一些杂七杂八的WriteUp

# -*- coding: utf-8 -*-

# @Author  : 1cePeak

import re

import urllib.parse

f = open("newlog-2024.log","r")

lines = f.readlines()

datas = []

for line in lines:

    t = urllib.parse.unquote(line)

    if 'LIMIT' in t and 'security' in t and '722' in t and 'Nqtp' in t:

        datas.append(t)

flag_ascii = {}

for data in datas:

    matchOjb = re.search( r'0,1\),(\d+),.+>(\d+)', data)

    if matchOjb:

        # print(matchOjb.group(1),chr(int(matchOjb.group(2))+1))

        print("key",end=':')

        key = int(matchOjb.group(1))

        print(key)

        print("value",end=':')

        value = int(matchOjb.group(2))

        print(value)

        flag_ascii[key] = value

        print(flag_ascii)

flag = ""

for value in flag_ascii.values():

    flag += chr(value)

print(flag)

# 8ea72d948d9cceb0a12c34b1c06952606547fdd25d4f6ffad12ab42a858d37fc

import wave

import os

def parse_morse_wav(filename, long_ucnt, short_ucnt, bit_sep, block_sep):

    # 打开 WAV 文件

    with wave.open(filename, 'rb') as wav_file:

        n_frames = wav_file.getnframes()

        # 读取所有帧数据

        frames = wav_file.readframes(n_frames)

        # 定义基本单位模式 (00 00 32 33 00 00 CE CC)

        base_unit = b'\x00\x00\x32\x33\x00\x00\xCE\xCC'

        base_unit_len = len(base_unit)

        bit_separator = b'\x00' * bit_sep

        block_separator = b'\x00' * block_sep

        pos = 0

        bits = []

        data = []

        while pos < len(frames):

            if frames[pos : pos + block_sep] == block_separator:

                if bits:

                    data.append(int(''.join(bits), 2))

                bits = []

                pos += block_sep

            elif frames[pos : pos + base_unit_len * long_ucnt] == base_unit * long_ucnt:

                bits.append('1')

                pos += base_unit_len * long_ucnt

            elif frames[pos : pos + base_unit_len * short_ucnt] == base_unit * short_ucnt:

                bits.append('0')

                pos += base_unit_len * short_ucnt

            elif frames[pos : pos + bit_sep] == bit_separator:

                pos += bit_sep

            else:

                break

        return data

long_ucnt1 = 36

short_ucnt1 = 12

bit_sep1 = 96

block_sep1 = 384

long_ucnt2 = 24

short_ucnt2 = 8

bit_sep2 = 64

block_sep2 = 256

if __name__ == "__main__":

    filenames = os.listdir('./wav')

    data = []

    try:

        for filename in filenames:

            decoded_data = parse_morse_wav(f'./wav/{filename}', long_ucnt1, short_ucnt1, bit_sep1, block_sep1)

            if not decoded_data:

                decoded_data = parse_morse_wav(f'./wav/{filename}', long_ucnt2, short_ucnt2, bit_sep2, block_sep2)

            data.extend(decoded_data)

        print(f"解码: {filename}")

    except Exception:

        print(f"解码错误: {filename}")

    print(data)

import string

f = open('1.txt', 'rb').read()

for i in range(len(f)-4):

    if(f[i:i+4] == b'RIFF'):

        if(chr(f[i-6]) in string.printable):

            print(chr(f[i-6]),end='')

import time

import os

import re

T = 1124789000

filenames = [filename for filename in os.listdir('.') if filename.endswith('.txt')]

sorted_filenames = sorted(filenames, key=lambda x: int(re.search(r'change(\d+)\.txt', x).group(1)))

print(sorted_filenames)

data = []

for filename in sorted_filenames:

    meta_info = os.stat(filename)

    mtime = time.localtime(meta_info.st_mtime)

    timestamp = time.mktime(mtime)

    data.append(int(timestamp) - T)

print(data)

import os

import base64

from PIL import Image

def get_Image_Pixel(image_path):

    with Image.open(image_path) as img:

        pixel_data = img.getpixel((0,0))[0]

        return pixel_data

def get_image_dimensions(image_path):

    with open(image_path, 'rb') as img:

        img_bytes = img.read()

        # print(img_bytes[:18])

        return int(img_bytes[0x13]), int(img_bytes[0x17])

def height_Steg():

    heights = []

    current_directory = os.getcwd()

    for i in range(1, 4704):

        image_name = f"pintu/{i}.png"

        image_path = os.path.join(current_directory, image_name)

        if os.path.exists(image_path):

            width, height = get_image_dimensions(image_path)

            heights.append(height)

            # print(f"{image_name}: Width = {width}, Height = {height}")

        else:

            print(f"{image_name} does not exist.")

    res = ''

    data = ''

    for item in heights:

        decimal_heights = int(str(item),8)

        res+=chr(decimal_heights)

    #print(res)

    res = res.split(' ')

    for item in res:

        data +=chr(int(item))

    #print(data)

    data = base64.b32decode(data)

    print(data)

    return data

def translate_pixel():

    res = ''

    output = []

    current_directory = os.getcwd()

    for i in range(1, 4704):

        image_name = f"pintu/{i}.png"

        image_path = os.path.join(current_directory, image_name)

        if os.path.exists(image_path):

            pixel_data = get_Image_Pixel(image_path)

            if pixel_data == 255:

                res += '1'

            else:

                res += '0'

    if len(res) % 8!=0:

        # 这里一定要注意是在前面补零还是在后面补零，一般都是在前面补零对齐

        # res+='0'*(8-len(res)%8)

        res = '0'*(8-len(res)%8) + res

    for i in range(0,len(res),8):

        binary_segment = res[i:i+8]

        int_value = int(binary_segment,2)

        char_value = chr(int_value)

        output += [char_value]

    # print(output)

    print(''.join([str(x) for x in output]))

b64data = height_Steg()

translate_pixel()

b64t = str.maketrans('sUvcu5rgSeAmJQCfdXtEMKIB91Lj3niOo4hyV0b/2azpx8HqZP6wk7GNlTFYDR+W', "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/")

dec = b64data.decode('ascii').translate(b64t)

print(dec)

with open('1.txt', 'r') as f:

    data = f.readlines()

trans = {

    '00': '.',

    '01': '-',

    '02': '/'

}

print(''.join([trans[b.strip()] for b in data]))

import os

import base64

import shutil

def base32_decode_filename(filename):

    # 移除.png 后缀

    if filename.endswith('.png'):

        filename = filename[:-4]

    # Base32 解码

    try:

        decoded_bytes = base64.b32decode(filename)

        return decoded_bytes.decode('utf-8')

    except base64.binascii.Error as e:

        # Base32 末尾填充 =

        if "Incorrect padding" in str(e):

            padded_input = filename + '=' * (8 - len(filename) % 8)

            return base64.b32decode(padded_input).decode('utf-8')

def decode_png_filenames_in_tmp():

    b32decode_results = {}

    tmp_dir = 'tmp'

    for filename in os.listdir(tmp_dir):

        if filename.lower().endswith('.png'):

            decoded_name = base32_decode_filename(filename)

            if decoded_name:

                print(f"原始文件名: {filename} -> 解码后: {decoded_name}")

                b32decode_results[filename] = decoded_name

    return b32decode_results

def decode_filename_number(b32decode_results):

    cn2number = {

        '零': '0',

        '一': '1',

        '二': '2',

        '三': '3',

        '四': '4',

        '五': '5',

        '六': '6',

        '七': '7',

        '八': '8',

        '九': '9',

        '壹': '1',

        '贰': '2',

        '叁': '3',

        '肆': '4',

        '伍': '5',

        '陆': '6',

        '柒': '7',

        '捌': '8',

        '玖': '9',

        '零': '0',

        '0': '0',

        '1': '1',

        '2': '2',

        '3': '3',

        '4': '4',

        '5': '5',

        '6': '6',

        '7': '7',

        '8': '8',

        '9': '9',

    }

    numberdecode_results = {}

    for item in b32decode_results.items():

        number_str = ''.join([cn2number[char] for char in item[1] if char in cn2number])

        numberdecode_results[item[0]] = number_str

        print(f"原始文件名: {item[0]} -> 解码后: {number_str}")

    os.makedirs('renamed_png', exist_ok=True)

    for item in numberdecode_results.items():

        shutil.copy2(f'tmp/{item[0]}', f'renamed_png/{item[1]}.png')

if __name__ == "__main__":

    dec1 = decode_png_filenames_in_tmp()

    decode_filename_number(dec1)

print(hex(0x2de0d7dc833099fcdcd7d452bf24d98e8281e1b72f384a57b71683520e893386894b998ed71888503de031f1f2d0c9f7ad9247d618679aed ^ 0x778dafb4d903eac99183bf2bf14990bfcfc2d0dc626f0363fb42d22a43bb62f2c60ffde59961b93867a7679cbd9798c6f7d516af4130d4d4))

import binascii

import itertools

import string

import zipfile

import os

def crack_crc32(target_crc, length=4, charset=None):

    """

    通过CRC32碰撞找到匹配的字符串

    :param target_crc: 目标CRC32值（整数或十六进制字符串）

    :param length: 原文长度（默认为4）

    :param charset: 使用的字符集（默认所有可打印ASCII字符）

    :return: 匹配的字符串或None

    """

    # 处理目标 CRC32 值

    if isinstance(target_crc, str):

        target_crc = int(target_crc, 16)

    target_crc = target_crc & 0xffffffff  # 确保是 32 位无符号整数

    # 设置字符集

    if charset is None:

        charset = string.printable  # 默认使用所有可打印 ASCII 字符

    elif isinstance(charset, str):

        charset = list(charset)

    print(f"开始碰撞 {length} 字节CRC32: 0x{target_crc:08x}")

    print(f"使用的字符集: {charset[:20]}... (共{len(charset)}个字符)")

    # 遍历所有可能的组合

    for candidate in itertools.product(charset, repeat=length):

        text = ''.join(candidate)

        crc = binascii.crc32(text.encode()) & 0xffffffff

        if crc == target_crc:

            return text

    return None  # 未找到匹配

if __name__ == "__main__":

    ext = ''

    filelist = [f'ext/{i}.zip' for i in range(1, 69)]

    for filename in filelist:

        with zipfile.ZipFile(filename) as zf:

            file_info = zf.infolist()[0]

            target_crc = file_info.CRC

        result = crack_crc32(target_crc, length=4)

        ext += result

        if result:

            print(f"找到匹配: '{result}' (CRC32: 0x{binascii.crc32(result.encode()) & 0xffffffff:08x})")

        else:

            print("未找到匹配")

    print(ext)

from PIL import Image

filenames = [f'qrsea/{i}.png' for i in range(531)]

data = {}

for file in filenames:

    with Image.open(file) as img:

        n = img.width

        if n in data.keys():

            data[n] += 1

        else:

            data[n] = 1

print(data)

from PIL import Image

import numpy as np

import matplotlib.pyplot as plt

filenames = [f'qrsea/{i}.png' for i in range(531)]

data = {}

for file in filenames:

    with Image.open(file) as img:

        n = img.width

        if n in data.keys():

            data[n] += 1

        else:

            data[n] = 1

data = sorted(data.keys())

data = {data[i]: i for i in range(10)}

result = ''

for file in filenames:

    with Image.open(file) as img:

        n = img.width

        result += str(data[n])

def Tupper_self_referential_formula(k):

    aa = np.zeros((17, 106))

    def f(x, y):

        y += k

        a1 = 2 ** -(-17 * x - y % 17)

        a2 = (y // 17) // a1

        return 1 if a2 % 2 > 0.5 else 0

    for y in range(17):

        for x in range(106):

            aa[y, x] = f(x, y)

    return aa[:, ::-1]

k = int(result)

aa = Tupper_self_referential_formula(k)

plt.figure(figsize=(15, 10))

plt.imshow(aa, origin='lower')

plt.gca().invert_xaxis()

plt.show()

from PIL import Image

import os

def stitch_images(output_path):

    # 获取所有图片文件（按文件名排序）

    image_files = [f'ftpdump/{i}.png' for i in range(1, 101)]

    # 创建空白画布

    result = Image.new('RGB', (400, 400))

    # 当前垂直位置

    y_offset = 0

    # 逐个拼接图片

    for img_file in image_files:

        img_path = os.path.join(img_file)

        with Image.open(img_path) as img:

            # 确保图片尺寸是 400x4

            if img.size != (400, 4):

                raise ValueError(f"图片{img_file}尺寸不是400x4，而是{img.size}")

            # 将当前图片粘贴到结果中

            result.paste(img, (0, y_offset))

            y_offset += 4  # 每次下移 4 像素

    # 保存结果

    result.save(output_path)

    print(f"图片已成功拼接并保存到: {output_path}")

stitch_images("output.jpg")

# -*- coding: utf-8 -*-

# @Author  : 1cePeak

import matplotlib.pyplot as plt

import cv2

import numpy as np

from PIL import Image

img = cv2.imread('output.png')

def arnold_encode(image, shuffle_times, a, b):

    """ Arnold shuffle for rgb image

    Args:

        image: input original rgb image

        shuffle_times: how many times to shuffle

    Returns:

        Arnold encode image

    """

    # 1: 创建新图像

    arnold_image = np.zeros(shape=image.shape)

    # 2：计算 N

    h, w = image.shape[0], image.shape[1]

    N = h   # 或 N=w

    # 3：遍历像素坐标变换

    for time in range(shuffle_times):

        for ori_x in range(h):

            for ori_y in range(w):

                # 按照公式坐标变换

                new_x = (1*ori_x + b*ori_y)% N

                new_y = (a*ori_x + (a*b+1)*ori_y) % N

                # 像素赋值

                print(image[ori_x, ori_y, :])

                print(arnold_image[new_x, new_y, :])

                arnold_image[new_x, new_y, :] = image[ori_x, ori_y, :]

    cv2.imwrite('flag_arnold_encode.png', arnold_image, [int(cv2.IMWRITE_PNG_COMPRESSION), 0])

    return arnold_image

def arnold_decode(image, shuffle_times, a, b):

    """ decode for rgb image that encoded by Arnold

    Args:

        image: rgb image encoded by Arnold

        shuffle_times: how many times to shuffle

    Returns:

        decode image

    """

    # 1: 创建新图像

    decode_image = np.zeros(shape=image.shape)

    # 2：计算 N

    h, w = image.shape[0], image.shape[1]

    N = h  # 或 N=w

    # 3：遍历像素坐标变换

    for time in range(shuffle_times):

        for ori_x in range(h):

            for ori_y in range(w):

                # 按照公式坐标变换

                new_x = ((a * b + 1) * ori_x + (-b) * ori_y) % N

                new_y = ((-a) * ori_x + ori_y) % N

                decode_image[new_x, new_y, :] = image[ori_x, ori_y, :]

    cv2.imwrite('flag.png', decode_image, [int(cv2.IMWRITE_PNG_COMPRESSION), 0])

    return decode_image

# arnold_encode(img, 1, 2, 3)

arnold_decode(img, 1, 0x726e, 0x6f6c64)