解压附件,得到MP3后缀的文件,以为是音频隐写,无法播放,au也无法打开
010也看不出什么格式,绝对不是标准MP3文件
送进kali,file看一下,只是数据文件
和标准MP3文件对比,结果很明显
binwalk看看,发现两张图片
foremost分离
一张图片有flag(忍不住吐槽:这猫哪里可爱了……)
------------------分割线------------------
另一张图片是个二维码,我们看看里面有什么
扫码得到字符串
03f30d0ad41db4576300000000000000000100000040000000730d0000006400008400005a00006401005328020000006300000000030000000700000043000000734b0000006401006402006403006404006405006406006407006707007d00006408007d0100781e007c0000445d16007d02007c01007400007c0200830100377d0100712800577c010047486400005328090000004e694d0000006972000000692e0000006948000000696f000000696e0000006967000000740000000028010000007403000000636872280300000074030000007374727404000000666c6167740100000069280000000028000000007304000000612e7079520300000001000000730a00000000011b0106010d0114024e280100000052030000002800000000280000000028000000007304000000612e707974080000003c6d6f64756c653e010000007300000000
03f3老熟人了,010另存为pyc文件,反编译一下,得出python2代码
def flag():
str = [
77,
114,
46,
72,
111,
110,
103]
flag = ''
for i in str:
flag += chr(i)
print flag
最后顶格加上falg()调用函数,输出结果,一个假的flag



