第四届“强网”拟态防御国际精英挑战赛MISC-mirror

Posted 2021-12-03 末 初

full.png使用010 Editor打开出现CRC校验报错，猜测需要修复宽高，其次发现了文件末尾附加了镜像翻转的png字节流数据

将附加数据提取出来另存为png文件，通过分析不难发现将字节流数据逆序然后每十六个字节流翻转一下即为正常的png数据

使用Python简单处理

from binascii import *

with open('full1.png', 'rb') as f:
	with open('res-full.png', 'wb') as f1:
		hex_data = hexlify(f.read()).decode()[::-1]
		for i in range(0, len(hex_data), 32):
			data = hex_data[i:i+32][::-1]
			f1.write(unhexlify(data))

即得到full.png和res-full.png两张图片，两张图片使用010 Editor打开都会出现CRC报错，使用脚本还原宽高

import binascii
import struct
import sys

file = 'full.png'
fr = open(file,'rb').read()
data = bytearray(fr[0x0c:0x1d])
crc32key = eval('0x'+str(binascii.b2a_hex(fr[0x1d:0x21]))[2:-1])
#原来的代码: crc32key = eval(str(fr[29:33]).replace('\\\\x','').replace("b'",'0x').replace("'",''))
n = 4095
for w in range(n):
    width = bytearray(struct.pack('>i', w))
    for h in range(n):
        height = bytearray(struct.pack('>i', h))
        for x in range(4):
            data[x+4] = width[x]
            data[x+8] = height[x]
        crc32result = binascii.crc32(data) & 0xffffffff
        if crc32result == crc32key:
            print(width,height)
            newpic = bytearray(fr)
            for x in range(4):
                newpic[x+16] = width[x]
                newpic[x+20] = height[x]
            fw = open(file+'.png','wb')
            fw.write(newpic)
            fw.close
            sys.exit()

即得到完整的图片full.png.png以及res-full.png.png


很明显res-full.png.png可能存在盲水印

flag.png使用PS水平翻转一下

32effq8aa8374a02a9p1636ae8901qa0

提示

2-5 e-6 9-a p-b q-d

一开始以为只是2->5 e->6 9->a p->b q->d，替换后发现提交并不对，猜测是都要相互替换即

flag='32effq8aa8374a02a9p1636ae8901qa0'

dict1 = {'2':'5','5':'2','e':'6','6':'e','9':'a','a':'9','p':'b','b':'p','q':'d','d':'q'}
flag_list = list(flag)

idx = 0
for char in flag_list:
	for key in dict1:
		if char == key:
			flag_list[idx] = dict1[key]
	idx += 1
res_flag = ''
for i in flag_list:
	res_flag += i
print('flag{{{}}}'.format(res_flag))

PS C:\\Users\\Administrator\\Downloads\\mirror> python .\\replace.py
flag{356ffd89983749059ab1e3e968a01d90}