【picoCTF2022】Misc部分

Enhance!

File types

去掉 .pdf 是一个 shell 脚本，运行时用到了 uudecode，需要 sudo apt install sharutils

之后就是各种压缩包的嵌套了，QAQ

┌──(sparks㉿LAPTOP-Sparks)-[/mnt/…/CTF/pico2022/Misc/File types]
└─$ file Flag
Flag: current ar archive┌──(sparks㉿LAPTOP-Sparks)-[/mnt/…/CTF/pico2022/Misc/File types]
└─$ ar -p Flag > flag1┌──(sparks㉿LAPTOP-Sparks)-[/mnt/…/CTF/pico2022/Misc/File types]
└─$ file flag1
flag1: cpio archive┌──(sparks㉿LAPTOP-Sparks)-[/mnt/…/CTF/pico2022/Misc/File types]
└─$ cpio -idmv < flag1
flag
2 blocks┌──(sparks㉿LAPTOP-Sparks)-[/mnt/…/CTF/pico2022/Misc/File types]
└─$ file flag
flag: bzip2 compressed data, block size = 900k┌──(sparks㉿LAPTOP-Sparks)-[/mnt/…/CTF/pico2022/Misc/File types]
└─$ bunzip2 flag
bunzip2: Can't guess original name for flag -- using flag.out┌──(sparks㉿LAPTOP-Sparks)-[/mnt/…/CTF/pico2022/Misc/File types]
└─$ file flag.out
flag.out: gzip compressed data, was "flag", last modified: Tue Mar 15 06:50:49 2022, from Unix, original size modulo 2^32 326┌──(sparks㉿LAPTOP-Sparks)-[/mnt/…/CTF/pico2022/Misc/File types]
└─$ gzip -d flag.out┌──(sparks㉿LAPTOP-Sparks)-[/mnt/…/CTF/pico2022/Misc/File types]
└─$ file flag.out
flag.out: lzip compressed data, version: 1┌──(sparks㉿LAPTOP-Sparks)-[/mnt/…/CTF/pico2022/Misc/File types]
└─$ unzip flag.out┌──(sparks㉿LAPTOP-Sparks)-[/mnt/…/CTF/pico2022/Misc/File types]
└─$ file flag
flag: LZ4 compressed data (v1.4+)┌──(sparks㉿LAPTOP-Sparks)-[/mnt/…/CTF/pico2022/Misc/File types]
└─$ lz4 -d flag.lz4
Decoding file flag
flag.lz4             : decoded 263 bytes┌──(sparks㉿LAPTOP-Sparks)-[/mnt/…/CTF/pico2022/Misc/File types]
└─$ file flag
flag: LZMA compressed data, non-streamed, size 252┌──(sparks㉿LAPTOP-Sparks)-[/mnt/…/CTF/pico2022/Misc/File types]
└─$ lzma -d flag.lzma┌──(sparks㉿LAPTOP-Sparks)-[/mnt/…/CTF/pico2022/Misc/File types]
└─$ file flag
flag: lzop compressed data - version 1.040, LZO1X-1, os: Unix┌──(sparks㉿LAPTOP-Sparks)-[/mnt/…/CTF/pico2022/Misc/File types]
└─$ lzop -dv flag.lzo
decompressing flag.lzo into flag┌──(sparks㉿LAPTOP-Sparks)-[/mnt/…/CTF/pico2022/Misc/File types]
└─$ file flag
flag: lzip compressed data, version: 1┌──(sparks㉿LAPTOP-Sparks)-[/mnt/…/CTF/pico2022/Misc/File types]
└─$ unzip flag.out┌──(sparks㉿LAPTOP-Sparks)-[/mnt/…/CTF/pico2022/Misc/File types]
└─$ file flag
flag: XZ compressed data, checksum CRC64┌──(sparks㉿LAPTOP-Sparks)-[/mnt/…/CTF/pico2022/Misc/File types]
└─$ xz -d flag.xz┌──(sparks㉿LAPTOP-Sparks)-[/mnt/…/CTF/pico2022/Misc/File types]
└─$ file flag
flag: ASCII text┌──(sparks㉿LAPTOP-Sparks)-[/mnt/…/CTF/pico2022/Misc/File types]
└─$ cat flag
7069636f4354467b66316c656e406d335f6d406e3170756c407431306e5f
6630725f3062326375723137795f37353137353362307d0a┌──(sparks㉿LAPTOP-Sparks)-[/mnt/…/CTF/pico2022/Misc/File types]
└─$ cat flag | hex --decode
picoCTF{f1len@m3_m@n1pul@t10n_f0r_0b2cur17y_751753b0}

Lookey here

Packets Primer

Redaction gone wrong

Sleuthkit Intro

┌──(sparks㉿LAPTOP-Sparks)-[/mnt/…/CTF/pico2022/Misc/Sleuthkit Intro]
└─$ mmls -B disk.img
DOS Partition Table
Offset Sector: 0
Units are in 512-byte sectorsSlot      Start        End          Length       Size    Description
000:  Meta      0000000000   0000000000   0000000001   0512B   Primary Table (#0)
001:  -------   0000000000   0000002047   0000002048   1024K   Unallocated
002:  000:000   0000002048   0000204799   0000202752   0099M   Linux (0x83)┌──(sparks㉿LAPTOP-Sparks)-[/mnt/…/CTF/pico2022/Misc/Sleuthkit Intro]
└─$ nc saturn.picoctf.net 52279
What is the size of the Linux partition in the given disk image?
Length in sectors: 202752
202752
Great work!
picoCTF{mm15_f7w!}

Sleuthkit Apprentice

取证题，搞半天，用了 AXIOM Process

Eavesdrop

┌──(sparks㉿LAPTOP-Sparks)-[/mnt/…/CTF/pico2022/Misc/Eavesdrop]
└─$ openssl des3 -d -salt -in file.des3 -out file.txt -k supersecretpassword123
*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.┌──(sparks㉿LAPTOP-Sparks)-[/mnt/…/CTF/pico2022/Misc/Eavesdrop]
└─$ cat file.txt
picoCTF{nc_73115_411_aefc6100}

Operation Oni

先提取出.ssh 文件

加入到本地，尝试连接

┌──(sparks㉿LAPTOP-Sparks)-[~/.ssh]
└─$ ssh -i key_file -p 57455 ctf-player@saturn.picoctf.net
Warning: Identity file key_file not accessible: No such file or directory.
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions 0644 for '/home/sparks/.ssh/id_ed25519' are too open.
It is required that your private key files are NOT accessible by others.
This private key will be ignored.
Load key "/home/sparks/.ssh/id_ed25519": bad permissions
ctf-player@saturn.picoctf.net's password:

更改权限后再次尝试

┌──(sparks㉿LAPTOP-Sparks)-[~/.ssh]
└─$ sudo chmod 600 id_ed25519┌──(sparks㉿LAPTOP-Sparks)-[~/.ssh]
└─$ sudo chmod 600 id_ed25519.pub┌──(sparks㉿LAPTOP-Sparks)-[~/.ssh]
└─$ ssh -i key_file -p 57455 ctf-player@saturn.picoctf.net
Warning: Identity file key_file not accessible: No such file or directory.
Welcome to Ubuntu 20.04.3 LTS (GNU/Linux 5.13.0-1017-aws x86_64)* Documentation:  https://help.ubuntu.com* Management:     https://landscape.canonical.com* Support:        https://ubuntu.com/advantageThis system has been minimized by removing packages and content that are
not required on a system that users do not log into.To restore this content, you can run the 'unminimize' command.The programs included with the Ubuntu system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by
applicable law.ctf-player@challenge:~$ ll
-bash: ll: command not found
ctf-player@challenge:~$ ls
flag.txt
ctf-player@challenge:~$ cat flag.txt
picoCTF{k3y_5l3u7h_d6570e30}

补充一下 mnt 下的不能改权限

┌──(root㉿LAPTOP-Sparks)-[/mnt/…/pico2022/Misc/Operation Oni/已保存文件]
└─# sudo chmod 600 id_ed25519.pub┌──(root㉿LAPTOP-Sparks)-[/mnt/…/pico2022/Misc/Operation Oni/已保存文件]
└─# ll
total 0
-rwxrwxrwx 1 sparks sparks 111 Mar 27 22:02 id_ed25519.pub

-i 参数应该后面接私钥文件的，之前是歪打正着了

【picoCTF2022】Misc部分相关推荐

sun.misc.BASE64Encoder找不到jar包的解决方法
1.右键项目->属性->java bulid path->jre System Library->access rules->resolution选择accessible ...
python使用matplotlib可视化、使用matplotlib可视化scipy.misc图像、自定义使用grey灰色映射、将不同亮度映射到不同的色彩、并添加颜色标尺
python使用matplotlib可视化.使用matplotlib可视化scipy.misc图像.自定义使用grey灰色映射.将不同亮度映射到不同的色彩.并添加颜色标尺目录
python使用matplotlib可视化、使用matplotlib可视化scipy.misc图像、自定义使用RdYIBu色彩映射、将不同亮度映射到不同的色彩
python使用matplotlib可视化.使用matplotlib可视化scipy.misc图像.自定义使用RdYIBu色彩映射.将不同亮度映射到不同的色彩目录
python使用matplotlib可视化、使用matplotlib可视化scipy.misc图像、自定义使用winter色彩映射、将不同亮度映射到不同的色彩
python使用matplotlib可视化.使用matplotlib可视化scipy.misc图像.自定义使用winter色彩映射.将不同亮度映射到不同的色彩目录
python使用matplotlib可视化、使用matplotlib可视化scipy.misc图像、自定义使用Accent色彩映射、将不同亮度映射到不同的色彩
python使用matplotlib可视化.使用matplotlib可视化scipy.misc图像.自定义使用Accent色彩映射.将不同亮度映射到不同的色彩目录
不降低scipy版本解决AttributeError: module ‘scipy.misc‘ has no attribute ‘imresize‘问题
问题描述在Tensorflow2.1.0上运行代码出现 AttributeError: module 'scipy.misc' has no attribute 'imresize' 查阅资料大多都 ...
module 'scipy.misc' has no attribute 'imresize'
报错 module 'scipy.misc' has no attribute 'imresize' import scipy.misc scipy.misc.imresize(img, (im_he ...
sun.misc.BASE64Encoder在Eclipse中不能直接使用的原因和解决方案
1.为什么在Eclipse中不能直接使用sun.misc.BASE64Encoder和sun.misc.BASE64Decoder呢? 因为sun.misc.BASE64Encoder和sun.mis ...
openJDK之sun.misc.Unsafe类CAS底层实现
2019独角兽企业重金招聘Python工程师标准>>> 注:这篇文章参考了https://www.cnblogs.com/snowater/p/8303698.html,而后自己结合 ...

【picoCTF2022】Misc部分

Enhance!

File types

Lookey here

Packets Primer

Redaction gone wrong

Sleuthkit Intro

Sleuthkit Apprentice

Eavesdrop

Operation Oni

【picoCTF2022】Misc部分相关推荐

最新文章

热门文章