{"id":288,"date":"2025-05-26T14:00:00","date_gmt":"2025-05-26T06:00:00","guid":{"rendered":"https:\/\/www.hurkin.top\/?p=288"},"modified":"2025-05-26T14:03:47","modified_gmt":"2025-05-26T06:03:47","slug":"litctf-2025-misc-%e9%83%a8%e5%88%86","status":"publish","type":"post","link":"https:\/\/www.hurkin.top\/index.php\/2025\/litctf-2025-misc-%e9%83%a8%e5%88%86\/","title":{"rendered":"LitCTF 2025 Misc \u90e8\u5206"},"content":{"rendered":"\n

\u6700\u8fd1\u5176\u4ed6\u7684\u5403\u591a\u4e86 \u5012\u611f\u89c9LitCTF\u7684misc\u7709\u6e05\u76ee\u79c0\u7684<\/p>\n\n\n\n

Cropping<\/h2>\n\n\n\n

\u5148\u662f\u538b\u7f29\u5305\u4f2a\u52a0\u5bc6\u4fee\u590d<\/p>\n\n\n\n

\"img\"<\/figure>\n\n\n\n

\u62fc\u56fe\u5373\u53ef<\/p>\n\n\n\n

magick montage *.png -tile 10x10 -geometry +0+0 flag.png<\/code><\/pre>\n\n\n\n
\"img\"<\/figure>\n\n\n\n
LitCTF{e7c3f4b2-9a6f-4d3f-9f98-0b3db91c2a12}<\/p>\n\n\n\n
\u50cf\u7d20\u4e2d\u7684\u822a\u73ed<\/h3>\n\n\n\n
Osint\u9898 \u5c0f\u674e\u8981\u53bb\u53c2\u52a0\u957f\u57ce\u676f\u4e86\uff0c\u4ed6\u4e58\u5750\u7684\u54ea\u8d9f\u822a\u73ed\uff1f \u957f\u57ce\u676f\u51b3\u8d5b\u5728\u798f\u5dde \u65f6\u95f4\u4e3a4.28<\/p>\n\n\n\n
\u56fe\u7247\u4e2d\u7684\u4fe1\u606f\u662f\u4e2d\u56fd\u5357\u65b9\u822a\u7a7a<\/p>\n\n\n\n
\nhttps:\/\/www.flightera.net\/zh\/airport\/Fuzhou\/ZSFZ\/arrival\n<\/div><\/figure>\n\n\n\n
\u5728\u8fd9\u4e2a\u7f51\u7ad9\uff0c\u8fc7\u6ee4\u5357\u65b9\u822a\u7a7a\uff0c\u4ece4.27\u4e00\u4e2a\u4e2a\u5f80\u524d\u627e\uff0c\u6700\u540e\u627e\u5230\u662f\u57284.26\u7684\u822a\u7a7aCZ8289<\/p>\n\n\n\n
\"img\"<\/figure>\n\n\n\n
LitCTF{CZ8289}<\/p>\n\n\n\n
\u7075\u611f\u83c7\ud83c\udf44\u54e9\u83c7\u54e9\u83c7\u54e9\u54c7\u64e6\u7075\u611f\u83c7\u7075\u611f\u83c7\ud83c\udf44<\/h3>\n\n\n\n
\u7075\u611f\u83c7\u7f16\u7801<\/p>\n\n\n\n
\u63a2\u59ec\u7684\u9879\u76eehttps:\/\/github.com\/ProbiusOfficial\/Lingicrypt<\/p>\n\n\n\n
\"img\"<\/figure>\n\n\n\n
\u6d88\u5931\u7684\u6587\u5b57<\/h3>\n\n\n\n
\u5c06\u6d41\u91cf\u5305\u7528neta\u68ad\u54c8\u4e00\u4e0b\u5f97\u5230\u538b\u7f29\u5305\u5bc6\u7801868F-83BD-FF<\/strong><\/p>\n\n\n\n
\"img\"<\/figure>\n\n\n\n
\u89e3\u538b\u540e\u5f97\u5230\u4e00\u4e2a\u6587\u6863\uff0c\u53eb\u505ahidden-word\uff0c\u7528https:\/\/hidden-word.top\/\u89e3\u5bc6\u5f97\u5230flag<\/p>\n\n\n\n
\"img\"<\/figure>\n\n\n\n
\u6d1e\u5996\u6d1e\u5996<\/h3>\n\n\n\n
\u9644\u4ef6\u7ed9\u4e86\u4e00\u4e2appt\uff0c\u6539zip\u89e3\u538b\u540e\u53d1\u73b0\u5728ppt\u76ee\u5f55\u4e2d\u6709\u4e00\u4e2avbaProject.bin\uff0c\u662f\u5b8f\u4ee3\u7801\uff0c\u7528olevba .\\vbaProject.bin\u770b\u770b\u5177\u4f53\u6267\u884c\u4e86\u4ec0\u4e48<\/p>\n\n\n\n
\u5927\u6982\u5c31\u662f\u7528\u6362\u8868base64\u505a\u4e86\u4e00\u4e9b\u7f16\u7801\u548c\u52a0\u5bc6\uff0c\u7ed9\u4e86\u5bc6\u6587\uff0c\u9700\u8981\u5199\u811a\u672c\u89e3\u51fa\u660e\u6587\uff0c\u4f46\u662f\u8fd9\u91cc\u7684\u5b57\u7b26\u8868\u6ca1\u7ed9\uff0c\u90a3\u4e48\u9700\u8981\u53bb\u627e\u4e00\u4e0b<\/p>\n\n\n\n
olevba 0.60.2 on Python 3.9.1 - http:\/\/decalage.info\/python\/oletools\n===============================================================================\nFILE: .\\vbaProject.bin\nType: OLE\n-------------------------------------------------------------------------------\nVBA MACRO \u6a21\u57571.bas \nin file: .\\vbaProject.bin - OLE stream: 'VBA\/\u6a21\u57571'\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - \nSub hgf()\nSub CustomEncode()\n    Dim inputString As String\n    inputString = \"*******\"\n\n    Dim encodedString As String\n    encodedString = CustomEncode(inputString)\n\n    MsgBox \"\u81ea\u5b9a\u4e49\u7f16\u7801\u7ed3\u679c\u4e3a: \" & vbCrLf & encodedString\nEnd Sub\n\nFunction CustomEncode(inputString As String) As String\n    Dim charSet As String\n    charSet = \"*******************\"\n\n    Dim byteArray() As Byte\n    byteArray = StrConv(inputString, vbFromUnicode)\n\n    Dim encodedString As String\n    encodedString = \"\"\n    Dim i As Integer\n    Dim n As Long\n    For i = 1 To LenB(byteArray) Step 3\n        n = 0\n        n = (n Or (ByteToInt(MidB(byteArray, i, 1)) << 16))\n        If i + 1 <= LenB(byteArray) Then\n            n = (n Or (ByteToInt(MidB(byteArray, i + 1, 1)) << 8))\n        End If\n        If i + 2 <= LenB(byteArray) Then\n            n = (n Or ByteToInt(MidB(byteArray, i + 2, 1)))\n        End If\n\n        encodedString = encodedString & Mid(charSet, (n >> 18) + 1, 1)\n        encodedString = encodedString & Mid(charSet, ((n >> 12) And &H3F) + 1, 1)\n        If (i + 1) <= LenB(byteArray) Then\n            encodedString = encodedString & Mid(charSet, ((n >> 6) And &H3F) + 1, 1)\n        Else\n            encodedString = encodedString & \"=\"\n        End If\n        If (i + 2) <= LenB(byteArray) Then\n            encodedString = encodedString & Mid(charSet, (n And &H3F) + 1, 1)\n        Else\n            encodedString = encodedString & \"=\"\n        End If\n    Next i\n\n    CustomEncode = encodedString\nEnd Function\n\nFunction ByteToInt(byteVal As Byte) As Long\n    ByteToInt = CLng(byteVal)\nEnd Function\nEnd Function\n\"5uESz7on4R8eyC\/\/\"<\/code><\/pre>\n\n\n\n
\u540e\u9762\u53d1\u73b0\u5728\u5e7b\u706f\u7247\u6d4f\u89c8\u4e2d\u53d1\u73b0\u540e\u9762\u7684\u9875\u9762\u7684\u5e27\u95f4\u9694\u90fd\u662f0\u548c1\uff0c\u731c\u5230\u662fppt\u5e27\u95f4\u9694\u9690\u5199<\/p>\n\n\n\n
\"img\"<\/figure>\n\n\n\n
\u8ba9ai\u6413\u4e2a\u811a\u672c\uff0c\u63d0\u53d6\u4e00\u4e0bxml\u4e2d\u7684\u6301\u7eed\u65f6\u95f4<\/p>\n\n\n\n
import os\nimport re\n\ndef extract_unique_advTm_per_file(directory, output_file):\n    advTm_pattern = re.compile(r'advTm=\"(.*?)\"')\n    results = []\n\n    for i in range(1, 457):  # slide1.xml \u5230 slide456.xml\n        file_name = f'slide{i}.xml'\n        file_path = os.path.join(directory, file_name)\n        try:\n            with open(file_path, 'r', encoding='utf-8') as f:\n                content = f.read()\n                matches = advTm_pattern.findall(content)\n                unique_matches = sorted(set(matches))\n                if unique_matches:\n                    results.append(f\"{', '.join(unique_matches)}\")\n        except FileNotFoundError:\n            print(f'{file_path} not found. Skipping.')\n        except Exception as e:\n            print(f'Error reading {file_path}: {e}')\n\n    with open(output_file, 'w', encoding='utf-8') as f_out:\n        for line in results:\n            f_out.write(line + '\\n')\n\nif __name__ == '__main__':\n    directory = '.\/slides'  # <<< \u4fee\u6539\u4e3a\u4f60\u7684\u76ee\u5f55\u8def\u5f84\n    output_file = 'result.txt'\n    extract_unique_advTm_per_file(directory, output_file)\n    print(f'Done. Results saved to {output_file}')<\/code><\/pre>\n\n\n\n
\u7136\u540e\u4e22\u7ed9\u53a8\u5b50 7\u4f4d\u4e8c\u8fdb\u5236\u8f6c\u5b57\u7b26\u5373\u53ef\u5f97\u5230\u5b57\u7b26\u8868\uff0c<\/p>\n\n\n\n
\"img\"<\/figure>\n\n\n\n
\u7136\u540e\u518d\u8ba9ai\u5199\u4e2a\u89e3\u5bc6\u811a\u672c\u5373\u53ef\u89e3\u51fa\u5bc6\u7801<\/p>\n\n\n\n
import sys\n\n# Custom Base64-like decoder based on provided VBA code\n\ndef custom_decode(encoded: str, charSet: str) -> bytes:\n    \"\"\"\n    Decode a string encoded with the custom Base64-like algorithm.\n\n    :param encoded: The encoded string (may include '=' padding).\n    :param charSet: A 64-character alphabet used for encoding.\n    :return: Decoded bytes.\n    \"\"\"\n    decoded = bytearray()\n    # Process each 4-character block\n    for i in range(0, len(encoded), 4):\n        block = encoded[i:i+4]\n        # Build the 24-bit number\n        num = 0\n        for ch in block:\n            num <<= 6\n            if ch != '=':\n                idx = charSet.find(ch)\n                if idx == -1:\n                    raise ValueError(f\"Character '{ch}' not found in charSet\")\n                num |= idx\n        # Extract original bytes\n        byte1 = (num >> 16) & 0xFF\n        byte2 = (num >> 8) & 0xFF\n        byte3 = num & 0xFF\n        decoded.append(byte1)\n        if block[2] != '\/':\n            decoded.append(byte2)\n        if block[3] != '\/':\n            decoded.append(byte3)\n    return bytes(decoded)\n\n\ndef main():\n    # Example usage\n    # Replace with actual 64-character alphabet used in your VBA charSet\n    charSet = 'CEdcwvZuNmlkJtsrqaV93=7Bzyx654YXWFp0n+MLKjiHgfDAbUeTSORQPoIhG821\/'\n    encoded_str = '5uESz7on4R8eyC\/\/'\n\n    try:\n        decoded_bytes = custom_decode(encoded_str, charSet)\n        # Adjust decoding as needed (e.g., utf-8, latin-1)\n        try:\n            decoded_str = decoded_bytes.decode('utf-8')\n        except UnicodeDecodeError:\n            decoded_str = decoded_bytes.decode('latin-1')\n        print(f\"Decoded result: {decoded_str}\")\n    except Exception as e:\n        print(f\"Error during decoding: {e}\", file=sys.stderr)\n\n\nif __name__ == '__main__':\n    main()<\/code><\/pre>\n\n\n\n
ppt\u7684\u672b\u5c3e\u8fd8\u85cf\u4e86\u4e2a\u9006\u8f6c\u52a0\u5bc6\u538b\u7f29\u5305\uff0c\u63d0\u53d6\u51fa\u6765\u7ffb\u8f6c\u4e00\u4e0b<\/p>\n\n\n\n
\u7136\u540e\u5c06\u5f97\u5230\u7684\u5bc6\u7801\u89e3\u538b\u52a0\u5bc6\u538b\u7f29\u5305\uff0c\u7136\u540e\uff0c\u6253\u5f00\u6587\u6863\uff0c\u628a\u56fe\u7247\u5220\u4e86\u7136\u540e\u5168\u9009\u6539\u989c\u8272\u53d1\u73b0flag<\/p>\n\n\n\n
\"\"<\/figure>\n","protected":false},"excerpt":{"rendered":"
\u6700\u8fd1\u5176\u4ed6\u7684\u5403\u591a\u4e86 \u5012\u611f\u89c9LitCTF\u7684misc\u7709\u6e05\u76ee\u79c0\u7684 Cropping \u5148\u662f\u538b\u7f29\u5305\u4f2a\u52a0\u5bc6\u4fee\u590d \u62fc\u56fe\u5373\u53ef LitCTF{e7c3 …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"emotion":"","emotion_color":"","title_style":"","license":"","_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-288","post","type-post","status-publish","format-standard","hentry","category-some-competition"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/www.hurkin.top\/index.php\/wp-json\/wp\/v2\/posts\/288","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.hurkin.top\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hurkin.top\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hurkin.top\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hurkin.top\/index.php\/wp-json\/wp\/v2\/comments?post=288"}],"version-history":[{"count":5,"href":"https:\/\/www.hurkin.top\/index.php\/wp-json\/wp\/v2\/posts\/288\/revisions"}],"predecessor-version":[{"id":302,"href":"https:\/\/www.hurkin.top\/index.php\/wp-json\/wp\/v2\/posts\/288\/revisions\/302"}],"wp:attachment":[{"href":"https:\/\/www.hurkin.top\/index.php\/wp-json\/wp\/v2\/media?parent=288"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hurkin.top\/index.php\/wp-json\/wp\/v2\/categories?post=288"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hurkin.top\/index.php\/wp-json\/wp\/v2\/tags?post=288"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}