# Write up BUUCTF MISC ### 金三胖 ![image](https://hackmd.io/_uploads/SkiDsOGpR.png) #### when we download file we will get gif ![frame001](https://hackmd.io/_uploads/BJ_8h_Ga0.png) ```bash! apt-get install ffmpeg ffmpeg -i aaa.gif frame%03d.png ``` ###### flag{he11ohongke} ### 你竟然赶我走 ![image](https://hackmd.io/_uploads/ryt46Oz60.png) #### i downloaded file we will get jpg ![biubiu](https://hackmd.io/_uploads/H1W_6_GaA.jpg) ```bash! strings biubiu.jpg | grep flag flag IS flag{stego_is_s0_bor1ing} ``` ### 大白 ![image](https://hackmd.io/_uploads/ByupdKfpC.png) ![image](https://hackmd.io/_uploads/SJUYwYGaR.png) ![dabaishuxing](https://hackmd.io/_uploads/SJwWdYz6R.png) ###### We use Winhex or other software to open it, as shown in the figure below. The red arrow in the second row points 00 00 02 A7to 02A7the width, and the red arrow 00 00 01 00in the middle points 0100to the height. 02A7 converted to decimal is 679. We can also change 0100 to 02A7 to see the flag ![image](https://hackmd.io/_uploads/SywHdYzTC.png) ![image](https://hackmd.io/_uploads/rkQcdtzaC.png) ###### flag:flag{He1l0_d4_ba1} ### wireshark ![image](https://hackmd.io/_uploads/B1gz9tM6C.png) #### we got file pcap and follow tcp ![image](https://hackmd.io/_uploads/SJ3d5FMpC.png) #### as you can see password ###### flag{ffb7567a1d4f4abdffdb54e022f8facd} ### N种方法解决 ![image](https://hackmd.io/_uploads/Hy4pRYz60.png) ![image](https://hackmd.io/_uploads/BkWg19f6R.png) ![image](https://hackmd.io/_uploads/B11515zpR.png) ![image](https://hackmd.io/_uploads/Hyzj1cMp0.png) ![image](https://hackmd.io/_uploads/B10hycG6C.png) ###### flag{dca57f966e4e4e31fd5b15417da63269}\ ### 基础破解 ![image](https://hackmd.io/_uploads/HJAZZ5GpA.png) ![image](https://hackmd.io/_uploads/rJz8Z5G6C.png) it requires password!!! ![image](https://hackmd.io/_uploads/SJoEEcz6R.png) ###### open the file after getting password ![image](https://hackmd.io/_uploads/Syt2NqzTA.png) it is a base64 ###### It is obvious that the base64 encrypted document is decrypted to get the answer flag{70354300a5100ba78068805661b93a5c}