Blue Shield cup writeup

Because only the Intranet is provided during the competition, Web questions cannot be reproduced. Here we will briefly write some questions about Misc.

 

1. Are you dazzled?

(The original question is from the lab)

Tip: when you are dazzled, two images will be displayed. You can think of a situation where two images are included.

Use foremost to separate the two identical images:

Open with stegsolve and select data extract to find the flag:

ISG {e4sy_steg4n0gr4phy}

 

2. Beautiful roses

Tip: The key is in the image.

It is assumed that the key value is put in the image, and the key value is obtained using steghide. But you need to know the password value. First, try the weak password, and the result is displayed.

Open test.txt to obtain the key value:

The answer is d77f5e4da-291bcb.

 

3. brainfuck

Tip: The image is very strange.

We can see that brainfuck is thinking of using braintools.

Place the downloaded image to the file directory where bftools.exe is located. Run the following command:

bftools.exe decode braincopter doge.jpg --output --dogeout.jpg

Reuse:

bftools.exe run --dogeout.jpg

Get:

You can get a string of base64 encoding, which can be decoded by converter (any tool that can solve base64:

That is: CTF {brainfuck_1s_simp1e}

 

4. Flag is in the picture.

A compressed package is named birthday.zip, so the password is related to the birthday.

Use archpr to crack the password:

Get the password, enter the password, get an image, and click View Properties to get the flag:

That is: bdctf {gdyh4vogbd}

Blue Shield cup writeup