2024年蓝桥杯网安赛项部分wp

2024年蓝桥杯网安赛项部分wp

题目确实是偏简单,适合全站佬打/(ㄒoㄒ)/~~

packet

分析流量包,发现是flag是base64加密

解密即可

flag{7d6f17a4-2b0a-467d-8a42-66750368c249}

CC

用赛博厨子逆着求回去即可

flag{6500e76e-15fb-42e8-8f29-a309ab73ba38}

爬虫协议

直接访问robots.txt文件,得到关键目录/15b8a98d5daaa78e7b36f122581930a2/

成功访问

点进去查看文件即是flag

flag{5935303c-55a6-4d00-8675-f3422a53d456}

Theorem

签到题,工具秒解(这里应该是非预期了,n可以直接被分解)

flag{5f00e1b9-2933-42ad-b4e1-069f6aa98e9a}

缺失的数据

题目给了一个压缩包,内含一个压缩包以及一张图片

首先看下给的py代码

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
 

class WaterMarkDWT:
def __init__(self, origin: str, watermark: str, key: int, weight: list):
self.key = key
self.img = cv2.imread(origin)
self.mark = cv2.imread(watermark)
self.coef = weight


def arnold(self, img):
r, c = img.shape
p = np.zeros((r, c), np.uint8)

a, b = 1, 1
for k in range(self.key):
for i in range(r):
for j in range(c):
x = (i + b * j) % r
y = (a * i + (a * b + 1) * j) % c
p[x, y] = img[i, j]
return p

def deArnold(self, img):
r, c = img.shape
p = np.zeros((r, c), np.uint8)

a, b = 1, 1
for k in range(self.key):
for i in range(r):
for j in range(c):
x = ((a * b + 1) * i - b * j) % r
y = (-a * i + j) % c
p[x, y] = img[i, j]
return p



def get(self, size: tuple = (1200, 1200), flag: int = None):
img = cv2.resize(self.img, size)

img1 = cv2.cvtColor(img, cv2.COLOR_RGB2GRAY)
img2 = cv2.cvtColor(self.mark, cv2.COLOR_RGB2GRAY)

c = pywt.wavedec2(img2, 'db2', level=3)
[cl, (cH3, cV3, cD3), (cH2, cV2, cD2), (cH1, cV1, cD1)] = c

d = pywt.wavedec2(img1, 'db2', level=3)
[dl, (dH3, dV3, dD3), (dH2, dV2, dD2), (dH1, dV1, dD1)] = d

a1, a2, a3, a4 = self.coef

ca1 = (cl - dl) * a1
ch1 = (cH3 - dH3) * a2
cv1 = (cV3 - dV3) * a3
cd1 = (cD3 - dD3) * a4

waterImg = pywt.waverec2([ca1, (ch1, cv1, cd1)], 'db2')
waterImg = np.array(waterImg, np.uint8)

waterImg = self.deArnold(waterImg)

kernel = np.ones((3, 3), np.uint8)
if flag == 0:
waterImg = cv2.erode(waterImg, kernel)
elif flag == 1:
waterImg = cv2.dilate(waterImg, kernel)

cv2.imwrite('水印.png', waterImg)
return waterImg


if __name__ == '__main__':
img = 'a.png'
k = 20
xs = [0.2, 0.2, 0.5, 0.4]
W1 = WaterMarkDWT(img, waterImg, k, xs)

看得出来是利用了两张图片进行了一些操作,代码中的a.png我们在另外一个压缩包里发现,但是压缩包有密码

尝试解压只能解压出secret.txt文件,打开后是密码本

用该密码本对压缩包进行爆破,成功得到解压密码pavilion

成功打开压缩包得到图片

回到上述lose.py代码本身,直接运行会报错,尝试补全代码,代码中有加解密部分,直接调用解密部分即可

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
import cv2
import pywt
import xlrd
import numpy as np

class WaterMarkDWT:
def __init__(self, origin: str, watermark: str, key: int, weight: list):
self.key = key
self.img = cv2.imread(origin)
self.mark = cv2.imread(watermark)
self.coef = weight


def arnold(self, img):
r, c = img.shape
p = np.zeros((r, c), np.uint8)

a, b = 1, 1
for k in range(self.key):
for i in range(r):
for j in range(c):
x = (i + b * j) % r
y = (a * i + (a * b + 1) * j) % c
p[x, y] = img[i, j]
return p

def deArnold(self, img):
r, c = img.shape
p = np.zeros((r, c), np.uint8)

a, b = 1, 1
for k in range(self.key):
for i in range(r):
for j in range(c):
x = ((a * b + 1) * i - b * j) % r
y = (-a * i + j) % c
p[x, y] = img[i, j]
return p



def get(self, size: tuple = (1200, 1200), flag: int = None):
img = cv2.resize(self.img, size)

img1 = cv2.cvtColor(img, cv2.COLOR_RGB2GRAY)
img2 = cv2.cvtColor(self.mark, cv2.COLOR_RGB2GRAY)

c = pywt.wavedec2(img2, 'db2', level=3)
[cl, (cH3, cV3, cD3), (cH2, cV2, cD2), (cH1, cV1, cD1)] = c

d = pywt.wavedec2(img1, 'db2', level=3)
[dl, (dH3, dV3, dD3), (dH2, dV2, dD2), (dH1, dV1, dD1)] = d

a1, a2, a3, a4 = self.coef

ca1 = (cl - dl) * a1
ch1 = (cH3 - dH3) * a2
cv1 = (cV3 - dV3) * a3
cd1 = (cD3 - dD3) * a4

waterImg = pywt.waverec2([ca1, (ch1, cv1, cd1)], 'db2')
waterImg = np.array(waterImg, np.uint8)

waterImg = self.deArnold(waterImg)

kernel = np.ones((3, 3), np.uint8)
if flag == 0:
waterImg = cv2.erode(waterImg, kernel)
elif flag == 1:
waterImg = cv2.dilate(waterImg, kernel)

cv2.imwrite('水印.png', waterImg)
return waterImg


if __name__ == '__main__':
img = 'a.png'
waterImg='newImg.png'
k = 20
xs = [0.2, 0.2, 0.5, 0.4]
W1 = WaterMarkDWT(img, waterImg, k, xs)
W1.get()//调用解密部分

运行后生成带有flag 的图片


2024年蓝桥杯网安赛项部分wp
https://erkangkang.github.io/2024/04/27/2024年蓝桥杯网安赛项/
作者
尔康康康康
发布于
2024年4月27日
许可协议