一、信号不好先挂了

题目链接：https://adworld.xctf.org.cn/task/task_list?type=misc&number=1&grade=1&page=4

二、答题步骤

1.binwalk

imagedata           .. text: "\"\"\"'&&\"##"
b1,rgb,lsb,xy       .. file: Zip archive data, at least v2.0 to extract
b2,rgb,msb,xy       .. text: "]UUUUUUUWUU"
b2,bgr,msb,xy       .. text: "U]]UUUUUUuUUu"
b4,r,msb,xy         .. text: ["w" repeated 10 times]
b4,rgb,msb,xy       .. text: ["w" repeated 15 times]
b4,bgr,msb,xy       .. text: ["w" repeated 14 times]

使用binwalk分析文件斌没发现有用的信息

2.stegsolver

使用stegsolver分析中发现

用stegsolver分离后得到压缩包解压，得到一张相似的图片：pen.png

因为两张图片长得一样，所以很容易想到可能是藏有盲水印，于是用opencv处理盲水印得到flag

py -3 bwm.py decode apple.png pen.png apple_pen.png

flag：unctf{9d0649505b702643}

总结

• zsteg
• 盲水印

py -3 py文件名 --original 有水印的图片名 --image 原图片名 --result 解密图片名

脚本

# coding=utf-8
import cv2
import numpy as np
import random
import os
from argparse import ArgumentParser
ALPHA = 5

def build_parser():
    parser = ArgumentParser()
    parser.add_argument('--original', dest='ori', required=True)
    parser.add_argument('--image', dest='img', required=True)
    parser.add_argument('--result', dest='res', required=True)
    parser.add_argument('--alpha', dest='alpha', default=ALPHA)
    return parser

def main():
    parser = build_parser()
    options = parser.parse_args()
    ori = options.ori
    img = options.img
    res = options.res
    alpha = options.alpha
    if not os.path.isfile(ori):
        parser.error("original image %s does not exist." % ori)
    if not os.path.isfile(img):
        parser.error("image %s does not exist." % img)
    decode(ori, img, res, alpha)

def decode(ori_path, img_path, res_path, alpha):
    ori = cv2.imread(ori_path)
    img = cv2.imread(img_path)
    ori_f = np.fft.fft2(ori)
    img_f = np.fft.fft2(img)
    height, width = ori.shape[0], ori.shape[1]
    watermark = (ori_f - img_f) / alpha
    watermark = np.real(watermark)
    res = np.zeros(watermark.shape)
    random.seed(height + width)
    x = range(height // 2)
    y = range(width)
    random.shuffle(list(x))
    random.shuffle(list(y))
    for i in range(height // 2):
        for j in range(width):
            res[x[i]][y[j]] = watermark[i][j]
    cv2.imwrite(res_path, res, [int(cv2.IMWRITE_JPEG_QUALITY), 100])
if __name__ == '__main__':
    main()

• lsb