiteHat{2fda0b6199b0465b61fde1f43c6a721038c7f3a0}
Một mạch có đầu vào 8bit và đầu ra 8 bit tương ướng với plaintext và ciphertext (đã được base64)cipher = 4BauKt+udK5gx34Wkyq03/Wurqb1336+3zSu37S+kyq037u0u5Mq9X7fx776w99grqaupjSuYN9+Frt+334Wrt+7k2BqIrsqrt9+u4uu9d++ICDfu7S7kyr1ft9+Fq7f4JMqKsPfKr5+3+CTfhbfk37LFlag = WhiteHat{sha1(plaintext)}Schematic của mạch mã hóa được vẽ bằng mô phỏng proteus như sau:
import base64def NAND(a,b):a=int(a)b=int(b)if not (a&b):return 1return 0def XOR(a,b):a=int(a)b=int(b)if a != b:return 1else:return 0def N1(a):return NAND(a[0],a[1])def N2(a):return NAND(a[2],a[3])def N3(a):return NAND(a[4],a[5])def N4(a):return NAND(a[6],a[7])def N5(a):return NAND(a[0],a[2])def N6(a):return NAND(a[1],a[3])def N7(a):return NAND(a[4],a[6])def N8(a):return NAND(a[5],a[7])def X11(a):return XOR(N1(a),a[1])def X12(a):return XOR(N2(a),a[1])def X13(a):return XOR(N3(a),a[2])def X14(a):return XOR(N4(a),a[3])def X15(a):return XOR(N5(a),a[4])def X16(a):return XOR(N6(a),a[5])def X17(a):return XOR(N7(a),a[6])def X18(a):return XOR(N8(a),a[7])def X21(a):return XOR(X11(a),a[6])def X22(a):return XOR(X12(a),a[3])def X23(a):return XOR(X13(a),a[4])def X24(a):return XOR(X14(a),a[5])def X25(a):return XOR(X15(a),a[6])def X26(a):return XOR(X16(a),a[7])def X27(a):return XOR(X17(a),a[0])def X28(a):return XOR(X18(a),a[1])def toChar(a):a = char2binary(a)bin = str(X21(a))bin += str(X22(a))bin += str(X23(a))bin += str(X24(a))bin += str(X25(a))bin += str(X26(a))bin += str(X27(a))bin += str(X28(a))return bindef char2binary(a):x=format(ord(a),'b').zfill(8)return xcipher = base64.b64decode("4BauKt+udK5gx34Wkyq03/Wurqb1336+3zSu37S+kyq037u0u5Mq9X7fx776w99grqaupjSuYN9+Frt+334Wrt+7k2BqIrsqrt9+u4uu9d++ICDfu7S7kyr1ft9+Fq7f4JMqKsPfKr5+3+CTfhbfk37L")key = []for n in xrange(0,len(cipher)):k = []c = char2binary(cipher[n])for i in xrange(32,126):res = toChar(chr(i))if res==c:k.append(chr(i))key.append(k)if len(k)==0:print "Fail"exit(1)flag = ""for i in xrange(len(key)):flag+=key[i][0]print i,key[i]print flag
Run tiếp:def X21(a):# return XOR(X11(a),a[6])return XOR(X11(a),a[7])
C:\Users\phieu lang\Desktop\WH9>crypto300.py
0 ['W']
1 ['H', '|']
2 ['E']
3 ['D', 'N', 'z']
4 [' ', '[']
5 ['E']
6 ['V']
7 ['E']
8 ['R']
9 ['Y']
10 ['T', '^']
11 ['H', '|']
12 ['I']
13 ['D', 'N', 'z']
14 ['G']
15 [' ', '[']
16 ['S']
17 ['E']
18 ['E']
19 ['M']
20 ['S']
21 [' ', '[']
22 ['T', '^']
23 ['O']
24 [' ', '[']
25 ['B']
26 ['E']
27 [' ', '[']
28 ['G']
29 ['O']
30 ['I']
31 ['D', 'N', 'z']
32 ['G']
33 [' ', '[']
34 ['A']
35 ['G']
36 ['A']
37 ['I']
38 ['D', 'N', 'z']
39 ['S']
40 ['T', '^']
41 [' ', '[']
42 ['Y']
43 ['O']
44 ['U']
45 [',']
46 [' ', '[']
47 ['R']
48 ['E']
49 ['M']
50 ['E']
51 ['M']
52 ['B']
53 ['E']
54 ['R']
55 [' ', '[']
56 ['T', '^']
57 ['H', '|']
58 ['A']
59 ['T', '^']
60 [' ', '[']
61 ['T', '^']
62 ['H', '|']
63 ['E']
64 [' ', '[']
65 ['A']
66 ['I']
67 ['R']
68 ['+', 'P']
69 ['L', 'x']
70 ['A']
71 ['D', 'N', 'z']
72 ['E']
73 [' ', '[']
74 ['T', '^']
75 ['A']
76 ['K']
77 ['E']
78 ['S']
79 [' ', '[']
80 ['O']
81 ['F']
82 ['F']
83 [' ', '[']
84 ['A']
85 ['G']
86 ['A']
87 ['I']
88 ['D', 'N', 'z']
89 ['S']
90 ['T', '^']
91 [' ', '[']
92 ['T', '^']
93 ['H', '|']
94 ['E']
95 [' ', '[']
96 ['W']
97 ['I']
98 ['D', 'N', 'z']
99 ['D', 'N', 'z']
100 [',']
101 [' ', '[']
102 ['D', 'N', 'z']
103 ['O']
104 ['T', '^']
105 [' ', '[']
106 ['W']
107 ['I']
108 ['T', '^']
109 ['H', '|']
110 [' ', '[']
111 ['I']
112 ['T', '^']
113 ['$', '.']
WHED EVERYTHIDG SEEMS TO BE GOIDG AGAIDST YOU, REMEMBER THAT THE AIR+LADE TAKES OFF AGAIDST THE WIDD, DOT WITH IT$Fix lại 1 số chỗ ta được key chính xác là:
WHEN EVERYTHING SEEMS TO BE GOING AGAINST YOU, REMEMBER THAT THE AIRPLANE TAKES OFF AGAINST THE WIND, NOT WITH IT.OK giờ ta có flag:
WhiteHat{5ad8000a22f19c27cba191e4e6812c1833141138}
