2020湖湘杯MISC全解-writeup

MISC1

导出index-demo.html，查看代码发现隐藏了一长串base64

使用base64隐写进行解密

key:"lorrie"

得到key说明可能存在某种隐写，是snow隐写，但用网页版的snow隐写解出来是一串乱码，于是尝试使用本地版的SNOW.EXE

SNOW.EXE -p lorrie index-demo.html

flag{→_→←_←←_←←_←←_← →_→→_→←_←←_←←_← →_→←_←←_←←_← ←_←←_←←_←→_→→_→ ←_←←_←←_←→_→→_→ ←_← ←_←←_←←_←→_→→_→ →_→→_→→_→→_→←_← →_→←_←←_←←_← ←_←←_←←_←←_←←_← ←_←→_→→_→→_→→_→ →_→→_→→_→→_→→_→ ←_←←_←←_←←_←←_← ←_←←_←→_→←_← →_→←_←←_ ←←_← ←_←←_←←_←←_←→_→ ←_←→_→ ←_←←_←→_→→_→→_→ →_→→_→→_→→_→←_← ←_←←_←←_←←_ ←←_← ←_←←_←←_←→_→→_→ ←_←→_→ →_→→_→→_→→_→→_→ →_→←_←→_→←_← ←_← →_→→_→←_←←_←←_← →_→→_→→_→→_→←_← →_→←_←→_→←_← ←_←←_←←_←→_→→_→ ←_←←_←←_←→_→→_→ →_→→_ →←_←←_←←_← →_→→_→→_→←_←←_←}

把→_→和→_ →替换成-，把 ←_←和 ←_ ←替换成.，然后摩斯解密，得到

67b33e39b5105fb4a2953a0ce79c3378

MISC2 -passwd

内存取证

volatility2.6.exe -f WIN-BU6IJ7FI9RU-20190927-152050.raw imageinfo

Win7SP1x86_23418, Win7SP0x86, Win7SP1x86

volatility2.6.exe -f WIN-BU6IJ7FI9RU-20190927-152050.raw --profile=Win7SP1x86_23418 hashdump

Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::

Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::

CTF:1000:aad3b435b51404eeaad3b435b51404ee:0a640404b5c386ab12092587fe19cd02:::

db25f2fc14cd2d2b1e7af307241f548fb03c312a

MISC3-虚实之间

binwalk提取出一个明文和一个加密的压缩包

修复加密压缩包

使用AZPR4.0进行明文攻击

123%asd!O

解压得到：

仅需5，跳过去

ffd5e341le25b2dcab15cbb}gc3bc5b{789b51

栅栏解密：

https://www.qqxiuzi.cn/bianma/zhalanmima.php

flag{febc7d2138555b9ebccb32b554dbb11c}

MISC4 隐藏的秘密

volatility2.6.exe -f 隐藏的秘密.vmem imageinfo

//Win2003SP0x86, Win2003SP1x86, Win2003SP2x86

volatility2.6.exe -f 隐藏的秘密.vmem --profile=Win2003SP0x86 filescan

windows下文件扫描出错，换成kali下，也不行，把版本换成Win2003SP1x86