ASISCTF2017-ASIS secret letter-writeup
binwalk Stéganô

Task

1	The face is the index of the mind, its ASIS secret letter!

Solution

题目提供了压缩包，解压后得到两张图片。用binwalk看一下。

root@chybeta:~/Desktop/asis_letter# binwalk *
Scan Time:     2017-09-06 07:51:11
Target File:   /root/Desktop/asis_letter/3baa358f6d671e86f17bc4439cc4062e
MD5 Checksum:  3baa358f6d671e86f17bc4439cc4062e
Signatures:    344
DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             JPEG image data, JFIF standard 1.01
30            0x1E            TIFF image data, big-endian, offset of first image directory: 8
56            0x38            Zlib compressed data, default compression
Scan Time:     2017-09-06 07:51:11
Target File:   /root/Desktop/asis_letter/e07d17ed7d8104590ff3e17bdf052057
MD5 Checksum:  e07d17ed7d8104590ff3e17bdf052057
Signatures:    344
DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             PNG image, 4351 x 2812, 8-bit/color RGB, non-interlaced
41            0x29            Zlib compressed data, default compression

用命令binwalk -e *解压出文件，在图片3baa358f6d671e86f17bc4439cc4062e解压得到的文件夹中：

root@chybeta:~/Desktop/asis_letter# cd _3baa358f6d671e86f17bc4439cc4062e.extracted/
root@chybeta:~/Desktop/asis_letter/_3baa358f6d671e86f17bc4439cc4062e.extracted# ls
38  38.zlib
root@chybeta:~/Desktop/asis_letter/_3baa358f6d671e86f17bc4439cc4062e.extracted# cat 38
OEorU2pDQWdabkp2YlNCQlUwbFRJSGRwZEdnZ2JHOTJaU3dnY0d4bFlYTmxJR1pwYm1RZ2MyVmpjbVYwSUcxbGMzTmhaMlVnWVc1a0lISmxjR3g1SUhOdmIyNHNJSEJ2ZDJWeVpXUWdZbmtnOEorUmlTQWdVM1REcVdkaGJzTzBJUENma1lnPQ==r

将上面的base64串进行解密，得到：

1
2
3

>>> import base64
>>> base64.b64decode("OEorU2pDQWdabkp2YlNCQlUwbFRJSGRwZEdnZ2JHOTJaU3dnY0d4bFlYTmxJR1pwYm1RZ2MyVmpjbVYwSUcxbGMzTmhaMlVnWVc1a0lISmxjR3g1SUhOdmIyNHNJSEJ2ZDJWeVpXUWdZbmtnOEorUmlTQWdVM1REcVdkaGJzTzBJUENma1lnPQ==r")
'8J+SjCAgZnJvbSBBU0lTIHdpdGggbG92ZSwgcGxlYXNlIGZpbmQgc2VjcmV0IG1lc3NhZ2UgYW5kIHJlcGx5IHNvb24sIHBvd2VyZWQgYnkg8J+RiSAgU3TDqWdhbsO0IPCfkYg='

继续进行base64解密：

得到提示：Stéganô 。

在github上搜索，发现了一个项目：cedricbonhomme/Stegano

经过尝试，最后的命令如下：

1	stegano-lsb-set reveal -i e07d17ed7d8104590ff3e17bdf052057 -g triangular_numbers

flag:

1	ASIS{767ba85340d9e49fa0bb9c2b12037f08}

或者用python

>>> from stegano import lsbset
>>> from stegano.lsbset import generators
>>> message = lsbset.reveal("./e07d17ed7d8104590ff3e17bdf052057", generators.triangular_numbers())
>>> message
'ASIS{767ba85340d9e49fa0bb9c2b12037f08}'