將題目的pcap檔的data提取出來
使用wireshark
提取資料
發現他都是10.10.10.10->10.10.10.11的tcp封包,且好像是同一個session,
因此我們隨便點一個封包,右鍵->Follow->TCP Stream
Show as 選擇Raw,按save as
儲存成stream.bin
根據題目給的加密腳本寫出解密腳本
解密腳本
根據題目的編碼方法編寫解碼,並印出來一部分看是什麼類型的
def decode(b,key):
return (b-key)%256
def main(filename,key=42):
s = ""
with open(filename, 'rb') as f:
data = f.read()
out = bytes(decode(b, 42) for b in data)
print(out[:500])
if __name__ == "__main__":
main("stream.bin")
發現是JPEG的檔案,更改腳本儲存成JPEG
def decode(b,key):
return (b-key)%256
def main(filename,key=42):
s = ""
with open(filename, 'rb') as f:
data = f.read()
out = bytes(decode(b, 42) for b in data)
# print(out[:500])
with open("flag.jpeg", "wb") as f:
f.write(out)
if __name__ == "__main__":
main("stream.bin")
flag
說些什麼吧！