文章目录
- 一、信号不好先挂了
- 二、答题步骤
- 1.binwalk
- 2.stegsolver
- 总结
一、信号不好先挂了
题目链接：https://adworld.xctf.org.cn/task/task_list?type=misc&number=1&grade=1&page=4
二、答题步骤
1.binwalk
代码语言：javascript复制imagedata .. text: """"'&&"##"
b1,rgb,lsb,xy .. file: Zip archive data, at least v2.0 to extract
b2,rgb,msb,xy .. text: "]UUUUUUUWUU"
b2,bgr,msb,xy .. text: "U]]UUUUUUuUUu"
b4,r,msb,xy .. text: ["w" repeated 10 times]
b4,rgb,msb,xy .. text: ["w" repeated 15 times]
b4,bgr,msb,xy .. text: ["w" repeated 14 times]使用binwalk分析文件斌没发现有用的信息
2.stegsolver
使用stegsolver分析中发现
用stegsolver分离后得到压缩包解压，得到一张相似的图片：pen.png
因为两张图片长得一样，所以很容易想到可能是藏有盲水印，于是用opencv处理盲水印得到flag
代码语言：javascript复制py -3 bwm.py decode apple.png pen.png apple_pen.png
flag：unctf{9d0649505b702643}
总结
- zsteg
- 盲水印
py -3 py文件名 --original 有水印的图片名 --image 原图片名 --result 解密图片名脚本
代码语言：javascript复制# coding=utf-8
import cv2
import numpy as np
import random
import os
from argparse import ArgumentParser
ALPHA = 5
def build_parser():
parser = ArgumentParser()
parser.add_argument('--original', dest='ori', required=True)
parser.add_argument('--image', dest='img', required=True)
parser.add_argument('--result', dest='res', required=True)
parser.add_argument('--alpha', dest='alpha', default=ALPHA)
return parser
def main():
parser = build_parser()
options = parser.parse_args()
ori = options.ori
img = options.img
res = options.res
alpha = options.alpha
if not os.path.isfile(ori):
parser.error("original image %s does not exist." % ori)
if not os.path.isfile(img):
parser.error("image %s does not exist." % img)
decode(ori, img, res, alpha)
def decode(ori_path, img_path, res_path, alpha):
ori = cv2.imread(ori_path)
img = cv2.imread(img_path)
ori_f = np.fft.fft2(ori)
img_f = np.fft.fft2(img)
height, width = ori.shape[0], ori.shape[1]
watermark = (ori_f - img_f) / alpha
watermark = np.real(watermark)
res = np.zeros(watermark.shape)
random.seed(height width)
x = range(height // 2)
y = range(width)
random.shuffle(list(x))
random.shuffle(list(y))
for i in range(height // 2):
for j in range(width):
res[x[i]][y[j]] = watermark[i][j]
cv2.imwrite(res_path, res, [int(cv2.IMWRITE_JPEG_QUALITY), 100])
if __name__ == '__main__':
main()- lsb
