39 |
--------------------------------------------------------------------------------
/Arnold/core/ImageCore.py:
--------------------------------------------------------------------------------
1 | import cv2
2 | import numpy as np
3 |
4 |
5 | def read_img(imgPath, flags, *agrs, **kwargs) -> np.ndarray:
6 | """相当于cv2.imread()
7 |
8 | Parameters
9 | ----------
10 | imgPath : str
11 | 图像的路径
12 |
13 | *args : flags
14 | cv2.imdecode 中的 flags 参数，用于指定读取的色彩空间。
15 |
16 | *args : tuple
17 | cv2.imdecode 中的参数，用于解码图像数据。
18 |
19 | **kwargs : dict
20 | cv2.imdecode 中的关键字参数，用于解码图像数据。
21 |
22 | Returns
23 | -------
24 | numpy.ndarray
25 | 读取的图像数据，如果读取失败则返回 None。
26 | """
27 | with open(imgPath, "rb") as f:
28 | encoded_image = np.frombuffer(f.read(), dtype=np.uint8)
29 | return cv2.imdecode(encoded_image, flags=flags, *agrs, **kwargs)
30 |
31 | def save_img(saveImgPath, img, ext, *args, **kwargs) -> bool:
32 | """相当于cv2.imwrite()
33 |
34 | Parameters
35 | ----------
36 | saveImgPath : str
37 | 要保存的图像路径。
38 |
39 | img : numpy.ndarray
40 | 要保存的图像数据。
41 |
42 | ext : str
43 | 要保存的图像格式后缀。
44 |
45 | *args : tuple
46 | cv2.imencode 中的参数，用于编码图像数据。
47 |
48 | **kwargs : dict
49 | cv2.imencode 中的关键字参数，用于编码图像数据。
50 |
51 | Returns
52 | -------
53 | bool
54 | 返回 True 表示保存成功，返回 False 表示保存失败。
55 | """
56 | success, encoded_image = cv2.imencode(img=img, ext=ext, *args, **kwargs)
57 | if success:
58 | with open(saveImgPath, "wb") as f:
59 | f.write(encoded_image)
60 | return success
--------------------------------------------------------------------------------
/Arnold/core/PathCore.py:
--------------------------------------------------------------------------------
1 | import os
2 | import shutil
3 | from typing import Tuple
4 |
5 |
6 | def get_baseDir():
7 | """获取当前工作目录。
8 |
9 | Returns
10 | -------
11 | str
12 | 当前工作目录的路径。
13 | """
14 | return os.getcwd()
15 |
16 | def get_save_info(filePath) -> Tuple[str, str, str]:
17 | """从文件路径中提取文件名、文件夹路径和保存文件夹路径。
18 |
19 | Parameters
20 | ----------
21 | filePath : str
22 | 要处理的文件路径。
23 |
24 | Returns
25 | -------
26 | Tuple[str, str, str]
27 | 一个包含三个元素的元组，分别是文件名前缀、文件名和保存文件夹路径。
28 | """
29 |
30 | fileDir = os.path.dirname(filePath)
31 | fileName = filePath.split('/')[-1]
32 | filePrefix, fileSuffix = os.path.splitext(fileName)
33 |
34 | if fileSuffix == "":
35 | saveDir = os.path.join(fileDir, f"{filePrefix}_BYXS20")
36 | else:
37 | saveDir = os.path.join(fileDir, filePrefix)
38 | return filePrefix, fileName, saveDir
39 |
40 | def clear_and_create_dir(saveDir):
41 | """删除指定的文件夹，并重新创建一个同名的空文件夹。如果指定的文件夹不存在，则不进行任何操作。
42 |
43 | Parameters
44 | ----------
45 | saveDir : str
46 | 要操作的文件夹路径。
47 | """
48 | if os.path.exists(saveDir):
49 | shutil.rmtree(saveDir, ignore_errors=True)
50 | os.makedirs(saveDir)
51 |
--------------------------------------------------------------------------------
/Arnold/core/__init__.py:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/yixinBC/CTF_Script/68c17c7f750cafbeb8a71cd6891d1bb1d2aaa2cd/Arnold/core/__init__.py
--------------------------------------------------------------------------------
/Arnold/demo/catcat_7_100_100.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/yixinBC/CTF_Script/68c17c7f750cafbeb8a71cd6891d1bb1d2aaa2cd/Arnold/demo/catcat_7_100_100.png
--------------------------------------------------------------------------------
/Arnold/demo/encode_1_31_13.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/yixinBC/CTF_Script/68c17c7f750cafbeb8a71cd6891d1bb1d2aaa2cd/Arnold/demo/encode_1_31_13.png
--------------------------------------------------------------------------------
/Arnold/demo/girlfriend_0x61_0x726e_0x6f6c64.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/yixinBC/CTF_Script/68c17c7f750cafbeb8a71cd6891d1bb1d2aaa2cd/Arnold/demo/girlfriend_0x61_0x726e_0x6f6c64.png
--------------------------------------------------------------------------------
/Arnold/demo/sictf2023_2_1_2.bmp:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/yixinBC/CTF_Script/68c17c7f750cafbeb8a71cd6891d1bb1d2aaa2cd/Arnold/demo/sictf2023_2_1_2.bmp
--------------------------------------------------------------------------------
/Arnold/images/image.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/yixinBC/CTF_Script/68c17c7f750cafbeb8a71cd6891d1bb1d2aaa2cd/Arnold/images/image.png
--------------------------------------------------------------------------------
/Arnold/r.bmp:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/yixinBC/CTF_Script/68c17c7f750cafbeb8a71cd6891d1bb1d2aaa2cd/Arnold/r.bmp
--------------------------------------------------------------------------------
/Arnold/test.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/yixinBC/CTF_Script/68c17c7f750cafbeb8a71cd6891d1bb1d2aaa2cd/Arnold/test.png
--------------------------------------------------------------------------------
/Arnold/test.py:
--------------------------------------------------------------------------------
1 | from PIL import Image
2 | import numpy as np
3 |
4 | def arnold(im_file, a, b):
5 | img = np.array(Image.open(im_file))
6 | height, width, color = img.shape
7 | res_img = np.zeros((height, width, color), dtype=int) # 横向变换，右移
8 | step = 0
9 | for j in range(height):
10 | if step == 0:
11 | res_img[j] = img[j]
12 | else:
13 | res_img[j, :step] = img[j, -step:]
14 | res_img[j, step:] = img[j, :-step]
15 | step = (step+a) % width
16 | img = res_img
17 | res_img = np.zeros((height, width, color), dtype=int) # 纵向变换，下移
18 | step = 0
19 | for i in range(width):
20 | if step == 0:
21 | res_img[:, i] = img[:, i]
22 | else:
23 | res_img[:step, i] = img[-step:, i]
24 | res_img[step:, i] = img[:-step, i]
25 | step = (step+b) % height
26 | # for i in range(width): #i -> y, j -> x
27 | # for j in range(height):
28 | # new_i = (i + a*j) % width
29 | # new_j = (j + b*new_i) % height
30 | # res_img[new_j, new_i] = img[j, i]
31 | Image.fromarray(np.uint8(res_img)).save('res_a{}_b{}.png'.format(a, b))
32 |
33 |
34 | arnold("./r.bmp", 301, 376)
--------------------------------------------------------------------------------
/BruteForceAES/AESTool.py:
--------------------------------------------------------------------------------
1 | import base64
2 | import hashlib
3 | from Crypto.Cipher import AES
4 | from Crypto.Util.Padding import unpad
5 |
6 |
7 | class AesCipher:
8 | def __init__(self, key, version):
9 | self.key = hashlib.md5(key).hexdigest()[:16].encode()
10 | self.version = version
11 |
12 | @staticmethod
13 | def decodeBase64(baseStr: str):
14 | return base64.b64decode(baseStr.encode())
15 |
16 | def decrypt(self, enc):
17 | if self.version == 4:
18 | cipher = AES.new(self.key, AES.MODE_ECB, use_aesni=True) # 启用AES-NI指令集的硬件加速
19 | elif self.version == 3:
20 | cipher = AES.new(self.key, AES.MODE_CBC, iv=b'\0' * 16, use_aesni=True) # 启用AES-NI指令集的硬件加速
21 | if (dec := self._unpad(cipher.decrypt(enc))):
22 | return dec
23 |
24 | # def checkSize(self, enc, dec):
25 | # return len(dec) + (16 - (len(dec)) % 16) == len(enc)
26 |
27 | def _unpad(self, s):
28 | try:
29 | return unpad(s, AES.block_size, style='pkcs7')
30 | except Exception:
31 | return None
32 |
33 | # def _unpad(self, s):
34 | # return s[:-ord(s[-1:])]
35 |
36 | if __name__ == '__main__':
37 | cipher_text = "qPm3sf5ED5vjWYAJhpDBu9LXU7LgIuNSXa1TLo+aWXjp9SpHbDQJqTuJXlaW2NWG"
38 | cipher_text = AesCipher.decodeBase64(cipher_text)
39 | print(AesCipher(b'hunting', version=4).decrypt(cipher_text))
40 |
--------------------------------------------------------------------------------
/BruteForceAES/BruteForceAES.py:
--------------------------------------------------------------------------------
1 | import os
2 | import mmap
3 | import queue
4 | import chardet
5 | import datetime
6 | import argparse
7 | import threading
8 | from AESTool import AesCipher
9 | from multiprocessing import cpu_count
10 |
11 |
12 | def read_large_file(file_path):
13 | # 使用mmap映射文件
14 | with open(file_path, "r+b") as f:
15 | with mmap.mmap(f.fileno(), 0, access=mmap.ACCESS_READ) as mm:
16 | while True:
17 | yield mm.readline().rstrip(b"\r\n")
18 | if mm.tell() == len(mm):
19 | break
20 |
21 | def producer(dic_path, queue, thread_num):
22 | for password in read_large_file(dic_path):
23 | queue.put(password)
24 |
25 | for _ in range(thread_num):
26 | queue.put(None)
27 |
28 | def consumer(queue_password, version):
29 | global enc, f
30 | while True:
31 | pwd = queue_password.get()
32 | if pwd is None:
33 | return
34 |
35 | aes = AesCipher(key=pwd, version=version)
36 | if (dec := aes.decrypt(enc)):
37 | if (result := chardet.detect(dec)) and result["encoding"] in ["GB2312", "UTF-16", "utf-8", "UTF-8-SIG", "ascii"] and result["confidence"] > 0.8:
38 | message = f"Find Password: {pwd.decode()}, AES key: {aes.key.decode()}, Message: {str(dec)}"
39 | print(message)
40 | f.write(message + "\n")
41 |
42 | if __name__ == '__main__':
43 | parser = argparse.ArgumentParser()
44 | parser.add_argument('-d', type=str, default=None, required=True,
45 | help='输入字典的文件名称')
46 | parser.add_argument('-v', type=int, default=3,
47 | help='输入冰蝎流量版本')
48 | parser.add_argument('-p', type=int, default=cpu_count(),
49 | help='输入多线程数')
50 | args = parser.parse_args()
51 |
52 | dic_path = os.path.abspath(args.d)
53 | thread_num = args.p
54 | version = args.v
55 |
56 | queue_password = queue.Queue()
57 | t = threading.Thread(target=producer, args=(dic_path, queue_password, thread_num))
58 | t.start()
59 |
60 | # enc = AesCipher.decodeBase64("TyXq0tb3mQYD6Ch0FMHJpgsBLOdQsSiFwdEtJEKUEwl4MMV404ZdswnxNWB966ma")
61 | formatted_date = datetime.datetime.now().strftime("%Y-%m-%d %H:%M:%S")
62 | print(f"[{formatted_date}] 开始爆破, 线程数: {thread_num}.")
63 |
64 | enc = AesCipher.decodeBase64("TyXq0tb3mQYD6Ch0FMHJpgsBLOdQsSiFwdEtJEKUEwlOR8AmpF7uChIfV+xwoxhT")
65 |
66 | with open("output.txt", "w", encoding='utf-8') as f:
67 | threads = []
68 | for _ in range(thread_num):
69 | t = threading.Thread(target=consumer, args=(queue_password, version))
70 | t.start()
71 | threads.append(t)
72 |
73 | for t in threads:
74 | t.join()
75 |
76 | formatted_date = datetime.datetime.now().strftime("%Y-%m-%d %H:%M:%S")
77 | print(f"[{formatted_date}] 爆破结束!")
78 |
--------------------------------------------------------------------------------
/BruteForceAES/BruteForceAES/BruteForceAES.go:
--------------------------------------------------------------------------------
1 | package main
2 |
3 | import (
4 | "bytes"
5 | "crypto/aes"
6 | "crypto/cipher"
7 | "encoding/base64"
8 | "fmt"
9 | )
10 |
11 | func encrypt(plaintext []byte, key []byte, iv []byte) ([]byte, error) {
12 | block, err := aes.NewCipher(key)
13 | if err != nil {
14 | return nil, err
15 | }
16 |
17 | ciphertext := make([]byte, len(plaintext))
18 | mode := cipher.NewCBCEncrypter(block, iv)
19 | mode.CryptBlocks(ciphertext, plaintext)
20 |
21 | return ciphertext, nil
22 | }
23 |
24 | func decrypt(ciphertext []byte, key []byte, iv []byte) ([]byte, error) {
25 | block, err := aes.NewCipher(key)
26 | if err != nil {
27 | return nil, err
28 | }
29 |
30 | plaintext := make([]byte, len(ciphertext))
31 | mode := cipher.NewCBCDecrypter(block, iv)
32 | mode.CryptBlocks(plaintext, ciphertext)
33 |
34 | return plaintext, nil
35 | }
36 |
37 | func pad(plaintext []byte) []byte {
38 | if len(plaintext)%aes.BlockSize == 0 {
39 | return plaintext
40 | }
41 | padding := aes.BlockSize - (len(plaintext) % aes.BlockSize)
42 | padtext := bytes.Repeat([]byte{byte(padding)}, padding)
43 | return append(plaintext, padtext...)
44 | }
45 |
46 | func unpad(padded []byte) []byte {
47 | if len(padded)%aes.BlockSize == 0 {
48 | return padded
49 | }
50 | padding := int(padded[len(padded)-1])
51 | return padded[:len(padded)-padding]
52 | }
53 |
54 | func main() {
55 | key := []byte("this_iskeykeykey")
56 | iv := []byte{0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}
57 |
58 | plaintext := []byte("hello world")
59 | plaintext = pad(plaintext)
60 |
61 | // 加密
62 | ciphertext, err := encrypt(plaintext, key, iv)
63 | if err != nil {
64 | panic(err)
65 | }
66 | fmt.Printf("加密结果：%s\n", base64.StdEncoding.EncodeToString(ciphertext))
67 |
68 | // 解密
69 | decrypted, err := decrypt(ciphertext, key, iv)
70 | if err != nil {
71 | panic(err)
72 | }
73 | fmt.Printf("解密结果：%s\n", unpad(decrypted))
74 | }
75 |
--------------------------------------------------------------------------------
/BruteForceAES/BruteForceAES/go.mod:
--------------------------------------------------------------------------------
1 | module BruteForceAES
2 |
3 | go 1.20
4 |
--------------------------------------------------------------------------------
/BruteForceAES/README.md:
--------------------------------------------------------------------------------
1 | # BruteForceAES
2 |
3 | ## Usage
4 |
5 | 1. 修改代码里面的 `enc` 参数为 `base64` 字符串
6 |
7 | ```
8 | Usage: $ python .\BruteForceAES.py -d 
31 |
32 |
--------------------------------------------------------------------------------
/FIX_BMP/channel/123.bmp:
--------------------------------------------------------------------------------
1 | BMF 6 (
2 |
--------------------------------------------------------------------------------
/FIX_BMP/channel/123.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/yixinBC/CTF_Script/68c17c7f750cafbeb8a71cd6891d1bb1d2aaa2cd/FIX_BMP/channel/123.png
--------------------------------------------------------------------------------
/FIX_BMP/channel/24.bmp:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/yixinBC/CTF_Script/68c17c7f750cafbeb8a71cd6891d1bb1d2aaa2cd/FIX_BMP/channel/24.bmp
--------------------------------------------------------------------------------
/FIX_BMP/channel/32.bmp:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/yixinBC/CTF_Script/68c17c7f750cafbeb8a71cd6891d1bb1d2aaa2cd/FIX_BMP/channel/32.bmp
--------------------------------------------------------------------------------
/FIX_BMP/channel/8.bmp:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/yixinBC/CTF_Script/68c17c7f750cafbeb8a71cd6891d1bb1d2aaa2cd/FIX_BMP/channel/8.bmp
--------------------------------------------------------------------------------
/FIX_BMP/channel/exp.py:
--------------------------------------------------------------------------------
1 | import cv2
2 | import numpy as np
3 |
4 |
5 | img = np.array([
6 | [[0, 1, 2], [3, 4, 5]],
7 | [[6, 7, 8], [9, 10, 11]]
8 | ], dtype=np.uint8)
9 |
10 |
11 | cv2.imwrite("123.bmp", img)
12 | cv2.imwrite("123.png", img)
--------------------------------------------------------------------------------
/FIX_BMP/demo/[HNCTF 2022 Week1]silly_zip.bmp:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/yixinBC/CTF_Script/68c17c7f750cafbeb8a71cd6891d1bb1d2aaa2cd/FIX_BMP/demo/[HNCTF 2022 Week1]silly_zip.bmp
--------------------------------------------------------------------------------
/FIX_BMP/demo/ctfshow_misc入门_misc31.bmp:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/yixinBC/CTF_Script/68c17c7f750cafbeb8a71cd6891d1bb1d2aaa2cd/FIX_BMP/demo/ctfshow_misc入门_misc31.bmp
--------------------------------------------------------------------------------
/FIX_BMP/demo/qsnctf_EzMisc.bmp:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/yixinBC/CTF_Script/68c17c7f750cafbeb8a71cd6891d1bb1d2aaa2cd/FIX_BMP/demo/qsnctf_EzMisc.bmp
--------------------------------------------------------------------------------
/FIX_BMP/images/image1.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/yixinBC/CTF_Script/68c17c7f750cafbeb8a71cd6891d1bb1d2aaa2cd/FIX_BMP/images/image1.png
--------------------------------------------------------------------------------
/FIX_BMP/main.py:
--------------------------------------------------------------------------------
1 | import os
2 | import time
3 | import math
4 | import argparse
5 |
6 |
7 | parser = argparse.ArgumentParser()
8 | parser.add_argument("-f", type=str, default=None, required=True,
9 | help="输入同级目录下图片的名称")
10 | args = parser.parse_args()
11 |
12 | SAVE_DIR = os.getcwd()
13 |
14 | def save_img(data, width=None, height=None, sqrt_num=None):
15 | with open(os.path.join(SAVE_DIR, "fix_width.bmp"), "wb") as f:
16 | f.write(data[:0x12] + width.to_bytes(4, byteorder="little", signed=False) + data[0x16:])
17 |
18 | with open(os.path.join(SAVE_DIR, "fix_height.bmp"), "wb") as f:
19 | f.write(data[:0x16] + height.to_bytes(4, byteorder="little", signed=False) + data[0x1a:])
20 |
21 | with open(os.path.join(SAVE_DIR, "fix_sqrt.bmp"), "wb") as f:
22 | f.write(data[:0x12] + sqrt_num.to_bytes(4, byteorder="little", signed=False) * 2 + data[0x1a:])
23 |
24 | def get_pixels_size(data):
25 | bfSize = int.from_bytes(data[0x2:0x2+4], byteorder="little", signed=False)
26 | bfOffBits = int.from_bytes(data[0xa:0xa+4], byteorder="little", signed=False)
27 | biBitCount = int.from_bytes(data[0x1c:0x1c+2], byteorder="little", signed=False)
28 | channel = biBitCount // 8
29 | # 由于宽高都会被修改，所以我计算出来的Padding_size也不是正确的，没有意义
30 | # padding_size = (4 - col * channel % 4) * row if col * channel % 4 != 0 else 0
31 | # pixels_size = (bfSize - bfOffBits - padding_size) // channel
32 | return (bfSize - bfOffBits) // channel
33 |
34 |
35 | if __name__ == '__main__':
36 | file_path = os.path.abspath(args.f)
37 | if os.path.splitext(args.f)[-1] != ".bmp":
38 | print("您的文件后缀名不为BMP!")
39 | time.sleep(1)
40 | exit(-1)
41 |
42 | with open(file_path, "rb") as f:
43 | data = f.read()
44 | col = abs(int.from_bytes(data[0x12:0x12+4], byteorder="little", signed=True))
45 | row = abs(int.from_bytes(data[0x16:0x16+4], byteorder="little", signed=True))
46 | pixels_size = get_pixels_size(data)
47 |
48 | width, height = pixels_size // row, pixels_size // col
49 | sqrt_num = int(math.sqrt((pixels_size)))
50 | save_img(data, width=width, height=height, sqrt_num=sqrt_num)
51 |
52 | print("温馨提示：由于填充字节的问题，所以可能会偏差几个像素!")
53 | print(f"1.修复宽度: {width}")
54 | print(f"2.修复高度: {height}")
55 | print(f"3.修复宽度高度为: {sqrt_num}")
56 | time.sleep(1)
--------------------------------------------------------------------------------
/FIX_BMP/padding/1.bmp:
--------------------------------------------------------------------------------
1 | BM> 6 ( % %
--------------------------------------------------------------------------------
/FIX_BMP/padding/100.bmp:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/yixinBC/CTF_Script/68c17c7f750cafbeb8a71cd6891d1bb1d2aaa2cd/FIX_BMP/padding/100.bmp
--------------------------------------------------------------------------------
/FIX_BMP/padding/150.bmp:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/yixinBC/CTF_Script/68c17c7f750cafbeb8a71cd6891d1bb1d2aaa2cd/FIX_BMP/padding/150.bmp
--------------------------------------------------------------------------------
/FIX_BMP/padding/2.bmp:
--------------------------------------------------------------------------------
1 | BMF 6 ( % %
--------------------------------------------------------------------------------
/FIX_BMP/padding/3.bmp:
--------------------------------------------------------------------------------
1 | BMN 6 ( % %
--------------------------------------------------------------------------------
/FIX_BMP/padding/4.bmp:
--------------------------------------------------------------------------------
1 | BMN 6 ( % %
--------------------------------------------------------------------------------
/FIX_JPG/demo/1.jpg:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/yixinBC/CTF_Script/68c17c7f750cafbeb8a71cd6891d1bb1d2aaa2cd/FIX_JPG/demo/1.jpg
--------------------------------------------------------------------------------
/FIX_JPG/demo/compass.jpg:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/yixinBC/CTF_Script/68c17c7f750cafbeb8a71cd6891d1bb1d2aaa2cd/FIX_JPG/demo/compass.jpg
--------------------------------------------------------------------------------
/FIX_JPG/main.py:
--------------------------------------------------------------------------------
1 | import os
2 | import time
3 | import argparse
4 |
5 |
6 | parser = argparse.ArgumentParser()
7 | parser.add_argument("-f", type=str, default=None, required=True,
8 | help="输入同级目录下图片的名称")
9 | parser.add_argument("-n", type=int, default=2, required=False,
10 | help="输入放大的倍数 (默认: 2倍)")
11 | args = parser.parse_args()
12 |
13 |
14 | if __name__ == '__main__':
15 | filePath = os.path.abspath(args.f)
16 | shfflePath, ext = os.path.splitext(filePath)
17 | shffleName = shfflePath.split("\\")[-1]
18 |
19 | with open(filePath, "rb") as f:
20 | data = f.read()
21 |
22 | if (index := data.rfind(b"\xff\xc0\x00\x11\x08")) == -1:
23 | print("没有找到SOFx层!")
24 | time.sleep(0.5)
25 | exit(-1)
26 |
27 | index += 5
28 | height = int.from_bytes(data[index:index+2], byteorder="big", signed=False) * args.n
29 |
30 | out_data = data[:index] + height.to_bytes(2, byteorder="big", signed=False) + data[index+2:]
31 | with open("fix_1.jpg", "wb") as f:
32 | f.write(out_data)
33 | print(f"图像高度已经修改为了{args.n}倍!")
34 | time.sleep(0.5)
35 |
36 |
--------------------------------------------------------------------------------
/FIX_PNG/BruteForceCrack.py:
--------------------------------------------------------------------------------
1 | import os
2 | import zlib
3 | import struct
4 |
5 | # 老铜匠
6 | def crack_no_inter(bt_ch, width, data, tmppath, chuncks):
7 | interlace = b'\x00' # 首先考虑逐行扫描的情况
8 | for i in bt_ch:
9 | # print('当前处理的值是：{}'.format(i))
10 | for w in range(width):
11 | colortype = i[0]
12 | colorchannel = i[1]
13 | bits = i[2]
14 | scanline = bits * colorchannel * w // 8 + 1
15 | if len(data) % scanline == 0:
16 | data1 = list(data[::(bits * colorchannel * w // 8 + 1)])
17 |
18 | if set(data1).issubset(b'\x00\x01\x02\x03\x04') and len(data1) != 1: # 如果每片的头部合集都在，0,1,2,3,4以内，就说明切片可能正确，得到宽度
19 |
20 | # print(w, len(data1), colortype, ':', colorchannel, ':', bits)
21 | head = b'\x89\x50\x4e\x47\x0d\x0a\x1a\x0a\x00\x00\x00\x0d\x49\x48\x44\x52' + \
22 | w.to_bytes(4,'big') + len(data1).to_bytes(4, 'big') + \
23 | bits.to_bytes(1, 'big') + colortype.to_bytes(1,'big') + b'\x00\x00' + interlace
24 | headcrc = zlib.crc32(head[12:])
25 | head = head + headcrc.to_bytes(4, 'big')
26 | print(f"[-] 宽度: {w}, hex: {hex(w)}")
27 | print(f"[-] 高度: {len(data1)}, hex: {hex(len(data1))}\n")
28 | with open(f"{tmppath}{w}X{len(data1)}_{colortype}_{colorchannel}_{bits}.png", 'wb') as fw:
29 | fw.write(head + b''.join(chuncks))
30 | elif len(data1) == 1:
31 | break
32 | # print('逐行扫描完成，请在output目录下查看是否有正常显示的图片，下面开始隔行扫描，先考虑常见的色彩模式(非灰度)，分辨率在2000x2000以内')
33 |
34 | def pngbaoli_def(filename):
35 | file = filename
36 | fr = open(file, 'rb').read()
37 | tmppath = './output/'
38 | if not os.path.exists(tmppath):
39 | os.mkdir(tmppath)
40 | # print(tmppath)
41 | chunckid = [b'IHDR', b'PLTE', b'IDAT', b'IEND', b'cHRM', b'gAMA', b'iCCP', b'sBIT', b'sRGB',
42 | b'bKGD', b'hIST', b'tRNS', b'pHYs', b'sPLT', b'tIME', b'iTXt', b'tEXt', b'zTXt']
43 | chuncks = []
44 | i = 4
45 | while i < len(fr):
46 | if fr[i:i + 4] in chunckid:
47 | try:
48 | datalen, dataname = struct.unpack(">I4s", fr[i - 4:i + 4])
49 | dataformat = f'>I4s{str(datalen)}s4s'
50 | datalen, dataname, data, datacrc = struct.unpack(dataformat, fr[i - 4:i - 4 + 8 + datalen + 4])
51 | realcrc = zlib.crc32(dataname + data).to_bytes(4, 'big')
52 | if realcrc != datacrc:
53 | datacrc = realcrc
54 | # print(dataname, 'crc32 fixed')
55 | # print(datalen, bytes.decode(dataname, encoding='utf-8'), hex(int.from_bytes(datacrc, 'big')))
56 | chuncks.append(fr[i - 4:i - 4 + 8 + datalen] + realcrc)
57 | i = i + 8 + datalen + 4 # 最少加一，防止出现iend
58 | except Exception:
59 | # 防止不能解析的结构体中出现png chunckid的关键字，指针直接指向下一个。
60 | i += 1
61 | continue
62 | else:
63 | i += 1
64 |
65 | for chk in chuncks: # 直接丢弃IHDR头部
66 | if chk[4:8] == b'IHDR':
67 | chuncks.remove(chk)
68 |
69 | blocks = [tmp[8:int.from_bytes(tmp[:4], 'big') + 8] for tmp in chuncks if tmp[4:8] == b'IDAT']
70 | blocks = b''.join(blocks) # 组合数据
71 | data = zlib.decompressobj().decompress(blocks) # 解码zlib得到像素（含filter）
72 | bt_ch_my = [(2, 3, 8)] # 比较常用的2,3,8
73 | crack_no_inter(bt_ch_my, 10001, data, tmppath, chuncks)
74 | bt_ch_my = [(6, 4, 8)] # 比较常用的6,4,8
75 | crack_no_inter(bt_ch_my, 10001, data, tmppath, chuncks)
--------------------------------------------------------------------------------
/FIX_PNG/BrutePNG/BrutePNG.exe:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/yixinBC/CTF_Script/68c17c7f750cafbeb8a71cd6891d1bb1d2aaa2cd/FIX_PNG/BrutePNG/BrutePNG.exe
--------------------------------------------------------------------------------
/FIX_PNG/BrutePNG/demo/height.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/yixinBC/CTF_Script/68c17c7f750cafbeb8a71cd6891d1bb1d2aaa2cd/FIX_PNG/BrutePNG/demo/height.png
--------------------------------------------------------------------------------
/FIX_PNG/BrutePNG/demo/snake2.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/yixinBC/CTF_Script/68c17c7f750cafbeb8a71cd6891d1bb1d2aaa2cd/FIX_PNG/BrutePNG/demo/snake2.png
--------------------------------------------------------------------------------
/FIX_PNG/BrutePNG/demo/test.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/yixinBC/CTF_Script/68c17c7f750cafbeb8a71cd6891d1bb1d2aaa2cd/FIX_PNG/BrutePNG/demo/test.png
--------------------------------------------------------------------------------
/FIX_PNG/BrutePNG/demo/width.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/yixinBC/CTF_Script/68c17c7f750cafbeb8a71cd6891d1bb1d2aaa2cd/FIX_PNG/BrutePNG/demo/width.png
--------------------------------------------------------------------------------
/FIX_PNG/BrutePNG/demo/width_height.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/yixinBC/CTF_Script/68c17c7f750cafbeb8a71cd6891d1bb1d2aaa2cd/FIX_PNG/BrutePNG/demo/width_height.png
--------------------------------------------------------------------------------
/FIX_PNG/BrutePNG/go.mod:
--------------------------------------------------------------------------------
1 | module BrutePNG
2 |
3 | go 1.20
4 |
--------------------------------------------------------------------------------
/FIX_PNG/README.md:
--------------------------------------------------------------------------------
1 | # FIX_PNG
2 |
3 | **关于项目：**
4 |
5 | - 一部分是来自于铜匠师傅的代码
6 | - 目前分为2种方式，如果crc32出错，就会遍历宽高爆破crc32相同的宽高；另一种情况是如果crc32相同会自动尝试铜匠师傅的代码（根据IDAT层的数据暴力爆破宽高）
7 |
8 | 
35 |
36 | **暴力爆破：**
37 |
38 | 
39 |
40 | 
51 |
--------------------------------------------------------------------------------
/FIX_PNG/demo.py:
--------------------------------------------------------------------------------
1 | import os, zlib, struct
2 |
3 |
4 | # 老铜匠
5 | def crack_no_inter(bt_ch, width, data, tmppath, chuncks):
6 | interlace = b'\x00' # 首先考虑逐行扫描的情况
7 | for i in bt_ch:
8 | # print('当前处理的值是：{}'.format(i))
9 | for w in range(width):
10 | colortype = i[0]
11 | colorchannel = i[1]
12 | bits = i[2]
13 | scanline = bits * colorchannel * w // 8 + 1
14 | if len(data) % scanline == 0:
15 | data1 = list(data[::(bits * colorchannel * w // 8 + 1)])
16 |
17 | if set(data1).issubset(b'\x00\x01\x02\x03\x04') and len(data1) != 1: # 如果每片的头部合集都在，0,1,2,3,4以内，就说明切片可能正确，得到宽度
18 |
19 | # print(w, len(data1), colortype, ':', colorchannel, ':', bits)
20 | head = b'\x89\x50\x4e\x47\x0d\x0a\x1a\x0a\x00\x00\x00\x0d\x49\x48\x44\x52' + \
21 | w.to_bytes(4,'big') + len(data1).to_bytes(4, 'big') + \
22 | bits.to_bytes(1, 'big') + colortype.to_bytes(1,'big') + b'\x00\x00' + interlace
23 | headcrc = zlib.crc32(head[12:])
24 | head = head + headcrc.to_bytes(4, 'big')
25 | with open(tmppath + str(w) + 'X' + str(len(data1)) + '_' + str(colortype) + '_' + str(
26 | colorchannel) + '_' + str(bits) + '.png', 'wb') as fw:
27 | fw.write(head + b''.join(chuncks))
28 | elif len(data1) == 1:
29 | break
30 | # print('逐行扫描完成，请在output目录下查看是否有正常显示的图片，下面开始隔行扫描，先考虑常见的色彩模式(非灰度)，分辨率在2000x2000以内')
31 |
32 | def pngbaoli_def(filename):
33 | file = filename
34 | fr = open(file, 'rb').read()
35 | tmppath = './output/'
36 | if not os.path.exists(tmppath):
37 | os.mkdir(tmppath)
38 | # print(tmppath)
39 | chunckid = [b'IHDR', b'PLTE', b'IDAT', b'IEND', b'cHRM', b'gAMA', b'iCCP', b'sBIT', b'sRGB',
40 | b'bKGD', b'hIST', b'tRNS', b'pHYs', b'sPLT', b'tIME', b'iTXt', b'tEXt', b'zTXt']
41 | chuncks = []
42 | i = 4
43 | while i < len(fr):
44 | if fr[i:i + 4] in chunckid:
45 | try:
46 | datalen, dataname = struct.unpack(">I4s", fr[i - 4:i + 4])
47 | dataformat = f'>I4s{str(datalen)}s4s'
48 | datalen, dataname, data, datacrc = struct.unpack(dataformat, fr[i - 4:i - 4 + 8 + datalen + 4])
49 | realcrc = zlib.crc32(dataname + data).to_bytes(4, 'big')
50 | if realcrc != datacrc:
51 | datacrc = realcrc
52 | # print(dataname, 'crc32 fixed')
53 | # print(datalen, bytes.decode(dataname, encoding='utf-8'), hex(int.from_bytes(datacrc, 'big')))
54 | chuncks.append(fr[i - 4:i - 4 + 8 + datalen] + realcrc)
55 | i = i + 8 + datalen + 4 # 最少加一，防止出现iend
56 | except Exception:
57 | # 防止不能解析的结构体中出现png chunckid的关键字，指针直接指向下一个。
58 | i += 1
59 | continue
60 | else:
61 | i += 1
62 |
63 | for chk in chuncks: # 直接丢弃IHDR头部
64 | if chk[4:8] == b'IHDR':
65 | chuncks.remove(chk)
66 |
67 | blocks = [tmp[8:int.from_bytes(tmp[:4], 'big') + 8] for tmp in chuncks if tmp[4:8] == b'IDAT']
68 | blocks = b''.join(blocks) # 组合数据
69 | data = zlib.decompressobj().decompress(blocks) # 解码zlib得到像素（含filter）
70 | bt_ch_my = [(2, 3, 8)] # 比较常用的2,3,8
71 | crack_no_inter(bt_ch_my, 10001, data, tmppath, chuncks)
72 | bt_ch_my = [(6, 4, 8)] # 比较常用的6,4,8
73 | crack_no_inter(bt_ch_my, 10001, data, tmppath, chuncks)
74 |
75 |
76 | pngbaoli_def("./demo/rabbit.png")
--------------------------------------------------------------------------------
/FIX_PNG/demo/暴力爆破/rabbit.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/yixinBC/CTF_Script/68c17c7f750cafbeb8a71cd6891d1bb1d2aaa2cd/FIX_PNG/demo/暴力爆破/rabbit.png
--------------------------------------------------------------------------------
/FIX_PNG/demo/正常爆破/height.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/yixinBC/CTF_Script/68c17c7f750cafbeb8a71cd6891d1bb1d2aaa2cd/FIX_PNG/demo/正常爆破/height.png
--------------------------------------------------------------------------------
/FIX_PNG/demo/正常爆破/snake2.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/yixinBC/CTF_Script/68c17c7f750cafbeb8a71cd6891d1bb1d2aaa2cd/FIX_PNG/demo/正常爆破/snake2.png
--------------------------------------------------------------------------------
/FIX_PNG/demo/正常爆破/test.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/yixinBC/CTF_Script/68c17c7f750cafbeb8a71cd6891d1bb1d2aaa2cd/FIX_PNG/demo/正常爆破/test.png
--------------------------------------------------------------------------------
/FIX_PNG/demo/正常爆破/width.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/yixinBC/CTF_Script/68c17c7f750cafbeb8a71cd6891d1bb1d2aaa2cd/FIX_PNG/demo/正常爆破/width.png
--------------------------------------------------------------------------------
/FIX_PNG/demo/正常爆破/width_height.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/yixinBC/CTF_Script/68c17c7f750cafbeb8a71cd6891d1bb1d2aaa2cd/FIX_PNG/demo/正常爆破/width_height.png
--------------------------------------------------------------------------------
/FIX_PNG/images/go.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/yixinBC/CTF_Script/68c17c7f750cafbeb8a71cd6891d1bb1d2aaa2cd/FIX_PNG/images/go.png
--------------------------------------------------------------------------------
/FIX_PNG/images/image2.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/yixinBC/CTF_Script/68c17c7f750cafbeb8a71cd6891d1bb1d2aaa2cd/FIX_PNG/images/image2.png
--------------------------------------------------------------------------------
/FIX_PNG/images/python&go.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/yixinBC/CTF_Script/68c17c7f750cafbeb8a71cd6891d1bb1d2aaa2cd/FIX_PNG/images/python&go.png
--------------------------------------------------------------------------------
/FIX_PNG/images/python.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/yixinBC/CTF_Script/68c17c7f750cafbeb8a71cd6891d1bb1d2aaa2cd/FIX_PNG/images/python.png
--------------------------------------------------------------------------------
/FIX_PNG/main.py:
--------------------------------------------------------------------------------
1 | import os
2 | import zlib
3 | import time
4 | import argparse
5 | import subprocess
6 | import BruteForceCrack
7 |
8 |
9 | parser = argparse.ArgumentParser()
10 | parser.add_argument("-f", type=str, default=None, required=True,
11 | help="输入同级目录下图片的名称")
12 | args = parser.parse_args()
13 |
14 | PNG_NAME = args.f.split("\\")[-1]
15 | PNG_DIR = os.path.abspath(args.f)
16 | BASE_DIR = os.path.dirname(os.path.abspath(__file__))
17 |
18 | # import struct, datetime, itertools
19 |
20 | # def calculation_crc32(width, height):
21 | # return zlib.crc32(data[12:16] + struct.pack('>i', width) + struct.pack('>i', height) + data[24:29])
22 |
23 | # def save_png(width, height):
24 | # with open(os.path.join(BASE_DIR, f"fix_{PNG_NAME}"), "wb") as f:
25 | # end = datetime.datetime.now()
26 | # duration = end - start
27 | # hours, remainder = divmod(duration.seconds, 3600)
28 | # minutes, seconds = divmod(remainder, 60)
29 | # milliseconds = duration.microseconds // 1000
30 | # print(f"[-] 宽度: {width}, hex: {hex(width)}")
31 | # print(f"[-] 高度: {height}, hex: {hex(height)}")
32 | # print(f"[-] 运行时间为：{hours}小时 {minutes}分钟 {seconds}秒 {milliseconds}毫秒")
33 | # print(f"[-] CRC32: {hex(original_crc32)}, 已经为您保存到运行目录中!")
34 | # f.write(data[:16] + struct.pack(">i", width) + struct.pack(">i", height) + data[24:])
35 | # time.sleep(1)
36 | # exit()
37 |
38 | if __name__ == '__main__':
39 | data = open(PNG_DIR, 'rb').read()
40 | crc32key = zlib.crc32(data[12:29]) # 计算crc
41 | original_width, original_height = int.from_bytes(data[0x10:0x10+4], byteorder="big", signed=False), int.from_bytes(data[0x14:0x14+4], byteorder="big", signed=False)
42 | original_crc32 = int(data[29:33].hex(), 16) # 原始crc
43 |
44 | if os.path.splitext(PNG_NAME)[1] != ".png":
45 | print("[-] 您的文件后缀名不为PNG!")
46 | time.sleep(1)
47 | exit(-1)
48 |
49 | if crc32key == original_crc32: # 计算crc对比原始crc
50 | print("[-] 计算CRC32, 宽高没有问题, 开始尝试暴力破解!(感谢老铜匠)")
51 | BruteForceCrack.pngbaoli_def(args.f)
52 | else:
53 | executablePath = os.path.join(BASE_DIR, "BrutePNG", "BrutePNG.exe")
54 | result = subprocess.run([f"{executablePath}", f"{PNG_DIR}"], capture_output=True)
55 | output = result.stdout.decode("utf-8")
56 | print(output)
57 |
58 | time.sleep(1)
59 | exit(0)
60 |
61 | # start = datetime.datetime.now()
62 | # print("[-] 爆破高度中...")
63 | # for height in range(0x1FFF):
64 | # if calculation_crc32(original_width, height) == original_crc32:
65 | # save_png(original_width, height)
66 |
67 | # print("[-] 爆破宽度中...")
68 | # for width in range(0x1FFF):
69 | # if calculation_crc32(width, original_height) == original_crc32:
70 | # save_png(width, original_height)
71 |
72 | # print("[-] 爆破宽度和高度中...")
73 | # for width, height in itertools.product(range(0x1FFF), range(0x1FFF)): # 理论上0x FF FF FF FF，但考虑到屏幕实际/cpu，0x1FFF就差不多了，也就是8191宽度和高度
74 | # if calculation_crc32(width, height) == original_crc32: # 计算当图片大小为width:height时的CRC校验值，与图片中的CRC比较，当相同，则图片大小已经确定
75 | # save_png(width, height)
76 |
--------------------------------------------------------------------------------
/FIX_RAR/demo/b64.png.rar:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/yixinBC/CTF_Script/68c17c7f750cafbeb8a71cd6891d1bb1d2aaa2cd/FIX_RAR/demo/b64.png.rar
--------------------------------------------------------------------------------
/FIX_RAR/demo/fix_flag.rar:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/yixinBC/CTF_Script/68c17c7f750cafbeb8a71cd6891d1bb1d2aaa2cd/FIX_RAR/demo/fix_flag.rar
--------------------------------------------------------------------------------
/FIX_RAR/demo/flag.rar:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/yixinBC/CTF_Script/68c17c7f750cafbeb8a71cd6891d1bb1d2aaa2cd/FIX_RAR/demo/flag.rar
--------------------------------------------------------------------------------
/FIX_RAR/demo/好像是伪加密-2/fix_flag.rar:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/yixinBC/CTF_Script/68c17c7f750cafbeb8a71cd6891d1bb1d2aaa2cd/FIX_RAR/demo/好像是伪加密-2/fix_flag.rar
--------------------------------------------------------------------------------
/FIX_RAR/demo/好像是伪加密-2/flag.rar:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/yixinBC/CTF_Script/68c17c7f750cafbeb8a71cd6891d1bb1d2aaa2cd/FIX_RAR/demo/好像是伪加密-2/flag.rar
--------------------------------------------------------------------------------
/FIX_RAR/demo/好像是伪加密-2/好像是伪加密-2.zip:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/yixinBC/CTF_Script/68c17c7f750cafbeb8a71cd6891d1bb1d2aaa2cd/FIX_RAR/demo/好像是伪加密-2/好像是伪加密-2.zip
--------------------------------------------------------------------------------
/FIX_RAR/demo/我是另一道签到题.rar:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/yixinBC/CTF_Script/68c17c7f750cafbeb8a71cd6891d1bb1d2aaa2cd/FIX_RAR/demo/我是另一道签到题.rar
--------------------------------------------------------------------------------
/FIX_RAR/main.py:
--------------------------------------------------------------------------------
1 | import os
2 | import time
3 | import argparse
4 |
5 |
6 | parser = argparse.ArgumentParser()
7 | parser.add_argument('-f', type=str, default=None, required=True,
8 | help='输入RAR文件路径')
9 | args = parser.parse_args()
10 |
11 | RarBlockType = {
12 | 114: "MARKER",
13 | 115: "ARCHIVE",
14 | 116: "FILE_OR_DIR",
15 | 117: "COMMENT_OLD",
16 | 118: "AV_OLD_1",
17 | 119: "SUBBLOCK_OLD",
18 | 120: "RR_OLD",
19 | 121: "AV_OLD_2",
20 | 122: "SUBBLOCK",
21 | 123: "_END_"
22 | }
23 |
24 | RarHead = bytes.fromhex("52 61 72 21 1A 07 00".replace(" ", ""))
25 | RarTail = bytes.fromhex("C4 3D 7B 00 40 07 00".replace(" ", ""))
26 |
27 | def repair(pos, answer, FileName=None):
28 | output = f"[+] 字节地址: {pos}, "
29 | rarBlockType = data[pos]
30 |
31 | if not FileName:
32 | if rarBlockType == answer:
33 | output += f"{RarBlockType[answer]} 结构正确!"
34 | else:
35 | data[pos] = answer
36 | output += f"修复前: {RarBlockType[rarBlockType]}, 修复后: {RarBlockType[answer]}"
37 | else:
38 | if rarBlockType == answer:
39 | output += f"文件名: {bytes(FileName)}, {RarBlockType[answer]} 结构正确, "
40 | else:
41 | data[pos] = answer
42 | output += f"文件名: {bytes(FileName)}, 修复前: {RarBlockType[rarBlockType]}, 修复后: {RarBlockType[answer]}, "
43 |
44 | # 判断是否为伪加密
45 | FileHeadFlags_Pos = pos + 1
46 | if data[FileHeadFlags_Pos] >> 2 & 1:
47 | data[FileHeadFlags_Pos] = data[FileHeadFlags_Pos] & 0b11111011
48 | output = f"{output}可能存在伪加密已经修复!"
49 | else:
50 | output = f"{output}不存在伪加密!"
51 | print(output)
52 | if __name__ == '__main__':
53 | filePath = os.path.abspath(args.f)
54 | baseDir = os.path.dirname(filePath)
55 | fileSuffix, ext = os.path.splitext(filePath)
56 | fileName = fileSuffix.split("\\")[-1]
57 |
58 | with open(filePath, "rb") as f:
59 | data = bytearray(f.read())
60 |
61 | if data[:7] == RarHead:
62 | print("[+] Rar文件头正确!")
63 | else:
64 | data[:7] = RarHead
65 | print("[-] Rar文件头修复完毕!")
66 |
67 | repair(0x9, 115)
68 |
69 | count = 1
70 | crc_Pos = 0x14
71 | while crc_Pos < len(data):
72 | RarBlockType_Pos = crc_Pos + 2
73 | FileHeadFlags_Pos = RarBlockType_Pos + 1
74 |
75 | if data[crc_Pos:crc_Pos+7] == RarTail:
76 | repair(RarBlockType_Pos, 123)
77 | break
78 |
79 | # 处理reverse字段的存在
80 | if not RarBlockType.get(data[RarBlockType_Pos]):
81 | RarBlockType_Pos = RarBlockType_Pos - 5
82 |
83 | # 获取文件大小
84 | RawDataSize_Pos = RarBlockType_Pos + 5
85 | File_RawDataSize = int.from_bytes(data[RawDataSize_Pos:RawDataSize_Pos+4], byteorder="little", signed=False)
86 |
87 | # 获取文件名长度
88 | NameSize_Pos = RawDataSize_Pos + 0x13
89 | File_NameSize = int.from_bytes(data[NameSize_Pos:NameSize_Pos+2], byteorder="little", signed=False)
90 |
91 | # 获取文件名
92 | FileName_Pos = NameSize_Pos + 6
93 | FileName = data[FileName_Pos:FileName_Pos+File_NameSize]
94 | repair(RarBlockType_Pos, 116, FileName)
95 |
96 | crc_Pos = FileName_Pos + File_NameSize + 5 + File_RawDataSize
97 | count += 1
98 |
99 | saveFileName = os.path.join(baseDir, f"fix_{fileName}{ext}")
100 | with open(saveFileName, "wb") as f:
101 | f.write(data)
102 | print("[+] 修复完毕, 已经为您保存至同级目录中, 切记使用WinRar打开!(该软件对Rar格式支持性较好)")
103 |
104 | time.sleep(0.5)
--------------------------------------------------------------------------------
/Get_Pixels/demo/__cat.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/yixinBC/CTF_Script/68c17c7f750cafbeb8a71cd6891d1bb1d2aaa2cd/Get_Pixels/demo/__cat.png
--------------------------------------------------------------------------------
/Get_Pixels/demo/_cat.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/yixinBC/CTF_Script/68c17c7f750cafbeb8a71cd6891d1bb1d2aaa2cd/Get_Pixels/demo/_cat.png
--------------------------------------------------------------------------------
/Get_Pixels/demo/cat.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/yixinBC/CTF_Script/68c17c7f750cafbeb8a71cd6891d1bb1d2aaa2cd/Get_Pixels/demo/cat.png
--------------------------------------------------------------------------------
/Get_Pixels/demo/flag.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/yixinBC/CTF_Script/68c17c7f750cafbeb8a71cd6891d1bb1d2aaa2cd/Get_Pixels/demo/flag.png
--------------------------------------------------------------------------------
/Get_Pixels/demo/img.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/yixinBC/CTF_Script/68c17c7f750cafbeb8a71cd6891d1bb1d2aaa2cd/Get_Pixels/demo/img.png
--------------------------------------------------------------------------------
/Get_Pixels/main.py:
--------------------------------------------------------------------------------
1 | import os
2 | import re
3 | import cv2
4 | import argparse
5 | import itertools
6 | import numpy as np
7 |
8 |
9 | parser = argparse.ArgumentParser()
10 | parser.add_argument('-f', type=str, default=None, required=True,
11 | help='输入文件名称')
12 | parser.add_argument('-p', type=str, default=None, required=True,
13 | help='输入左上顶点和右下顶点坐标 (如:-p 220x344+3520x2150)')
14 | parser.add_argument('-n', type=str, default=None, required=True,
15 | help='输入宽度间隔和高度间隔 (如:-n 44x86)')
16 | parser.add_argument('-size', type=str, default='1x1', required=False,
17 | help='输入截取图像的大小 (如:-size 7x7)')
18 | parser.add_argument('-resize', type=int, default=1, required=False,
19 | help='输入截取图像放大倍数 (如:-resize 1)')
20 | args = parser.parse_args()
21 |
22 | if __name__ == '__main__':
23 | if re.search(r"^\d{1,}x\d{1,}\+\d{1,}x\d{1,}$", args.p) and re.search(r"^\d{1,}x\d{1,}$", args.n) and re.search(r"^\d{1,}x\d{1,}$", args.size):
24 | x1, y1 = map(lambda x: int(x), args.p.split("+")[0].split("x"))
25 | x2, y2 = map(lambda x: int(x), args.p.split("+")[1].split("x"))
26 | width, height = map(lambda x: int(x), args.n.split("x"))
27 | width_size, height_size = map(lambda x: int(x), args.size.split("x"))
28 |
29 | img_path = os.path.abspath(args.f)
30 | file_name = img_path.split("\\")[-1]
31 |
32 | img = cv2.imread(img_path, cv2.IMREAD_COLOR)
33 | row, col = img.shape[:2]
34 |
35 | r, c = len(range(y1, y2 + 1, height)), len(range(x1, x2 + 1, width))
36 | new_img = np.zeros(shape=(r * height_size * args.resize, c * width_size * args.resize, 3))
37 | for y, x in itertools.product(range(r), range(c)):
38 | for y_size in range(height_size):
39 | for x_size in range(width_size):
40 | # new_img[y * height_size + y_size, x * width_size + x_size] = img[y1 + y * height + y_size, x1 + x * width + x_size]
41 | pt1 = ((x * width_size + x_size) * args.resize, (y * height_size + y_size) * args.resize)
42 | pt2 = ((x * width_size + x_size) * args.resize + args.resize, (y * height_size + y_size) * args.resize + args.resize)
43 | color = img[y1 + y * height + y_size, x1 + x * width + x_size].tolist()
44 | cv2.rectangle(new_img, pt1=pt1, pt2=pt2, color=color, thickness=-1)
45 |
46 |
47 | cv2.imwrite(f"_{file_name}", new_img)
48 | print("已保存到运行目录中...")
49 | else:
50 | print("参数-p或参数-n或参数-size, 输入错误!")
--------------------------------------------------------------------------------
/LCG/enc.py:
--------------------------------------------------------------------------------
1 | import uuid
2 | from Crypto.Util.number import *
3 |
4 | flag = f"BYXS20{{{uuid.uuid4()}}}"
5 | seed = bytes_to_long(flag.encode())
6 | length = seed.bit_length()
7 | print(length)
8 |
9 | a = getPrime(length)
10 | b = getPrime(length)
11 | m = getPrime(length)
12 |
13 | results = []
14 | for _ in range(10):
15 | seed = (a * seed + b) % m
16 | results.append(seed)
17 |
18 | print(f"results = {results}")
--------------------------------------------------------------------------------
/LCG/main.py:
--------------------------------------------------------------------------------
1 | import sympy
2 | import libnum
3 | import contextlib
4 |
5 |
6 | def lcg_get_m(output):
7 | t = [output[i] - output[i - 1] for i in range(1, len(output))]
8 | return [int(sympy.gcd(t[i + 3] * t[i + 1] - t[i + 2] * t[i + 2], t[i + 2] * t[i] - t[i + 1] * t[i + 1])) for i in range(len(t) - 3)]
9 |
10 | def lcg_get_a(output, m):
11 | lis = []
12 | with contextlib.suppress(Exception):
13 | lis.extend((output[i + 2] - output[1]) * int(sympy.mod_inverse((output[i + 1] - output[i]), m)) % m for i in range(len(output) - 2))
14 | return lis
15 |
16 | def lcg_get_b(output, a, m):
17 | return [(output[i] - a * output[i-1]) % m for i in range(1, len(output))]
18 |
19 | def lcg_get_seed(output, a, b, m):
20 | with contextlib.suppress(Exception):
21 | a_inv = int(sympy.mod_inverse(a, m))
22 | return a_inv * (output[0] - b) % m
23 |
24 | def lcg_solver(output, isPrint=True, isSet=False):
25 | lis = []
26 | for m in lcg_get_m(output):
27 | for a in lcg_get_a(output, m):
28 | for b in lcg_get_b(output, a, m):
29 | if (seed := lcg_get_seed(output, a, b, m)):
30 | lis.append(seed)
31 |
32 | if isSet:
33 | lis = list(set(lis))
34 |
35 | if isPrint:
36 | for seed in lis:
37 | print(libnum.n2s(seed))
38 | return lis
39 |
40 | if __name__ == '__main__':
41 | # output = [69676071514199964129368494511049773706185789519381885090989836826032423348931601761005255484444660094, 63031206989830671133688676504767396390656004885395484175664501826753686622909142758317354395992301026, 10982611756211554291222567868588733322082261620905115629089850311461024570081479382334755302093076626, 57593354371133571326881703280620102147253648139230630688131873856129105654575862207035367081838844484, 47619980490914264678052844656879066638030284466312631649629134306776942962249639156106765582151143844, 58789571370633161248337888914950971131623915440268354523313877777336488371785773275506162258821825516, 109481456137357201661490538198304522268006931099085677213764961347749368305449034788701532872386412243, 19307804703479426044115964742461201656670909298595515226324824508728816047217841799764422041962083267, 93700801968408201834162526077717334683725582703626747502836611244942102316238114344746715776427713387, 87095688282213954059983741940081650190732077925687511841367934545528486899471711188785929150582606959]
42 | output = [2362956263554848170817729987754611374928204274967748213482967526790646738692550494632686977605208124188164, 1272774410874317473670489174711151283842765704668789171057284003611511386277261507754750964030540471223565, 898982732342703863320991923205294587525869915431666895395350261011619733544248006834659710572114326635176, 2605108648366962409362647341634151151683570377790751041905577827369955936068519953780810763065590026709642, 2085998239792031891546268826259052653103310188786564909648386799865874059000264433415887678375234055781183, 1056062457012308922306581668219464282750217942037759606849987545327693824327814341037476841440815564079798, 2182504276869403618999593972078608895262196338036377015932439255627231434754913125255610612534092646605520, 1554748322991028777460381298766095073857639296646112762830350768614445020765763227681814150496693495044250, 2307915444185938322547554797556246210645139214659075550407575285577333700932965549465126134842440885654676, 411068882836855649055582443155224381449420676041100704621993277452694400824923872344461663651348379143917]
43 | lcg_solver(output, isPrint=True, isSet=False)
44 |
--------------------------------------------------------------------------------
/PBETools/README.md:
--------------------------------------------------------------------------------
1 | # PBE
2 |
3 | PBE（Password-Based Encryption，基于密码的加密）是一种加密技术，它使用密码（或叫口令）来加密和解密数据。
4 |
5 | 密文特征: 密文常以 `U2FsdGVkX1` 开头, base64解码为 `Salted__`
6 |
7 | # 完善程度
8 |
9 | - [x] MD5andAES128bit-CBC
10 | - [x] MD5andAES192bit-CBC
11 | - [x] MD5andAES256bit-CBC
12 | - [x] MD5andDES
13 | - [x] MD5andRC4
14 | - [x] MD5andTripleDES
15 | - [x] MD5andRabbit
16 | - [x] MD5andRabbit2
17 |
18 | # 在线网站
19 |
20 | **以下是个人推荐的在线网站，如果大家还有更多好用的网站欢迎补充~**
21 |
22 | 许愿星：https://wishingstarmoye.com/ctf/cryptojs
23 |
24 | 查询网：https://tool.ip138.com/aesdes/
25 |
26 | SOJSON在线工具箱：https://www.sojson.com/encrypt_aes.html
27 |
28 |
--------------------------------------------------------------------------------
/PBETools/exp.py:
--------------------------------------------------------------------------------
1 | import os
2 | import binascii
3 | import py_mini_racer
4 |
5 | # 这个库的打包尤为麻烦，需要手动去改dll的代码
6 |
7 | if __name__ == '__main__':
8 | with open("./js/rabbit.js", "r") as f:
9 | jsCode = f.read()
10 |
11 | crx = py_mini_racer.MiniRacer()
12 | crx.eval(jsCode)
13 |
14 | cipher = "U2FsdGVkX19bEN3D8vFeG39VyYXPwle2mMQLh5T1HYiSI1XCx7rJhsDnp9qLpUQByITd05Uu05ZAv0o="
15 | key = "Gui_1s_shumu"
16 | print(binascii.a2b_hex(crx.call("RabbitDecrypt", cipher, key)))
17 | os.system("pause")
--------------------------------------------------------------------------------
/PBETools/test.py:
--------------------------------------------------------------------------------
1 | from main import *
2 |
3 | if __name__ == '__main__':
4 | # AES
5 | print(AES128Decrypt(b"123", "U2FsdGVkX19sTZDwd5c0MQwWhW8HWVNuOmpGsE+bhLa0gXITdVSojT0vsmuuXfGn"))
6 | print(AES192Decrypt(b"123", "U2FsdGVkX19sTZDwd5c0MRcERwLNxNRA+hdHfykE+DlDOGNjDd7w+1b0ZrwU3NVR"))
7 | print(AES256Decrypt(b"123", "U2FsdGVkX1/Cypfk69uqZGCEDOF9loE4vVJ03hh01Yif+Y/ZigZdO53dU/UBdY48"))
8 |
9 | # DES
10 | print(DESDecrypt(b"123", "U2FsdGVkX1+C4UoPrPwGrt4DxgzHxcqxwG9lpDns87Rb+wW4bCeQpg=="))
11 |
12 | # 3DES
13 | print(TripleDesDecrypt(b"123", "U2FsdGVkX1/ysI7dcQULvLVMVtPrvu8n1y6wJdckvz18Q4EUzal5Gw=="))
14 |
15 | # RC4
16 | print(RC4Decrypt(b"123", "U2FsdGVkX18c7nwA2OsstI0a+jJP5UUwaSoyp/FHUCieYpNR"))
17 |
18 | # Rabbit
19 | print(RabbitDecrypt(b"Gui_1s_shumu", "U2FsdGVkX19bEN3D8vFeG39VyYXPwle2mMQLh5T1HYiSI1XCx7rJhsDnp9qLpUQByITd05Uu05ZAv0o="))
20 | print(AES256Decrypt(b"hahaha,youcantgetflag!!", "U2FsdGVkX18s+Wam0HiVp+vgdF9bvG6SlUvWFqhNN6cnm9HH9eITVxxJW9CzPg/R"))
21 |
--------------------------------------------------------------------------------
/PBETools/zero补充/AK-AES.exe:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/yixinBC/CTF_Script/68c17c7f750cafbeb8a71cd6891d1bb1d2aaa2cd/PBETools/zero补充/AK-AES.exe
--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | # CTF_Script
2 |
3 | ### 2进制绘制二维码：
4 |
5 | ##### [NSSRound#7 Team]IKUN的电脑：
6 |
7 | 
8 |
9 | 23 | misc_tools
24 | 25 |Miscellaneous Tools by 330k
26 | 27 |28 | Unicode Steganography with Zero-Width Characters
29 | 30 |http://330k.github.io/misc_tools/unicode_steganography.html
31 | 32 |33 | Show KML Layer on Google Maps Gadget for Google Sites
34 | 35 |http://330k.github.io/misc_tools/kmlmap_gadget.xml
36 | 37 |Usage:
38 | 39 |-
40 |
- Go to Google Sites 41 |
- Create new page or edit page 42 |
- Insert external gadget from URL 43 |
- Disignate the above URL 44 |
- Input the URL to kml file to show 45 |
- Done! 46 |