{"id":2206,"date":"2025-12-30T21:33:17","date_gmt":"2025-12-30T13:33:17","guid":{"rendered":"https:\/\/www.sanjiuctf.cn\/?p=2206"},"modified":"2025-12-30T21:33:18","modified_gmt":"2025-12-30T13:33:18","slug":"xctf%e6%94%bb%e9%98%b2%e4%b8%96%e7%95%8cmisc%e9%9a%be%e5%ba%a6%e5%9b%9b%e6%89%80%e6%9c%89%e6%95%b4%e5%90%88wp","status":"publish","type":"post","link":"https:\/\/www.sanjiuctf.cn\/?p=2206","title":{"rendered":"XCTF\u653b\u9632\u4e16\u754cMisc\u96be\u5ea6\u56db\u6240\u6709\u6574\u5408wp"},"content":{"rendered":"\n

\u524d\u8a00\uff1a<\/h2>\n\n\n\n

\u628a\u653b\u9632\u4e16\u754c\u96be\u5ea6\u56db\u5168\u90e8\u6574\u5408\u4e86\uff0c\u6709\u70b9\u96be\u5ea6\uff0c\u8fd8\u597d\uff0c\u8111\u6d1e\u9898\uff0c\u6709\u4e9b\u633a\u7b80\u5355\u7684<\/p>\n\n\n\n

\u4f5c\u8005-\u53c1\u7396<\/p>\n\n\n\n

1.Cat_Jump<\/h2>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n

010\u641c\u7d22CatCTF{<\/p>\n\n\n\n

\u5c31\u884c<\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n
CatCTF{EFI_1sv3ry_funn9}<\/code><\/pre>\n\n\n\n
2.miao~<\/h2>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u56fe\u7247\u8fdb\u884cforemost \u53ef\u4ee5\u5f97\u5230\u97f3\u9891<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
Audacity \u67e5\u770b\u9891\u8c31\u56fe<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u53ef\u4ee5\u53d1\u73b0CatCTF \u8fd9\u4e2a\u5e94\u8be5\u662f\u4e00\u4e2a\u5bc6\u94a5<\/p>\n\n\n\n
\u7528DeepSound\u9690\u5199<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u517d\u97f3\u89e3\u5bc6<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
CatCTF{d0_y0u_Hate_c4t_ba3k1ng_?_M1ao~}<\/code><\/pre>\n\n\n\n
3.cantnim<\/h2>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u7ecf\u5178\u7684 Nim \u6e38\u620f<\/strong>\uff1a<\/p>\n\n\n\n
\u6709\u591a\u5806\u77f3\u5b50\uff0c\u73a9\u5bb6\u8f6e\u6d41\u4ece\u4efb\u610f\u4e00\u5806\u4e2d\u53d6\u51fa\u4efb\u610f\u6570\u91cf\u7684\u77f3\u5b50\uff08\u81f3\u5c11\u4e00\u4e2a\uff09\n\u65e0\u6cd5\u53d6\u77f3\u5b50\u7684\u73a9\u5bb6\u8f93\n\u5148\u624b\u73a9\u5bb6\u6709 50 \u79d2\u65f6\u95f4\u9650\u5236\uff0c\u5fc5\u987b\u901a\u8fc7\u591a\u8f6e\u6e38\u620f\u83b7\u80dc\u624d\u80fd\u83b7\u5f97 flag<\/code><\/pre>\n\n\n\n
\u5173\u952e\uff1a\u5f53\u4e14\u4ec5\u5f53\u6240\u6709\u5806\u77f3\u5b50\u6570\u7684 **\u5f02\u6216\u548c\uff08Nim-sum\uff09\u4e0d\u4e3a 0** \u65f6\uff0c\u5148\u624b\u6709\u5fc5\u80dc\u7b56\u7565\n\u5fc5\u80dc\u7b56\u7565\uff1a\u6bcf\u6b21\u79fb\u52a8\u540e\u4f7f\u6240\u6709\u5806\u77f3\u5b50\u6570\u7684\u5f02\u6216\u548c\u53d8\u4e3a 0\n\u64cd\u4f5c\u65b9\u6cd5\uff1a\u8ba1\u7b97\u5f53\u524d\u5f02\u6216\u548c `nim_sum`\uff0c\u627e\u5230\u4e00\u5806\u77f3\u5b50 `piles[i]` \u4f7f\u5f97 `piles[i] ^ nim_sum < piles[i]`\uff0c\u4ece\u8be5\u5806\u53d6\u8d70 `piles[i] - (piles[i] ^ nim_sum)` \u4e2a\u77f3\u5b50<\/code><\/pre>\n\n\n\n
\u89e3\u9898\u6b65\u9aa4<\/strong><\/p>\n\n\n\n
\u8fde\u63a5\u670d\u52a1\u5668\uff1a\u9009\u62e9\u6b63\u5f0f\u6e38\u620f\uff08\u8f93\u5165 `N`\uff09\n\u6570\u636e\u89e3\u6790\uff1a\u670d\u52a1\u5668\u8fd4\u56de\u683c\u5f0f\u4e3a `Now pile:` \u540e\u8ddf\u4e00\u957f\u4e32\u6570\u5b57\uff0c\u8868\u793a\u5404\u5806\u77f3\u5b50\u6570\n\u81ea\u52a8\u4ea4\u4e92\uff1a\u7f16\u5199 Python \u811a\u672c\u5b9e\u73b0\uff1a\n- \u89e3\u6790\u77f3\u5b50\u5806\u6570\u636e\uff08\u6ce8\u610f\uff1a\u670d\u52a1\u5668\u4f7f\u7528 **0-based \u7d22\u5f15**\uff09\n- \u8ba1\u7b97\u5f02\u6216\u548c\u5e76\u6267\u884c\u5fc5\u80dc\u7b56\u7565\n- \u4f9d\u6b21\u53d1\u9001 `\u5806\u7d22\u5f15` \u548c `\u53d6\u77f3\u6570\u91cf`\n\u91cd\u590d\u6e38\u620f\uff1a\u6301\u7eed\u8fdb\u884c\u76f4\u5230\u83b7\u80dc<\/code><\/pre>\n\n\n\n
py3\u811a\u672c\u5448\u73b0<\/p>\n\n\n\n
from pwn import *\nimport re\n\ndef solve():\n    # \u8fde\u63a5\u670d\u52a1\u5668\n    host = '61.147.171.35'\n    port = 57796\n    conn = remote(host, port)\n\n    # \u9009\u62e9\u6b63\u5f0f\u6e38\u620f\uff08\u4e0d\u8981\u8bd5\u73a9\uff09\n    conn.recvuntil(b'(Y\/N)?')\n    conn.sendline(b'N')\n\n    game_round = 1\n\n    try:\n        while True:\n            # \u63a5\u6536\u6570\u636e\u76f4\u5230\"where:\"\n            data = conn.recvuntil(b'where:').decode()\n\n            # \u6253\u5370\u8c03\u8bd5\u4fe1\u606f\uff08\u524d\u51e0\u8f6e\uff09\n            if game_round <= 5:\n                print(f\"n=== Round {game_round} ===\")\n                print(f\"Received data:n{data[-500:]}\")\n\n            # \u68c0\u67e5\u662f\u5426\u83b7\u80dc\u6216\u5931\u8d25\n            if 'You win' in data or 'You lose' in data:\n                print(f\"nGame Over: {'Win' if 'You win' in data else 'Lose'}\")\n                print(\"Full data:\", data)\n                break\n\n            # \u67e5\u627e\u77f3\u5b50\u5806\u4fe1\u606f\n            # \u53ef\u80fd\u6709\u591a\u884c\uff0c\u627e\u5230\u6700\u540e\u51fa\u73b0\u7684\"Now pile:\"\n            now_pile_index = data.rfind('Now pile:')\n            if now_pile_index == -1:\n                print(\"Error: 'Now pile:' not found\")\n                print(\"Data received:\", data)\n                break\n\n            # \u63d0\u53d6\u77f3\u5b50\u5806\u884c\n            pile_line = data[now_pile_index:]\n            # \u53ef\u80fd\u5305\u542b\u6362\u884c\uff0c\u53d6\u7b2c\u4e00\u884c\n            if 'n' in pile_line:\n                pile_line = pile_line.split('n')[0]\n\n            # \u63d0\u53d6\u6570\u5b57\n            numbers = re.findall(r'bd+b', pile_line)\n            # \u8df3\u8fc7\"Now pile:\"\u8fd9\u4e2a\u8bcd\u672c\u8eab\n            if numbers and numbers[0].isdigit():\n                piles = list(map(int, numbers))\n            else:\n                print(\"Error: No numbers found in pile line\")\n                print(\"Pile line:\", pile_line)\n                break\n\n            # \u6253\u5370\u5f53\u524d\u77f3\u5b50\u5806\u4fe1\u606f\n            print(f\"Round {game_round}: Found {len(piles)} piles\")\n            if len(piles) <= 10:\n                print(f\"Piles: {piles}\")\n            else:\n                print(f\"First 5 piles: {piles[:5]}\")\n\n            # \u8ba1\u7b97Nim\u6e38\u620f\u7684\u5f02\u6216\u548c\n            xor_sum = 0\n            for p in piles:\n                xor_sum ^= p\n\n            print(f\"Nim xor sum: {xor_sum}\")\n\n            # \u5bfb\u627e\u5fc5\u80dc\u7b56\u7565\n            move_found = False\n            pile_index = -1\n            take_amount = 0\n\n            if xor_sum != 0:\n                # \u6709\u5fc5\u80dc\u7b56\u7565\uff0c\u627e\u5230\u4e00\u5806\u4f7f\u5f02\u6216\u548c\u53d8\u4e3a0\n                for i, pile in enumerate(piles):\n                    if pile ^ xor_sum < pile:\n                        pile_index = i  # 0-based\u7d22\u5f15\n                        take_amount = pile - (pile ^ xor_sum)\n                        move_found = True\n                        break\n\n            if not move_found:\n                # \u6ca1\u6709\u5fc5\u80dc\u7b56\u7565\uff08\u5fc5\u8d25\u5c40\u9762\uff09\uff0c\u4ece\u7b2c\u4e00\u4e2a\u975e\u7a7a\u5806\u53d61\u4e2a\n                for i, pile in enumerate(piles):\n                    if pile > 0:\n                        pile_index = i\n                        take_amount = 1\n                        print(f\"Warning: No winning move found, using fallback\")\n                        break\n\n            if pile_index == -1:\n                print(\"Error: No valid move found\")\n                break\n\n            print(f\"Move: Take {take_amount} from pile {pile_index}\")\n\n            # \u53d1\u9001\u5806\u7d22\u5f15\uff080-based\uff09\n            conn.sendline(str(pile_index).encode())\n\n            # \u63a5\u6536\"count:\"\u63d0\u793a\n            count_prompt = conn.recvuntil(b'count:')\n\n            # \u53d1\u9001\u53d6\u77f3\u6570\u91cf\n            conn.sendline(str(take_amount).encode())\n\n            game_round += 1\n\n            # \u68c0\u67e5\u662f\u5426\u8d85\u8fc7\u4e00\u5b9a\u8f6e\u6570\uff08\u9632\u6b62\u65e0\u9650\u5faa\u73af\uff09\n            if game_round > 1000:\n                print(\"Warning: Exceeded 1000 rounds, stopping\")\n                break\n\n    except EOFError:\n        print(\"nConnection closed by server\")\n        # \u5c1d\u8bd5\u83b7\u53d6\u6700\u540e\u7684\u6570\u636e\n        try:\n            final_data = conn.recvall(timeout=2).decode()\n            print(\"Final data received:\")\n            print(final_data)\n\n            # \u68c0\u67e5\u662f\u5426\u6709flag\n            if 'flag{' in final_data.lower() or 'ctf{' in final_data.lower():\n                print(\"n\" + \"=\"*50)\n                print(\"FLAG FOUND!\")\n                print(\"=\"*50)\n                # \u5c1d\u8bd5\u63d0\u53d6flag\n                flag_match = re.search(r'(flag{[^}]+}|ctf{[^}]+})', final_data, re.IGNORECASE)\n                if flag_match:\n                    print(f\"Flag: {flag_match.group(1)}\")\n                else:\n                    print(\"Could not extract flag, here's the full data:\")\n                    print(final_data)\n        except:\n            pass\n    except Exception as e:\n        print(f\"nError occurred: {e}\")\n        import traceback\n        traceback.print_exc()\n    finally:\n        conn.close()\n\nif __name__ == '__main__':\n    solve()<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
cyberpeace{aca1afe82bab143749aac938be674d59}<\/code><\/pre>\n\n\n\n
4.Time_losing<\/h2>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u4e3b\u8981\u770b\u65f6\u95f4<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u5c06\u6240\u6709\u6587\u4ef6\u6309\u6570\u5b57\u6392\u5e8f\uff08\u4ece0\u523046\uff0c\u56e0\u4e3a\u6587\u4ef6\u540d\u662f0.txt\u523046.txt\uff09\n\u5bf9\u4e8e\u6bcf\u4e2a\u6587\u4ef6\uff0c\u8ba1\u7b97\u4fee\u6539\u65f6\u95f4\u4e0e2033-05-18 11:33:20\u7684\u65f6\u95f4\u5dee\uff08\u79d2\uff09\n\u5c06\u65f6\u95f4\u5dee\uff08\u6574\u6570\u79d2\uff09\u8f6c\u6362\u4e3a\u5b57\u7b26\uff08ASCII\uff09\n\u5408\u5e76\u6240\u6709\u5b57\u7b26\u5f97\u5230flag\uff0cflag\u683c\u5f0f\u662fXMan{}<\/code><\/pre>\n\n\n\n
    \n
  1. \u83b7\u53d6\u6587\u4ef6\u5939\u4e2d\u6240\u6709txt\u6587\u4ef6\uff0c\u6309\u6587\u4ef6\u540d\u6570\u5b57\u6392\u5e8f<\/li>\n\n\n\n
  2. \u5c06\u53c2\u8003\u65f6\u95f4\u8bbe\u4e3a2033-05-18 11:33:20<\/li>\n\n\n\n
  3. \u904d\u5386\u6bcf\u4e2a\u6587\u4ef6\uff0c\u83b7\u53d6\u4fee\u6539\u65f6\u95f4\uff0c\u8ba1\u7b97\u4e0e\u53c2\u8003\u65f6\u95f4\u7684\u65f6\u95f4\u5dee\uff08\u79d2\uff09<\/li>\n\n\n\n
  4. \u5c06\u65f6\u95f4\u5dee\u8f6c\u6362\u4e3a\u6574\u6570\uff0c\u7136\u540e\u8f6c\u6362\u4e3a\u5bf9\u5e94\u7684ASCII\u5b57\u7b26<\/li>\n\n\n\n
  5. \u5408\u5e76\u8fd9\u4e9b\u5b57\u7b26\uff0c\u6700\u540e\u7528XMan{}\u5305\u88f9<\/li>\n<\/ol>\n\n\n\n
    py3\u811a\u672c\u5448\u73b0<\/p>\n\n\n\n
    import os\nimport datetime\n\ndef extract_flag():\n    txt_files = [f for f in os.listdir('.') if f.endswith('.txt')]\n\n    def file_num(f):\n        return int(f.split('.')[0])\n\n    txt_files.sort(key=file_num)\n\n    reference = datetime.datetime(2033, 5, 18, 11, 33, 20)\n\n    flag_chars = []\n\n    for filename in txt_files:\n        mtime = os.path.getmtime(filename)\n        file_dt = datetime.datetime.fromtimestamp(mtime)\n        time_diff = (file_dt - reference).total_seconds()\n        ascii_val = int(time_diff)\n        flag_chars.append(chr(ascii_val))\n\n    flag = ''.join(flag_chars)\n    return flag\n\nif __name__ == \"__main__\":\n    result = extract_flag()\n    print(f\"XMan{{{result}}}\")<\/code><\/pre>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    XMan{seems_to_be_related_to_the_special_guests}<\/code><\/pre>\n\n\n\n
    5.Keyword<\/h2>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u9700\u8981\u7528\u8fd9\u4e2a\u5de5\u5177<\/p>\n\n\n\n
    livz\/cloacked-pixel: LSB steganography and detection<\/a><\/p>\n\n\n\n
    \u56fe\u7247\u7ed9\u4e86\u5bc6\u7801<\/p>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    lsb\u9690\u5199<\/p>\n\n\n\n
    python lsb.py extract 1.png 1.txt lovekfc<\/code><\/pre>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    PVSF{vVckHejqBOVX9C1c13GFfkHJrjIQeMwf}<\/code><\/pre>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u662f\u8fd9\u4e2a\u5bc6\u7801<\/p>\n\n\n\n
    \u4e00\u4e2a\u53d8\u79cd<\/p>\n\n\n\n
    py3\u811a\u672c\u5448\u73b0<\/p>\n\n\n\n
    import string\n\ndef decode_nihilist_cipher():\n    txt = 'PVSF{vVckHejqBOVX9C1c13GFfkHJrjIQeMwf}'\n    table = 'LOVEKFCABDGHIJMNPQRSTUWXY'\n    flag = ''\n\n    for i in txt:\n        if i in string.ascii_lowercase:\n            # \u5728table\u7684\u5c0f\u5199\u7248\u672c\u4e2d\u67e5\u627e\u7d22\u5f15\n            index = table.lower().index(i)\n            # \u4f7f\u7528\u76f8\u540c\u7d22\u5f15\u7684ASCII\u5c0f\u5199\u5b57\u6bcd\u66ff\u6362\n            flag += string.ascii_lowercase[index]\n            continue\n        if i in string.ascii_uppercase:\n            # \u5728table\u7684\u5927\u5199\u7248\u672c\u4e2d\u67e5\u627e\u7d22\u5f15\n            index = table.upper().index(i)\n            # \u4f7f\u7528\u76f8\u540c\u7d22\u5f15\u7684ASCII\u5927\u5199\u5b57\u6bcd\u66ff\u6362\n            flag += string.ascii_uppercase[index]\n            continue\n        # \u975e\u5b57\u6bcd\u5b57\u7b26\u76f4\u63a5\u4fdd\u7559\n        flag += i\n\n    return flag\n\nresult = decode_nihilist_cipher()\nprint(f\"\u89e3\u7801\u7ed3\u679c: {result}\")<\/code><\/pre>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    QCTF{cCgeLdnrIBCX9G1g13KFfeLNsnMRdOwf}<\/code><\/pre>\n\n\n\n
    6.picture2<\/h2>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    010\u67e5\u770b<\/p>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u770b\u6587\u4ef6\u5934\u53d1\u73b0\u662fjpg\u56fe\u7247<\/p>\n\n\n\n
    \u76f4\u63a5binwalk<\/p>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u53d1\u73b0\u662fbase64<\/p>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    kp\u5e94\u8be5\u662f\u4e00\u4e2azip<\/p>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u76f4\u63a5\u89e3\u7801\u4e3ahex<\/p>\n\n\n\n
    \u5168\u90e8\u5c0f\u5199<\/p>\n\n\n\n
    4b5003041400010000003930974c6ce31f7c5a0000004e00000004000000636f6465e3de81f00fae476784c1b681bf3afc01c7a52d0632a0ab47db36d5b3f8dd2aa67ac2fea101a8e74963cf8cc872dab122c4c7576e7ed664c4eef15cf6097921489fedfd7fac72291ea97b9ea28f6fed8cea744bbb0854f266ffc3504b01023f001400010000003930974c6ce31f7c5a0000004e000000040024000000000000002000000000000000636f64650a0020000000000001001800005bc38385dad3013c8009ad87dad3013c8009ad87dad301504b05060000000001000100560000007c000000dc005b507974686f6e20322e375d0d0a3e3e3e20a87da87da87d0d0a0d0a54726163656261636b20286d6f737420726563656e742063616c6c206c617374293a0d0a202046696c6520223c70797368656c6c23303e222c206c696e6520312c20696e203c6d6f64756c653e0d0a20202020a87da87da87d0d0a5a65726f4469766973696f6e4572726f723a20a87da87da87da87da87da87da87da87da87da87da87da87da87da87da87da87da87da87da87da87da87da87da87da87da87da87da87da87da87da87d203c2d2070617373776f7264203b290d0a3e3e3e2000<\/code><\/pre>\n\n\n\n
    010\u5bfc\u5165\u5341\u516d\u8fdb\u5236 \u6539\u4e00\u4e0b\u6587\u4ef6\u5934<\/p>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u9700\u8981\u5bc6\u7801\u5bc6\u7801\u662f\u8fd9\u4e2a\u62a5\u9519\u63d0\u793a<\/p>\n\n\n\n
    [Python 2.7]\n>>> \u2586\u2586\u2586\n\nTraceback (most recent call last):\n  File \"<pyshell#0>\", line 1, in <module>\n    \u2586\u2586\u2586\nZeroDivisionError: \u2586\u2586\u2586\u2586\u2586\u2586\u2586\u2586\u2586\u2586\u2586\u2586\u2586\u2586\u2586\u2586\u2586\u2586\u2586\u2586\u2586\u2586\u2586\u2586\u2586\u2586\u2586\u2586\u2586\u2586 <- password ;)\n>>> <\/code><\/pre>\n\n\n\n
    \u6839\u636e\u8fd9\u4e2a Python 2.7 \u7684\u4ea4\u4e92\u5f0f\u4f1a\u8bdd\u9519\u8bef\u4fe1\u606f\uff0c\u8fd9\u662f\u4e00\u4e2a ZeroDivisionError<\/code>\uff08\u9664\u96f6\u9519\u8bef\uff09\u3002\u5728 Python \u4e2d\uff0c\u5f53\u8bd5\u56fe\u9664\u4ee5\u96f6\u65f6\u4f1a\u5f15\u53d1\u6b64\u9519\u8bef\u3002<\/p>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u5bc6\u7801\u662f:<\/p>\n\n\n\n
    integer division or modulo by zero<\/code><\/pre>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    UUencode\u89e3\u7801<\/p>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    CISCN{2388AF2893EB85EB1B439ABFF617319F}<\/code><\/pre>\n\n\n\n
    7.test.pyc<\/h2>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u4e00\u4e2apyc\u6587\u4ef6\u4f7f\u7528 uncompyle6\u8fdb\u884c\u53cd\u7f16\u8bd1<\/p>\n\n\n\n
    # \u76f4\u63a5\u8f93\u51fa\u53cd\u7f16\u8bd1\u540e\u7684\u4ee3\u7801\u5230\u63a7\u5236\u53f0\nuncompyle6 1.pyc\n\n# \u5c06\u53cd\u7f16\u8bd1\u7ed3\u679c\u4fdd\u5b58\u5230 .py \u6587\u4ef6\nuncompyle6 1.pyc > 2.py<\/code><\/pre>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    2.py<\/p>\n\n\n\n
    # uncompyle6 version 3.9.2\n# Python bytecode version base 2.7 (62211)\n# Decompiled from: Python 3.12.0 (tags\/v3.12.0:0fb18b0, Oct  2 2023, 13:03:39) [MSC v.1935 64 bit (AMD64)]\n# Embedded file name: test.py\n# Compiled at: 2016-10-19 09:08:27\n\n-- Stacks of completed symbols:\nSTART ::= |- stmts . \nand ::= expr . JUMP_IF_FALSE_OR_POP expr COME_FROM\nand ::= expr . jmp_false expr e_come_from_opt\nand ::= expr . jmp_false expr come_from_opt\nassert ::= assert_expr . jmp_true LOAD_ASSERT RAISE_VARARGS_1\nassert2 ::= assert_expr . jmp_true LOAD_ASSERT expr CALL_FUNCTION_1 RAISE_VARARGS_1\nassert_expr ::= expr . \nassert_expr_and ::= assert_expr . jmp_false expr\nassert_expr_or ::= assert_expr . jmp_true expr\nassign ::= expr . DUP_TOP designList\nassign ::= expr . store\nassign2 ::= expr . expr ROT_TWO store store\nassign3 ::= expr . expr expr ROT_THREE ROT_TWO store store store\naug_assign1 ::= expr . expr inplace_op ROT_FOUR STORE_SLICE+3\naug_assign1 ::= expr . expr inplace_op ROT_THREE STORE_SLICE+1\naug_assign1 ::= expr . expr inplace_op ROT_THREE STORE_SLICE+2\naug_assign1 ::= expr . expr inplace_op ROT_THREE STORE_SUBSCR\naug_assign1 ::= expr . expr inplace_op ROT_TWO STORE_SLICE+0\naug_assign1 ::= expr . expr inplace_op store\naug_assign2 ::= expr . DUP_TOP LOAD_ATTR expr inplace_op ROT_TWO STORE_ATTR\nbin_op ::= expr . expr binary_operator\nbuildclass ::= LOAD_CONST . expr mkfunc CALL_FUNCTION_0 BUILD_CLASS\ncall ::= expr . CALL_FUNCTION_0\ncall_stmt ::= expr . POP_TOP\nclassdefdeco1 ::= expr . classdefdeco1 CALL_FUNCTION_1\nclassdefdeco1 ::= expr . classdefdeco2 CALL_FUNCTION_1\ncompare_chained ::= expr . compared_chained_middle ROT_TWO POP_TOP e__come_froms\ncompare_chained ::= expr . compared_chained_middle ROT_TWO POP_TOP _come_froms\ncompare_single ::= expr . expr COMPARE_OP\ndelete ::= expr . DELETE_ATTR\ndelete_subscript ::= expr . expr DELETE_SUBSCR\nexpr ::= LOAD_CONST . \nexpr_jitop ::= expr . JUMP_IF_TRUE_OR_POP\nexpr_jt ::= expr . jmp_true\nif_exp ::= expr . jmp_false expr JUMP_ABSOLUTE expr\nif_exp ::= expr . jmp_false expr JUMP_FORWARD expr COME_FROM\nif_exp_lambda ::= expr . jmp_false expr return_if_lambda return_stmt_lambda LAMBDA_MARKER\nif_exp_not ::= expr . jmp_true expr _jump expr COME_FROM\nif_exp_not_lambda ::= expr . jmp_true expr return_if_lambda return_stmt_lambda LAMBDA_MARKER\nif_exp_true ::= expr . JUMP_FORWARD expr COME_FROM\nimport ::= LOAD_CONST . LOAD_CONST alias\nimport_from ::= LOAD_CONST . LOAD_CONST IMPORT_NAME importlist POP_TOP\nimport_from_star ::= LOAD_CONST . LOAD_CONST IMPORT_NAME IMPORT_STAR\nimportmultiple ::= LOAD_CONST . LOAD_CONST alias imports_cont\nmkfuncdeco ::= expr . mkfuncdeco CALL_FUNCTION_1\nmkfuncdeco ::= expr . mkfuncdeco0 CALL_FUNCTION_1\nprint_items_nl_stmt ::= expr . PRINT_ITEM e_print_items_opt PRINT_NEWLINE_CONT\nprint_items_nl_stmt ::= expr . PRINT_ITEM print_items_opt PRINT_NEWLINE_CONT\nprint_items_stmt ::= expr . PRINT_ITEM e_print_items_opt\nprint_items_stmt ::= expr . PRINT_ITEM print_items_opt\nprint_nl_to ::= expr . PRINT_NEWLINE_TO\nprint_to ::= expr . print_to_items POP_TOP\nprint_to_nl ::= expr . print_to_items PRINT_NEWLINE_TO\nraise_stmt1 ::= expr . RAISE_VARARGS_1\nraise_stmt2 ::= expr . expr RAISE_VARARGS_2\nraise_stmt3 ::= expr . expr expr RAISE_VARARGS_3\nret_and ::= expr . JUMP_IF_FALSE_OR_POP return_expr_or_cond COME_FROM\nret_or ::= expr . JUMP_IF_TRUE_OR_POP return_expr_or_cond COME_FROM\nreturn ::= return_expr . RETURN_VALUE\nreturn_expr ::= expr . \nreturn_expr_lambda ::= return_expr . RETURN_VALUE_LAMBDA\nreturn_expr_lambda ::= return_expr . RETURN_VALUE_LAMBDA LAMBDA_MARKER\nslice0 ::= expr . DUP_TOP SLICE+0\nslice0 ::= expr . SLICE+0\nslice1 ::= expr . expr DUP_TOPX_2 SLICE+1\nslice1 ::= expr . expr SLICE+1\nslice2 ::= expr . expr DUP_TOPX_2 SLICE+2\nslice2 ::= expr . expr SLICE+2\nslice3 ::= expr . expr expr DUP_TOPX_3 SLICE+3\nslice3 ::= expr . expr expr SLICE+3\nsubscript ::= expr . expr BINARY_SUBSCR\nsubscript2 ::= expr . expr DUP_TOPX_2 BINARY_SUBSCR\ntestfalse ::= expr . jmp_false\ntesttrue ::= expr . jmp_true\nunary_convert ::= expr . UNARY_CONVERT\nunary_not ::= expr . UNARY_NOT\nunary_op ::= expr . unary_operator\nwith ::= expr . SETUP_WITH POP_TOP e_suite_stmts_opt POP_BLOCK LOAD_CONST COME_FROM_WITH WITH_CLEANUP END_FINALLY\nwith ::= expr . SETUP_WITH POP_TOP suite_stmts_opt POP_BLOCK LOAD_CONST COME_FROM_WITH WITH_CLEANUP END_FINALLY\nwith_as ::= expr . SETUP_WITH store e_suite_stmts_opt POP_BLOCK LOAD_CONST COME_FROM_WITH WITH_CLEANUP END_FINALLY\nwith_as ::= expr . SETUP_WITH store suite_stmts_opt POP_BLOCK LOAD_CONST COME_FROM_WITH WITH_CLEANUP END_FINALLY\nyield ::= expr . YIELD_VALUE\nInstruction context:\n\n L.   1         0  LOAD_CONST               '=cWbihGfyMzNllzZ'\n->                 3  NOP              \n                   4  NOP              \n                   5  NOP              \n                   6  LOAD_CONST               '0cjZzMW'\n                   9  LOAD_CONST               'N5cTM4Y'\n                  12  LOAD_CONST               'jYygTOy'\n                  15  LOAD_CONST               'cmNycWNyYmM1Ujf'\n                  18  BINARY_ADD       \n                  19  STORE_NAME            0  'str'\n<\/code><\/pre>\n\n\n\n
    \u4ece\u53cd\u7f16\u8bd1\u7684\u5b57\u8282\u7801\u4e2d\u63d0\u53d6\u6240\u6709LOAD_CONST<\/code>\u52a0\u8f7d\u7684\u5b57\u7b26\u4e32\u5e38\u91cf\uff0c\u8fd9\u4e9b\u5e38\u91cf\u4f1a\u901a\u8fc7BINARY_ADD<\/code>\u8fdb\u884c\u62fc\u63a5\uff0c\u6700\u7ec8\u5b58\u50a8\u5230str<\/code>\u53d8\u91cf\u4e2d\u3002\u6211\u4eec\u53ea\u9700\u8981\u63d0\u53d6\u8fd9\u4e9b\u5b57\u7b26\u4e32\u5e76\u6309\u987a\u5e8f\u62fc\u63a5<\/p>\n\n\n\n
    # \u63d0\u53d6\u5b57\u8282\u7801\u4e2d\u7684LOAD_CONST\u5b57\u7b26\u4e32\u5e38\u91cf\nconst_strs = [\n    '=cWbihGfyMzNllzZ',\n    '0cjZzMW',\n    'N5cTM4Y',\n    'jYygTOy',\n    'cmNycWNyYmM1Ujf'\n]\n\n# \u62fc\u63a5\u6240\u6709\u5e38\u91cf\uff08\u5b57\u8282\u7801\u4e2dBINARY_ADD\u4f1a\u6309\u6808\u987a\u5e8f\u62fc\u63a5\uff09\nflag_content = ''.join(const_strs)\n\nflag = f'flag{{{flag_content}}}'\nprint(flag)<\/code><\/pre>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    =cWbihGfyMzNllzZ0cjZzMWN5cTM4YjYygTOycmNycWNyYmM1Ujf\n#\u53cd\u8f6c\nfjU1MmYyNWcyNmcyOTgyYjY4MTc5NWMzZjc0ZzllNzMyfGhibWc=\n#base64\u89e3\u7801\n~552f25g26g2982b681795c3f74g9e732|hbmg\n#\u53cd\u8f6c\ngmbh|237e9g47f3c597186b2892g62g52f255~<\/code><\/pre>\n\n\n\n
    \u6211\u4eec\u53d1\u73b0gmbh|237e9g47f3c597186b2892g62g52f255<\/p>\n\n\n\n
    gmbh\u5c31\u662fflag \u76f8\u5dee1 \u76f4\u63a5\u51ef\u6492<\/p>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    flag{237d9f47e3b597186a2892f62f52e255}<\/p>\n\n\n\n
    \u53d1\u73b0\u4e0d\u5bf9<\/p>\n\n\n\n
    \u53d1\u73b0\u662fASCII\u51cf\u4e00 \uff0c\u59824 \u53d8\u62103 b\u53d8\u6210a\u8fd9\u4e2a\u6837<\/p>\n\n\n\n
    py3\u811a\u672c\u5448\u73b0<\/p>\n\n\n\n
    s = \"gmbh|237e9g47f3c597186b2892g62g52f255\"\nnew_s = ''.join([chr(ord(c) - 1) for c in s])\nflag = f\"{{{new_s}}}\"\nprint(flag)<\/code><\/pre>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    flag{126d8f36e2b486075a1781f51f41e144}<\/code><\/pre>\n\n\n\n
    8.Avatar<\/h2>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    outguess \u9690\u5199\u5148\u4e0b\u8f7d<\/p>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    outguess -r 035bfaa85410429495786d8ea6ecd296.jpg -t flag.txt<\/code><\/pre>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    flag<\/p>\n\n\n\n
    We should blow up the bridge at midnight<\/code><\/pre>\n\n\n\n
    9.qr-easy<\/h2>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u4e00\u4e2a\u4e8c\u7ef4\u7801<\/p>\n\n\n\n
    \u9700\u8981\u4fee\u590d<\/p>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u9700\u8981\u5355\u72ec\u63d0\u53d6\u51fa\u6765ps\u4f46\u662f\u4e0d\u4f1aps \u6240\u4ee5\u770bwp\u4e86<\/p>\n\n\n\n
    \u6587\u7ae0\u5730\u5740:\u3010\u611a\u516c\u7cfb\u5217\u30112022\u5e7402\u6708 \u653b\u9632\u4e16\u754c-\u8fdb\u9636\u9898-MISC-83(qr-easy)_\u653b\u9632\u4e16\u754cqr-easy-CSDN\u535a\u5ba2<\/a><\/p>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u6b64\u4e8c\u7ef4\u7801\u7684\u5927\u5c0f\u4e3a 29×29\uff0c\u7248\u672cV\u7684\u5927\u5c0f\u4e3aN \u00d7 N\uff0cN = 17 + 4V\uff0c\u6240\u4ee5\u8fd9\u662f\u7248\u672c 3\u3002<\/p>\n\n\n\n
    \u4e8c\u7ef4\u7801\u683c\u5f0f\u4fe1\u606f<\/strong><\/p>\n\n\n\n
    \u8be5\u533a\u57df\u8868\u793a\u4e8c\u7ef4\u7801\u7684\u683c\u5f0f\u4fe1\u606f\u3002\u5b9e\u9645\u4e0a\uff0c\u683c\u5f0f\u4fe1\u606f\u662f 15 \u4f4d\u957f\uff0c\u533a\u57df\u6709\u6700\u540e 8 \u4f4d\u3002<\/p>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u641c\u7d22\u6240\u6709\u683c\u5f0f\u4fe1\u606f\u5b57\u7b26\u4e32\u7684\u5217\u8868\uff0c\u6211\u4eec\u53ef\u4ee5\u53d1\u73b0\u7c7b\u578b\u4fe1\u606f\u4f4d\u662f001001110111110<\/code>.\u6240\u4ee5\u8fd9\u4e2a\u4e8c\u7ef4\u7801\u6709ECC\u7ea7\u522bH\u548c\u63a9\u7801<\/a>\u6a21\u5f0f1\u3002<\/p>\n\n\n\n
    \u6240\u6709\u683c\u5f0f\u4fe1\u606f\u5b57\u7b26\u4e32\u7684\u5217\u8868\uff1a<\/p>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    1 \u53f7\u63a9\u7801\u6709\u516c\u5f0f(row) mod 2 == 0\u3002\u6ce8\u610f\u884c\u53f7\u662f\u4ece0\u5f00\u59cb\u7684\uff0c\u6240\u4ee5\u6211\u4eec\u8981\u5207\u6362\u5750\u6807\u4e3a0,2,4,\u2026,28\u7684\u884c\u7684\u4f4d\u3002<\/p>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u6240\u4ee54\u884c2\u5217\u4e00\u7ec4\uff0c\u539f\u59cb\u7684 D1-D26 \u662f\uff1a<\/p>\n\n\n\n
    D1  = 0b11101100\nD14 = 0b10000010\nD2  = 0b11111000\nD15 = 0b10010101\nD3  = 0b00110110\nD16 = 0b00111101\nD4  = 0b01110110\nD17 = 0b01100010\nD5  = 0b00100010\nD18 = 0b11101001\nD6  = 0b11110001\nD19 = 0b10100001\nD7  = 0b00110111\nD20 = 0b11100101\nD8  = 0b01010010\nD21 = 0b11010101\nD9  = 0b00010111\nD22 = 0b00101101\nD10 = 0b11011110\nD23 = 0b10010111\nD11 = 0b01000100\nD24 = 0b10001011\nD12 = 0b01010100\nD25 = 0b01111000\nD13 = 0b11001101\nD26 = 0b11000110\n<\/code><\/pre>\n\n\n\n
    (\u884c) mod 2 == 0 \u63a9\u7801\u4e4b\u540e<\/p>\n\n\n\n
    D1  = 0b00100000\nD14 = 0b01001110\nD2  = 0b00110100\nD15 = 0b01011001\nD3  = 0b11111010\nD16 = 0b00001110\nD4  = 0b01000101\nD17 = 0b01010001\nD5  = 0b00010001\nD18 = 0b11011010\nD6  = 0b00111101\nD19 = 0b10010010\nD7  = 0b00000100\nD20 = 0b11010101\nD8  = 0b10011110\nD21 = 0b00011001\nD9  = 0b11010100\nD22 = 0b00010001\nD10 = 0b00010100\nD23 = 0b00001110\nD11 = 0b11011101\nD24 = 0b00010010\nD12 = 0b11010010\nD25 = 0b00011111\nD13 = 0b01010100\nD26 = 0b01000000\n<\/code><\/pre>\n\n\n\n
    \u6570\u636e\u89e3\u7801<\/strong><\/p>\n\n\n\n
    \u89e3\u7801\u6709\u6a21\u5f0f\u6307\u793a\u7b26\uff1a<\/p>\n\n\n\n
    0001\uff1a\u6570\u5b57\u6a21\u5f0f\uff08\u6bcf 3 \u4f4d 10 \u4f4d\uff09\n0010\uff1a\u5b57\u6bcd\u6570\u5b57\u6a21\u5f0f\uff08\u6bcf 2 \u4e2a\u5b57\u7b26 11 \u4f4d\uff09\n0100\uff1a\u5b57\u8282\u6a21\u5f0f\uff08\u6bcf\u4e2a\u5b57\u7b26 8 \u4f4d\uff09\n1000\uff1a\u6c49\u5b57\u6a21\u5f0f\uff08\u6bcf\u4e2a\u5b57\u7b26 13 \u4f4d\uff09\n0111: ECI \u6a21\u5f0f\n<\/code><\/pre>\n\n\n\n
    \u5b57\u7b26\u8ba1\u6570\u6307\u793a\u7b26\u8ddf\u5728\u6a21\u5f0f\u6307\u793a\u7b26\u4e4b\u540e\u3002<\/p>\n\n\n\n
    \u7248\u672c 1-9\n\u6570\u5b57\u6a21\u5f0f\uff1a10 \u4f4d\n\u5b57\u6bcd\u6570\u5b57\u6a21\u5f0f\uff1a9\u4f4d\n\u5b57\u8282\u6a21\u5f0f\uff1a8\u4f4d\n\u6c49\u5b57\u6a21\u5f0f\uff1a8\u4f4d\n\u7248\u672c 10\u201326\n\u6570\u5b57\u6a21\u5f0f\uff1a12\u4f4d\n\u5b57\u6bcd\u6570\u5b57\u6a21\u5f0f\uff1a11 \u4f4d\n\u5b57\u8282\u6a21\u5f0f\uff1a16\u4f4d\n\u6c49\u5b57\u6a21\u5f0f\uff1a10\u4f4d\n\u7248\u672c 27\u201340\n\u6570\u5b57\u6a21\u5f0f\uff1a14\u4f4d\n\u5b57\u6bcd\u6570\u5b57\u6a21\u5f0f\uff1a13 \u4f4d\n\u5b57\u8282\u6a21\u5f0f\uff1a16\u4f4d\n\u6c49\u5b57\u6a21\u5f0f\uff1a12\u4f4d\n<\/code><\/pre>\n\n\n\n
    Ruby\u811a\u672c<\/strong><\/p>\n\n\n\n
    data = '00100000' \n       '00110100' \n       '11111010' \n       '01000101' \n       '00010001' \n       '00111101' \n       '00000100' \n       '10011110' \n       '11010100' \n       '00010100' \n       '11011101' \n       '11010010' \n       '01010100' \n       '01001110' \n       '01011001' \n       '00001110' \n       '01010001' \n       '11011010' \n       '10010010' \n       '11010101' \n       '00011001' \n       '00010001' \n       '00001110' \n       '00010010' \n       '00011111' \n       '01000000'\nalphanumeric = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ $%*+-.\/:'.chars\n\ndef read(str, size)\n  str.slice!(0, size)\nend\n\ndef kanji(num)\n  if num >= 0x1740\n    (0xC140 + num \/ 0xC0 * 0x100 + num % 0xC0)\n      .chr(Encoding::Shift_JIS).encode(Encoding::UTF_8)\n  else\n    (0x8140 + num \/ 0xC0 * 0x100 + num % 0xC0)\n      .chr(Encoding::Shift_JIS).encode(Encoding::UTF_8)\n  end\nend\n\nloop do\n  case mode = read(data, 4)\n  when '0010' # Alphanumeric\n    count = read(data, 9).to_i(2)\n    (count \/ 2).times do\n      chunk = read(data, 11).to_i(2)\n      print alphanumeric[chunk \/ 45] + alphanumeric[chunk % 45]\n    end\n    print alphanumeric[read(data, 11).to_i(2)] if count.odd?\n  when '0100' # Byte\n    count = read(data, 8).to_i(2)\n    count.times do\n      print read(data, 8).to_i(2).chr\n    end\n  when '1000' # Kanji\n    count = read(data, 8).to_i(2)\n    count.times do\n      print kanji(read(data, 13).to_i(2))\n    end\n  when '0000' # Terminate\n    break\n  else\n    fail \"Unhandled mode #{mode}\"\n  end\nend\n<\/code><\/pre>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    SECCON{PSwIQ9d9GjKTdD8H}<\/code><\/pre>\n\n\n\n
    10.message<\/h2>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u8003\u70b9\u57fa\u4e8e\u6587\u672c\u9690\u5199<\/p>\n\n\n\n
    7fffffffffffffffffffffffffffffffbffff0e10419dff07fdc3ffdaeab6deffdbfff6ffed7f7aef3febfffb7ff1bfbc675931e33c79fadfdebbae7aeddedb7dafef7dc37df7ef6dbed777beedbedb77b6de24718f260e0e71879fffffffffffffffffffffffffffffffffffffffffff07f87fc7f9ffffffffdbfbbfdbfeffffffffebfdffdfff7ffffff871c33e6fe7bffffffd5aefeed62dcffffffeadf9fb8bb0efffffff56df5db6dbf7ffffffaa0c21e19e3bffffe07ffffffffff9fffffffffffffffffffffffffffffffffffffff<\/code><\/pre>\n\n\n\n
    \u5c06\u5341\u516d\u8fdb\u5236\u8f6c\u6362\u6210\u4e8c\u8fdb\u5236 \u957f\u5ea6\u4e3a1679 \u4e8c\u8fdb\u5236\u6309\u716773*23\u6392\u5217<\/p>\n\n\n\n
    py3<\/p>\n\n\n\n
    with open('msg.txt', 'r') as f:\n    hex_data = f.read().strip()\n\nbinary_str = bin(int(hex_data, 16))[2:].zfill(1679)\n\nresult_lines = []\nfor i in range(23):\n    line = binary_str[i*73:(i+1)*73]\n    result_lines.append(line)\n\nwith open('1.txt', 'w') as f:\n    for line in result_lines:\n        f.write(line + 'n')<\/code><\/pre>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u7f29\u5c0f\u53ef\u4ee5\u770b\u5230flag<\/p>\n\n\n\n
    RCTF{ArEciBo_mEsSaGe}<\/code><\/pre>\n\n\n\n
    11.mysql<\/h2>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u76f4\u63a5010\u770bibdata1<\/p>\n\n\n\n
    \u641c\u7d22flag<\/p>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    71e55075163d5c6410c0d9eae499c977<\/code><\/pre>\n\n\n\n
    12.give_you_flag<\/h2>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u770b\u56fe\u7247\u6700\u540e\u6709\u4e00\u4e2a\u4e8c\u7ef4\u7801 \u7528stegsolve\u5de5\u5177\u8fdb\u884c\u52a8\u6001\u56fe\u7247\u5206\u79bb<\/p>\n\n\n\n
    \u6216\u8005gifsplitter2.0\u5206\u79bb<\/p>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u53d1\u73b0\u4e0d\u5b8c\u6574<\/p>\n\n\n\n
    \u5c11\u4e86\u4e09\u4e2a\u5b9a\u4f4d\u7b26\u52a0\u4e0a\u5c31\u884c<\/p>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    flag{e7d478cf6b915f50ab1277f78502a2c5}<\/code><\/pre>\n\n\n\n
    13.stegano<\/h2>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u63d0\u53d6 PDF \u5143\u6570\u636e\uff0c\u67e5\u770b\u6240\u6709\u5b57\u6bb5\uff1a<\/p>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
     Tm9wZSAsIG5vdCBoZXJlIDspCg==\n \u89e3\u7801:Nope , not here ;)<\/code><\/pre>\n\n\n\n
    \u76f4\u63a5\u63d0\u53d6pdf\u6240\u6709\u5185\u5bb9<\/p>\n\n\n\n
    py3\u811a\u672c\u5448\u73b0<\/p>\n\n\n\n
    import pdfplumber\n\n# -------------------------- \u914d\u7f6e\u9879 --------------------------\nPDF_PATH = \"d802bcf9530b45e0b37170c67b8efcea.pdf\"  # PDF\u6587\u4ef6\u8def\u5f84\uff08\u4e0e\u811a\u672c\u540c\u76ee\u5f55\uff09\nOUTPUT_TXT = \"1.txt\"  # \u8f93\u51fa\u6587\u672c\u6587\u4ef6\u540d\n# -------------------------------------------------------------\n\ndef pdf_extract_text(pdf_path, output_txt):\n    # \u521d\u59cb\u5316\u6587\u672c\u5185\u5bb9\n    all_text = \"\"\n\n    try:\n        # \u6253\u5f00PDF\u6587\u4ef6\n        with pdfplumber.open(pdf_path) as pdf:\n            # \u904d\u5386\u6240\u6709\u9875\u9762\uff08pdf.pages\u662f\u6240\u6709\u9875\u9762\u7684\u5217\u8868\uff09\n            for page_num, page in enumerate(pdf.pages, start=1):\n                print(f\"\u6b63\u5728\u63d0\u53d6\u7b2c {page_num} \u9875\u6587\u5b57...\")\n\n                # \u63d0\u53d6\u5f53\u524d\u9875\u6587\u672c\uff08extract_text()\u8fd4\u56de\u5b57\u7b26\u4e32\uff0c\u81ea\u52a8\u5904\u7406\u6362\u884c\uff09\n                page_text = page.extract_text()\n\n                # \u82e5\u5f53\u524d\u9875\u6709\u6587\u672c\uff0c\u6dfb\u52a0\u5230\u603b\u6587\u672c\u4e2d\uff08\u52a0\u9875\u5206\u9694\u7b26\u4fbf\u4e8e\u9605\u8bfb\uff09\n                if page_text:\n                    all_text += f\"===== \u7b2c {page_num} \u9875 =====n\"\n                    all_text += page_text + \"nn\"\n\n        # \u5c06\u6240\u6709\u6587\u672c\u5199\u51651.txt\uff08UTF-8\u7f16\u7801\uff0c\u907f\u514d\u4e2d\u6587\u4e71\u7801\uff09\n        with open(output_txt, \"w\", encoding=\"utf-8\") as f:\n            f.write(all_text)\n\n        print(f\"\u2705 \u63d0\u53d6\u6210\u529f\uff01\u6240\u6709\u6587\u5b57\u5df2\u5199\u5165 {output_txt}\")\n        print(f\"\ud83d\udcc4 \u5171\u63d0\u53d6 {len(pdf.pages)} \u9875\u5185\u5bb9\")\n\n    except FileNotFoundError:\n        print(f\"\u274c \u9519\u8bef\uff1a\u672a\u627e\u5230PDF\u6587\u4ef6\uff01\u8bf7\u68c0\u67e5\u8def\u5f84\u662f\u5426\u6b63\u786e\uff1a{pdf_path}\")\n    except Exception as e:\n        print(f\"\u274c \u63d0\u53d6\u5931\u8d25\uff1a{str(e)}\")\n\n# \u6267\u884c\u63d0\u53d6\nif __name__ == \"__main__\":\n    pdf_extract_text(PDF_PATH, OUTPUT_TXT)<\/code><\/pre>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    BBAAAABBBAAAAAAAAAAAAAABBAAABBBBAAAAABAAAABBBBBAAAAAABBBBABAAAABBBBBAAAABBBABBBAAABAABAABBAABBAAAABBBBAABBAAABABAABBAABAABBABBBBABAB<\/code><\/pre>\n\n\n\n
    \u6469\u65af\u5bc6\u7801<\/p>\n\n\n\n
    \u628aA\u6362\u6210 . \uff0cB\u6362\u6210-<\/p>\n\n\n\n
    --....---..............--...----.....-....-----......----.-....-----....---.---...-..-..--..--....----..--...-.-..--..-..--.----.-.-<\/code><\/pre>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u6709\u95ee\u9898\u8fd9\u4e2a\u9898\u76ee<\/p>\n\n\n\n
    \u63d0\u53d6\u5e94\u8be5\u662f<\/p>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    XXXX\u8fd9\u4e2a\u4f46\u662f\u4e0b\u9762\u7684BBA\u662f\u4e0d\u5bf9\u7684<\/p>\n\n\n\n
    \u67e5\u770bwp<\/p>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u53d1\u73b0\u786e\u5b9e\u4e0d\u4e00\u6837\u6240\u4ee5\u8fd9\u4e2a\u9898\u6709\u95ee\u9898\u7684<\/p>\n\n\n\n
    -.-. \u2014 -. --. .-. .- - \u2026- .-\u2026 .- - \u2026 \u2014 -. \u2026 --\u2026-- \u2026-. .-\u2026 .- --. \u2014\u2026 .---- -. \u2026- .---- \u2026 .---- -\u2026 .-\u2026 \u2026-- \u2013 \u2026-- \u2026 \u2026 \u2026- --. \u2026\u2013<\/code><\/pre>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    flag{1nv151bl3m3554g3}<\/code><\/pre>\n\n\n\n
    14.\u575a\u630160s<\/h2>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    jar\u8fdb\u884c\u89e3\u538b\u53d1\u73b0\u6ca1\u6709\u4ec0\u4e48\u4e1c\u897f<\/p>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    jd-gui\u8fdb\u884cjava\u53cd\u7f16\u8bd1<\/p>\n\n\n\n
    \u53d1\u73b0flag<\/p>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    flag{RGFqaURhbGlfSmlud2FuQ2hpamk=}<\/p>\n\n\n\n
    \u91cc\u9762\u8fdb\u884cbase64\u89e3\u7801<\/p>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    flag{DajiDali_JinwanChiji}<\/code><\/pre>\n\n\n\n
    15.gif<\/h2>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u6253\u5f00\u53d1\u73b0\u6709\u5f88\u591a\u56fe\u7247\u767d\u7684\u9ed1\u7684\u53ef\u4ee5\u8054\u60f3\u52300\u548c1\u4e8c\u8fdb\u5236<\/p>\n\n\n\n
    \u65b9\u6cd5\u4e00\uff1a\u624b\u52a8\u6536\u5165\uff1a01100110011011000110000101100111011110110100011001110101010011100101111101100111011010010100011001111101<\/p>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    flag{FuN_giF}<\/p>\n\n\n\n
    \u65b9\u6cd5\u4e8c\uff1a<\/p>\n\n\n\n
    \u811a\u672c\u7f16\u5199\uff1a<\/p>\n\n\n\n
    \u4ee3\u7801\u5b9e\u73b0\uff1a<\/p>\n\n\n\n
    from PIL import Image\n\nresult = \"\"\n# \u904d\u5386104\u5f20\u56fe\u7247\nfor i in range(104):\n    try:\n        # \u4f7f\u7528\u539f\u59cb\u5b57\u7b26\u4e32\u5904\u7406\u8def\u5f84\uff0c\u907f\u514d\u8f6c\u4e49\u95ee\u9898\n        img = Image.open(r\"C:Users14163Desktop\u5f20\u6587\u653b\u9632\u4e16\u754cMisc\u96be\u5ea6\u56dbgifgif\/{}.jpg\".format(i))\n        im = img.convert(\"RGB\")\n        # \u83b7\u53d6(1,1)\u4f4d\u7f6e\u7684RGB\u503c\n        r, g, b = im.getpixel((1, 1))\n        # \u6839\u636e\u7ea2\u8272\u901a\u9053\u503c\u5224\u65ad\u4e8c\u8fdb\u5236\u4f4d\n        result += \"1\" if r != 255 else \"0\"\n    except Exception as e:\n        print(f\"\u5904\u7406\u56fe\u7247{i}.jpg\u65f6\u51fa\u9519: {e}\")\n        continue\n\n# \u6bcf8\u4f4d\u4e00\u7ec4\u8f6c\u6362\u4e3aASCII\u5b57\u7b26\nfor i in range(0, len(result), 8):\n    byte = result[i:i+8]\n    if len(byte) == 8:  # \u786e\u4fdd\u67098\u4f4d\n        print(chr(int(byte, 2)), end=\"\")<\/code><\/pre>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    flag{FuN_giF}<\/code><\/pre>\n\n\n\n
    16.\u6380\u684c\u5b50<\/h2>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    c8e9aca0c6f2e5f3e8c4efe7a1a0d4e8e5a0e6ece1e7a0e9f3baa0e8eafae3f9e4eafae2eae4e3eaebfa\nebe3f5e7e9f3e4e3e8eaf9eaf3e2e4e6f2<\/code><\/pre>\n\n\n\n
    \u770b\u8d77\u6765\u50cf\u5341\u516d\u8fdb\u5236
    \u4fe9\u4e2a\u4e00\u7ec4\uff0c\u8f6c\u5316\u4e3a\u5341\u8fdb\u5236\uff0c\u51cf\u53bb128\uff0c\u518d\u8f6c\u5b57\u7b26\u4e32\u5f97\u5230flag\uff0c\u6709\u4e00\u70b9\u6295\u673a\u53d6\u5de7\u3002
    \u4ee3\u7801\uff1a<\/p>\n\n\n\n
    str=\"c8e9aca0c6f2e5f3e8c4efe7a1a0d4e8e5a0e6ece1e7a0e9f3baa0e8eafae3f9e4eafae2eae4e3eaebfaebe3f5e7e9f3e4e3e8eaf9eaf3e2e4e6f2\"\nstrlen=len(str)\nprint(strlen)\nfor i in range(0,118,2):\n    byte=str[i:i+2]\n    s=int(byte,16)-128\n    print(chr(s),end=\"\")\n<\/code><\/pre>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    flag{hjzcydjzbjdcjkzkcugisdchjyjsbdfr}<\/code><\/pre>\n\n\n\n
    17.\u53cc\u8272\u5757<\/h2>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u53ef\u4ee5\u770b\u5230<\/p>\n\n\n\n
    \u7eff\u8272\u548c\u7c89\u8272\u7684\u683c\u5b50<\/p>\n\n\n\n
    \u7eff\u8272\u662f0, \u7c89\u8272\u662f1<\/p>\n\n\n\n
    \u5148\u5c06\u591a\u4e2a\u56fe\u50cf\u53e0\u52a0\u5728\u4e00\u8d77\u770b\u770b<\/p>\n\n\n\n
    from PIL import Image\nimport numpy as np\nimport os\nfrom natsort import natsorted\n\ndir_path = \"gifframe\"\nfile_names = natsorted(os.listdir(dir_path))\nnew_img_array = np.zeros((240, 240, 4), np.uint8)\nfor file_name in file_names:\n    image = Image.open(os.path.join(dir_path, file_name))\n    image_array = np.array(image)\n    new_img_array += image_array\nnew_img = Image.fromarray(new_img_array)\nnew_img.show()\nnew_img.save(\"combined_image.png\")<\/code><\/pre>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u4e0d\u50cf\u4e8c\u7ef4\u7801\uff0c\u7ed9\u4ed6\u7eff\u82720, \u7c89\u8272\u662f1 \u8f6c\u6210\u4e8c\u8fdb\u5236<\/p>\n\n\n\n
    py3\u811a\u672c\u5448\u73b0<\/p>\n\n\n\n
    from PIL import Image\nimport numpy as np\nimport os\nfrom natsort import natsorted\n\ndir_path = r\"F:\u7b14\u8bb0\u7ec3\u4e60\u9776\u573a\u7b14\u8bb0\u653b\u9632\u4e16\u754cMisc\u96be\u5ea6\u56db\u53cc\u8272\u5757gifframe\"\nfile_names = natsorted(os.listdir(dir_path))[:576]\nbinary_576 = \"\"\nrow = 0\ncolumn = 0\n\nfor file_name in file_names:\n    img = Image.open(os.path.join(dir_path, file_name))\n    img_arr = np.array(img)[..., 0:3]\n    binary_576 += \"0\" if img_arr[row*10, column*10][1] == 255 else \"1\"\n    column += 1\n    if column % 24 == 0:\n        row += 1\n        column = 0\n\nprint(\"576\u4f4d\u4e8c\u8fdb\u5236\uff0824\u5217\u00d724\u884c\uff09\uff1a\")\nfor i in range(0, 576, 24):\n    print(binary_576[i:i+24])\n\nwith open(\"576\u4f4d\u4e8c\u8fdb\u5236.txt\", \"w\", encoding=\"utf-8\") as f:\n    for i in range(0, 576, 24):\n        f.write(binary_576[i:i+24] + \"n\")<\/code><\/pre>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u4e8c\u8fdb\u5236\u8f6cASCII<\/p>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    o8DlxK+H8wsiXe\/ERFpAMaBPiIcj1sHyGOMmQDkK+uXsVZgre5DSXw==hhhhhhhhhhhhhhhh<\/code><\/pre>\n\n\n\n
    \u539fGIF\u53ef\u4ee5binwalk \u5982\u4f55foremost\u63d0\u53d6<\/p>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u53d1\u73b0\u5bc6\u94a5<\/p>\n\n\n\n
    ctfer2333<\/code><\/pre>\n\n\n\n
    DES\u89e3\u5bc6\u5c31\u884c<\/p>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    flag{2ce3b416457d4380dc9a6149858f71db}<\/code><\/pre>\n\n\n\n
    18.ewm<\/h2>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    85\u5f20\u9700\u8981\u62fc\u63a5\u4e8c\u7ef4\u7801 \u7eaf\u96be\u4e3a\u4eba<\/p>\n\n\n\n
    \u6309\u4fee\u6539\u65f6\u95f4\u6392\u5e8f<\/strong>\uff1a\u8fd9\u662f\u5173\u952e\uff0c\u56e0\u4e3a\u539f\u811a\u672c\u5c31\u662f\u6309\u4fee\u6539\u65f6\u95f4\u6392\u5e8f\u7684<\/p>\n\n\n\n
    14\u884c6\u5217\u7f51\u683c<\/strong>\uff1a\u8fd9\u662f\u6700\u91cd\u8981\u7684\u7ebf\u7d22\uff0c\u539f\u811a\u672c\u4f7f\u752814×6=84\u683c\uff0c85\u5f20\u56fe\u7247\u53ef\u80fd\u591a\u4e00\u5f20<\/p>\n\n\n\n
    \u591a\u79cd\u5c1d\u8bd5\u65b9\u6cd5<\/strong>\uff1a<\/p>\n\n\n\n