Writeup-2020 Anxin cup Misc question: start depression

Posted by OM2 on Thu, 13 Jan 2022 06:41:53 +0100

Title Description: start depression Attachment Download

Open the compressed package and find a picture. Unzip it and check it directly. No exceptions are found

It is found that the size of the picture is too large, 4.5M. It is speculated that other files are mixed

Find the zip file header, directly change the format to zip, and extract two files

First, open the compressed package and find that it is encrypted. Open the picture time Png, it is found that it cannot be opened normally. It is speculated that it needs to be repaired. Winhex is opened

IHDR data block and empty file header are found, and the repaired file header is successfully opened after saving PS: IHDR is a png specific data block

Two dimensional code decoding


This is a code called Brainfuck, which is decoded


Obviously, jstuck, continue decoding

The result is similar to the time. It should be the compressed package password, but the password is wrong We take this time to the timestamp to get:


Use the timestamp to successfully decompress the compressed package to get a picture

After searching, this is the password of the dancer from Sherlock Holmes's detective collection. The password corresponds to

Decrypted as: WATCHTHEVIDEO (watch this video)

Then check the image information and find that the image size is obviously too large, 4.45M. Put it into Winhex and open it again to find the zip file header

Modify the suffix to zip and open it to get several pictures

Including flag Png cannot be opened. Winhex found that the file header is missing again. After supplement, open it to get an expression package

Observe the picture and find that there is a missing section. Check with TweakPNG and find that the data block is abnormal

Double click the IHDR block to modify the width and height of the picture to obtain the flag format

flag Format:{1234-1234-ABCDEFGHI-ABCDEFGHIJK-1234}

After obtaining the format, obtain each flag through several pictures in the flag folder There are six pictures in the flag folder. The numbers of the first five pictures correspond to the five time segments of your name in Bilibili, respectively

6 minutes 12 seconds / 21 minutes 05 seconds / 22 minutes 24 seconds / 44 minutes 52 seconds / 93 minutes 25 seconds

Fill the five clues into the flag format and capitalize to get the final flag: