文章目錄

• 一、warmup
• 二、答題步驟
• • 1.下載附件
  • 2.ARCHPR
  • 3.盲水印
  • 4.得到圖片
• 總結(jié)

---

一、warmup

題目鏈接：https://adworld.xctf.org.cn/task/task_list?type=misc&number=1&grade=1&page=4

二、答題步驟

1.下載附件

拿到題目，發(fā)現(xiàn)有一個(gè)圖片和一個(gè)壓縮包，嘗試打開(kāi)壓縮包發(fā)現(xiàn)需要密碼，因此猜測(cè)圖片即為壓縮包的明文。

用WINRAR壓縮png圖片, 進(jìn)行兩個(gè)raar進(jìn)行明文crc驗(yàn)證，用WINRAR軟件打開(kāi)兩個(gè)文件對(duì)比cec32

發(fā)現(xiàn)crc32一樣可以進(jìn)行明文工具，因?yàn)榇颂幰褂肁RCHPR進(jìn)行壓縮包的破解工作

2.ARCHPR

使用ARCHPR進(jìn)行明文攻擊

Advanced Archive Password Recovery 統(tǒng)計(jì)信息: 加密的 ZIP/RAR/ACE/ARJ 文件: C:\Users\Administrator\Desktop\warmup_3D87119B1FD69603E77BA1292A007C4B.zip 總計(jì)口令: n/a 總計(jì)時(shí)間: 3m 32s 157ms 平均速度(口令/秒): n/a 這個(gè)文件的口令 : 未找到 加密密鑰: [ e43a642a 8e424cdb eb7c6331 ]

解密文件會(huì)出現(xiàn)在目錄下

3.盲水印

盲水印腳本bwm.py

#!/usr/bin/env python # -*- coding: utf8 -*-import sys import randomcmd = None debug = False seed = 20160930 oldseed = False alpha = 3.0if __name__ == '__main__':if '-h' in sys.argv or '--help' in sys.argv or len(sys.argv) < 2:print ('Usage: python bwm.py <cmd> [arg...] [opts...]')print (' cmds:')print (' encode <image> <watermark> <image(encoded)>')print (' image + watermark -> image(encoded)')print (' decode <image> <image(encoded)> <watermark>')print (' image + image(encoded) -> watermark')print (' opts:')print (' --debug, Show debug')print (' --seed <int>, Manual setting random seed (default is 20160930)')print (' --oldseed Use python2 random algorithm.')print (' --alpha <float>, Manual setting alpha (default is 3.0)')sys.exit(1)cmd = sys.argv[1]if cmd != 'encode' and cmd != 'decode':print ('Wrong cmd %s' % cmd)sys.exit(1)if '--debug' in sys.argv:debug = Truedel sys.argv[sys.argv.index('--debug')]if '--seed' in sys.argv:p = sys.argv.index('--seed')if len(sys.argv) <= p+1:print ('Missing <int> for --seed')sys.exit(1)seed = int(sys.argv[p+1])del sys.argv[p+1]del sys.argv[p]if '--oldseed' in sys.argv:oldseed = Truedel sys.argv[sys.argv.index('--oldseed')]if '--alpha' in sys.argv:p = sys.argv.index('--alpha')if len(sys.argv) <= p+1:print ('Missing <float> for --alpha')sys.exit(1)alpha = float(sys.argv[p+1])del sys.argv[p+1]del sys.argv[p]if len(sys.argv) < 5:print ('Missing arg...')sys.exit(1)fn1 = sys.argv[2]fn2 = sys.argv[3]fn3 = sys.argv[4]import cv2 import numpy as np import matplotlib.pyplot as plt# OpenCV是以(BGR)的順序存儲(chǔ)圖像數(shù)據(jù)的 # 而Matplotlib是以(RGB)的順序顯示圖像的 def bgr_to_rgb(img):b, g, r = cv2.split(img)return cv2.merge([r, g, b])if cmd == 'encode':print ('image<%s> + watermark<%s> -> image(encoded)<%s>' % (fn1, fn2, fn3))img = cv2.imread(fn1)wm = cv2.imread(fn2)if debug:plt.subplot(231), plt.imshow(bgr_to_rgb(img)), plt.title('image')plt.xticks([]), plt.yticks([])plt.subplot(234), plt.imshow(bgr_to_rgb(wm)), plt.title('watermark')plt.xticks([]), plt.yticks([])# print img.shape # 高, 寬, 通道h, w = img.shape[0], img.shape[1]hwm = np.zeros((int(h * 0.5), w, img.shape[2]))assert hwm.shape[0] > wm.shape[0]assert hwm.shape[1] > wm.shape[1]hwm2 = np.copy(hwm)for i in range(wm.shape[0]):for j in range(wm.shape[1]):hwm2[i][j] = wm[i][j]if oldseed: random.seed(seed,version=1)else: random.seed(seed)m, n = list(range(hwm.shape[0])), list(range(hwm.shape[1]))if oldseed:random.shuffle(m,random=random.random)random.shuffle(n,random=random.random)else:random.shuffle(m)random.shuffle(n)for i in range(hwm.shape[0]):for j in range(hwm.shape[1]):hwm[i][j] = hwm2[m[i]][n[j]]rwm = np.zeros(img.shape)for i in range(hwm.shape[0]):for j in range(hwm.shape[1]):rwm[i][j] = hwm[i][j]rwm[rwm.shape[0] - i - 1][rwm.shape[1] - j - 1] = hwm[i][j]if debug:plt.subplot(235), plt.imshow(bgr_to_rgb(rwm)), \plt.title('encrypted(watermark)')plt.xticks([]), plt.yticks([])f1 = np.fft.fft2(img)f2 = f1 + alpha * rwm_img = np.fft.ifft2(f2)if debug:plt.subplot(232), plt.imshow(bgr_to_rgb(np.real(f1))), \plt.title('fft(image)')plt.xticks([]), plt.yticks([])img_wm = np.real(_img)assert cv2.imwrite(fn3, img_wm, [int(cv2.IMWRITE_JPEG_QUALITY), 100])# 這里計(jì)算下保存前后的(溢出)誤差img_wm2 = cv2.imread(fn3)sum = 0for i in range(img_wm.shape[0]):for j in range(img_wm.shape[1]):for k in range(img_wm.shape[2]):sum += np.power(img_wm[i][j][k] - img_wm2[i][j][k], 2)miss = np.sqrt(sum) / (img_wm.shape[0] * img_wm.shape[1] * img_wm.shape[2]) * 100print ('Miss %s%% in save' % miss)if debug:plt.subplot(233), plt.imshow(bgr_to_rgb(np.uint8(img_wm))), \plt.title('image(encoded)')plt.xticks([]), plt.yticks([])f2 = np.fft.fft2(img_wm)rwm = (f2 - f1) / alpharwm = np.real(rwm)wm = np.zeros(rwm.shape)for i in range(int(rwm.shape[0] * 0.5)):for j in range(rwm.shape[1]):wm[m[i]][n[j]] = np.uint8(rwm[i][j])for i in range(int(rwm.shape[0] * 0.5)):for j in range(rwm.shape[1]):wm[rwm.shape[0] - i - 1][rwm.shape[1] - j - 1] = wm[i][j]if debug:assert cv2.imwrite('_bwm.debug.wm.jpg', wm)plt.subplot(236), plt.imshow(bgr_to_rgb(wm)), plt.title(u'watermark')plt.xticks([]), plt.yticks([])if debug:plt.show()elif cmd == 'decode':print ('image<%s> + image(encoded)<%s> -> watermark<%s>' % (fn1, fn2, fn3))img = cv2.imread(fn1)img_wm = cv2.imread(fn2)if debug:plt.subplot(231), plt.imshow(bgr_to_rgb(img)), plt.title('image')plt.xticks([]), plt.yticks([])plt.subplot(234), plt.imshow(bgr_to_rgb(img_wm)), plt.title('image(encoded)')plt.xticks([]), plt.yticks([])if oldseed: random.seed(seed,version=1)else: random.seed(seed)m, n = list(range(int(img.shape[0] * 0.5))), list(range(img.shape[1]))if oldseed:random.shuffle(m,random=random.random)random.shuffle(n,random=random.random)else:random.shuffle(m)random.shuffle(n)f1 = np.fft.fft2(img)f2 = np.fft.fft2(img_wm)if debug:plt.subplot(232), plt.imshow(bgr_to_rgb(np.real(f1))), \plt.title('fft(image)')plt.xticks([]), plt.yticks([])plt.subplot(235), plt.imshow(bgr_to_rgb(np.real(f1))), \plt.title('fft(image(encoded))')plt.xticks([]), plt.yticks([])rwm = (f2 - f1) / alpharwm = np.real(rwm)if debug:plt.subplot(233), plt.imshow(bgr_to_rgb(rwm)), \plt.title('encrypted(watermark)')plt.xticks([]), plt.yticks([])wm = np.zeros(rwm.shape)for i in range(int(rwm.shape[0] * 0.5)):for j in range(rwm.shape[1]):wm[m[i]][n[j]] = np.uint8(rwm[i][j])for i in range(int(rwm.shape[0] * 0.5)):for j in range(rwm.shape[1]):wm[rwm.shape[0] - i - 1][rwm.shape[1] - j - 1] = wm[i][j]assert cv2.imwrite(fn3, wm)if debug:plt.subplot(236), plt.imshow(bgr_to_rgb(wm)), plt.title(u'watermark')plt.xticks([]), plt.yticks([])if debug:plt.show()

保存requirements.txt文件

opencv-python==4.2.0.34 matplotlib==2.1.1

執(zhí)行命令安裝對(duì)應(yīng)包

pip install -r requirements.txt

提取圖中的盲水印

python3 bwm.py decode day1.png day2.png day3.png --oldseed

4.得到圖片

falg為：flag{bWm_Are_W0nderfu1}

總結(jié)

• 盲水印
• 明文攻擊
• crc32碰撞

總結(jié)

以上是生活随笔為你收集整理的【愚公系列】2022年01月 攻防世界-进阶题-MISC-76(warmup)的全部?jī)?nèi)容，希望文章能夠幫你解決所遇到的問(wèn)題。

如果覺(jué)得生活随笔網(wǎng)站內(nèi)容還不錯(cuò)，歡迎將生活随笔推薦給好友。