1bkcrack.exe -C letter.zip -c letter.exe -x 0 4D5A -x 64 0E1FBA0E00B409CD21B8014CCD21546869732070726F6772616D2063616E6E6F742062652072756E20696E20444F53206D6F64652E0D0D0A24000000000000002bkcrack 1.7.1 - 2024-12-213[10:04:22] Z reduction using 56 bytes of known plaintext4100.0 % (56 / 56)5[10:04:22] Attack on 141108 Z values at index 716Keys: 68cc45ab 864060ce ac958caa775.7 % (106781 / 141108)8Found a solution. Stopping.9You may resume the attack with the option: --continue-attack 10678110[10:07:22] Keys1168cc45ab 864060ce ac958caa

1flag{N0w_U-V1ctory}

1sudo apt update2sudo apt install -y qemu-user-static qemu-user binfmt-support

1sudo systemctl restart systemd-binfmt.service2sudo systemctl restart docker

1ls /proc/sys/fs/binfmt_misc/ | grep qemu-aarch64

1docker run --platform linux/arm64 -it --name whiteout_container misc_docker_whiteout2root@08e66dc2317c:/opt/app# ls3decode.py  log.txt4root@08e66dc2317c:/opt/app# cat decode.py5# decode.py6KEY = 0x377 8def decode(path):9    with open(path, "rb") as f:10        data = f.read()11    return bytes(b ^ KEY for b in data)12 13if __name__ == "__main__":14    print(decode("/opt/.data/.logs/syslog.bin"))15root@08e66dc2317c:/opt/app# cat log.txt16cleanup done17root@08e66dc2317c:/opt/app# ls -ah /opt/.data/.logs18.  ..

1┌──(root㉿kali)-[~]2└─# docker inspect misc_docker_whiteout | grep -A 10 "LowerDir"3                "LowerDir": "/var/lib/docker/overlay2/baea9fd8e87c332fd0252c7d0244ce33d764a776186af5d3cd6e0a90f4a0f2e7/diff:/var/lib/docker/overlay2/0307dc3238f0a22adbbec6b0c9014846164f3da11ea10aeda872d446937a77c3/diff:/var/lib/docker/overlay2/ab17a839c8b202fca45d45f3acb2284a82f5c3de316f4de4f32e91d63856566f/diff:/var/lib/docker/overlay2/92b6636503fa03f103c0c737a634e3ab0225df9cc125f8355ecf3a035de9f97b/diff:/var/lib/docker/overlay2/f71662a75b1dd27faf57b4ec3205795ff6dca31240dda9c0d02ca3a0d5db7dc9/diff:/var/lib/docker/overlay2/d75503f05017f8d71d5cd479c9c9b384a20fb33d96fa9679bf0025abcff27c23/diff",4                "MergedDir": "/var/lib/docker/overlay2/b01d7efeb8cd62c830ebf157dcdfec628aad47a86a924c641da123057f73781a/merged",5                "UpperDir": "/var/lib/docker/overlay2/b01d7efeb8cd62c830ebf157dcdfec628aad47a86a924c641da123057f73781a/diff",6                "WorkDir": "/var/lib/docker/overlay2/b01d7efeb8cd62c830ebf157dcdfec628aad47a86a924c641da123057f73781a/work"7            },8            "Name": "overlay2"9        },10        "RootFS": {11            "Type": "layers",12            "Layers": [13                "sha256:b3f74c31dcaee85c6efbb1c8b30081ee1e7f2b11e841d4492217caa7d1681539",

1find /var/lib/docker/overlay2/baea9fd8e87c332fd0252c7d0244ce33d764a776186af5d3cd6e0a90f4a0f2e7/diff -name "syslog.bin" 2>/dev/null2find /var/lib/docker/overlay2/0307dc3238f0a22adbbec6b0c9014846164f3da11ea10aeda872d446937a77c3/diff -name "syslog.bin" 2>/dev/null3find /var/lib/docker/overlay2/ab17a839c8b202fca45d45f3acb2284a82f5c3de316f4de4f32e91d63856566f/diff -name "syslog.bin" 2>/dev/null4find /var/lib/docker/overlay2/92b6636503fa03f103c0c737a634e3ab0225df9cc125f8355ecf3a035de9f97b/diff -name "syslog.bin" 2>/dev/null5find /var/lib/docker/overlay2/f71662a75b1dd27faf57b4ec3205795ff6dca31240dda9c0d02ca3a0d5db7dc9/diff -name "syslog.bin" 2>/dev/null6find /var/lib/docker/overlay2/d75503f05017f8d71d5cd479c9c9b384a20fb33d96fa9679bf0025abcff27c23/diff -name "syslog.bin" 2>/dev/null7┌──(root㉿kali)-[~]8└─# find /var/lib/docker/overlay2/ab17a839c8b202fca45d45f3acb2284a82f5c3de316f4de4f32e91d63856566f/diff -name "syslog.bin" 2>/dev/null9/var/lib/docker/overlay2/ab17a839c8b202fca45d45f3acb2284a82f5c3de316f4de4f32e91d63856566f/diff/opt/.data/.logs/syslog.bin

1┌──(root㉿kali)-[~]2└─# cp /var/lib/docker/overlay2/ab17a839c8b202fca45d45f3acb2284a82f5c3de316f4de4f32e91d63856566f/diff/opt/.data/.logs/syslog.bin /home/kali/Desktop3 4┌──(root㉿kali)-[~]5└─# cd /home/kali/Desktop/6 7┌──(root㉿kali)-[/home/kali/Desktop]8└─# hexdump -C syslog.bin900000000  51 5b 56 50 4c 53 58 54  5c 52 45 68 40 5f 5e 43  |Q[VPLSXT\REh@_^C|1000000010  52 58 42 43 68 51 58 45  52 59 44 5e 54 44 68 5e  |RXBChQXERYD^TDh^|1100000020  44 68 51 42 59 4a                                 |DhQBYJ|1200000026

1flag{docker_whiteout_forensics_is_fun}

1tshark -r The_Rogue_Beacon.pcapng -Y can -T fields -e frame.number -e can.id -e data > can_data.txt

1import os2from collections import Counter3 4def can_analysis(file_path):5    if not os.path.exists(file_path):6        print(f"Error: {file_path} not found.")7        return8 9    # 1. 原始数据解析10    raw_packets = []11    id_list = []12    13    with open(file_path, 'r', encoding='utf-8') as f:14        for line in f:15            parts = line.strip().split()16            if len(parts) < 3: continue17            try:18                raw_packets.append({19                    'line': int(parts[0]),20                    'id': parts[1],21                    'hex': parts[2],22                    'val': int(parts[2], 16)23                })24                id_list.append(parts[1])25            except ValueError:26                continue27 28    # 2. 统计每个 ID 的出现频率29    id_counts = Counter(id_list)30    avg_freq = sum(id_counts.values()) / len(id_counts)31    32    # 3. 锁定干扰数据33    # 干扰数据通常是发送次数最少，或者明显偏离正常周期频率的 ID34    # 这里我们取出现频率最低的 ID35    sorted_by_freq = sorted(id_counts.items(), key=lambda x: x[1])36    interference_id = sorted_by_freq[0][0] 37 38    # 4. 锁定车速信号39    # 物理信号 ID 拥有最多的“唯一数值数量”40    # 因为它在加速和减速过程中几乎每一帧产生的物理值都不同41    id_uniqueness = {}42    for packet in raw_packets:43        if packet['id'] == interference_id: continue # 排除干扰帧44        45        if packet['id'] not in id_uniqueness:46            id_uniqueness[packet['id']] = set()47        id_uniqueness[packet['id']].add(packet['hex'])48    49    # 找到不重复数值最多的 ID50    speed_id = max(id_uniqueness, key=lambda k: len(id_uniqueness[k]))51 52    # 5. 在锁定的车速信号中寻找峰值53    speed_packets = [p for p in raw_packets if p['id'] == speed_id]54    peak_packet = max(speed_packets, key=lambda x: x['val'])55 56    # --- 输出结论 ---57    print(f"[*] 发现干扰数据 ID      : {interference_id}")58    print(f"    (判定依据: 该 ID 出现频率最低，共 {id_counts[interference_id]} 次)")59    60    print(f"[*] 锁定车速信号 ID      : {speed_id}")61    print(f"    (判定依据: 数据熵最高，拥有 {len(id_uniqueness[speed_id])} 个独立物理状态)")62    63    print("-" * 50)64    print(f"[*] 车辆达到的极限峰值   : {peak_packet['val']}")65    print(f"[*] 峰值数据原始载荷     : {peak_packet['hex']}")66    print(f"[*] 峰值发生的行位置 : 第 {peak_packet['line']} 行")67 68if __name__ == "__main__":69    can_analysis('can_data.txt')

1flag{9db878fd06dd7587a91c0fb600e0e9f7c3ea310e75f36253ef57ac2d92dd8c29}

1import numpy as np2from scipy.io import wavfile3from scipy import signal4 5def restore_audio():6    print("[-] Loading raw data files...")7    # GNU Radio File Sink 保存的是 raw binary float328    try:9        i_data = np.fromfile('flag1.txt', dtype=np.float32)10        q_data = np.fromfile('flag2.txt', dtype=np.float32)11    except FileNotFoundError:12        print("[!] Error: flag1.txt or flag2.txt not found.")13        return14 15    # 确保两个文件长度一致16    min_len = min(len(i_data), len(q_data))17    i_data = i_data[:min_len]18    q_data = q_data[:min_len]19 20    print(f"[-] Data loaded. Samples: {min_len}")21 22    # 1. 组合 I/Q 信号 (Complex IQ)23    # Z = I + jQ24    iq_signal = i_data + 1j * q_data25 26    print("[-] Demodulating FM signal...")27 28    # 2. FM 解调 (Quadrature Demodulation)29    # 原理: FM 信号的信息包含在瞬时频率中。30    # 离散域中，瞬时频率与相邻采样点的相位差成正比。31    #通过计算 sample[n] * conj(sample[n-1]) 的角度来获得相位差。32 33    # 将信号错位 1 位进行共轭相乘34    # angle( Z[n] * Z[n-1]* )35    demodulated_signal = np.angle(iq_signal[1:] * np.conj(iq_signal[:-1]))36 37    # 3. 降采样 (Decimation)38    # 流图参数: 39    #   USRP Rate = 576k40    #   IF Rate (quad_rate) = 576k / 3 = 192k (这是 flag 文件的采样率)41    #   Audio Rate (samp_rate) = 48k42    # 因此需要进行 192k -> 48k 的降采样，因子为 4。43    # 使用 scipy.signal.decimate 可以自动进行低通滤波防止混叠。44 45    print("[-] Decimating (192kHz -> 48kHz)...")46    decimation_factor = 447    audio_output = signal.decimate(demodulated_signal, decimation_factor)48 49    # 4. 去加重 (Optional but Recommended)50    # NBFM 发射端通常有预加重 (Pre-emphasis)，接收端应该去加重 (De-emphasis)。51    # 这里可以简单地使用一个低通滤波器，或者如果不做也能听清内容。52    # 为了简化，这里我们只依靠 decimate 自带的滤波，通常足够还原语音。53 54    # 5. 归一化并保存55    # 归一化到 -1.0 到 1.0 之间，防止爆音56    print("[-] Normalizing and saving...")57    audio_output = audio_output / np.max(np.abs(audio_output))58 59    # 写入 WAV 文件 (48kHz)60    output_filename = 'password.wav'61    wavfile.write(output_filename, 48000, audio_output.astype(np.float32))62 63    print(f"[+] Audio saved to {output_filename}")64 65if __name__ == '__main__':66    restore_audio()

1bkcrack.exe -C flag.zip -c flag.txt -x 0 666c61677b593075 -x 25 2121217d2bkcrack 1.7.1 - 2024-12-213[00:46:51] Z reduction using 1 bytes of known plaintext4100.0 % (1 / 1)5[00:46:52] Attack on 2555904 Z values at index 66Keys: 33b19021 93c4a78d 9ceed931713.3 % (339321 / 2555904)8Found a solution. Stopping.9You may resume the attack with the option: --continue-attack 33932110[00:51:55] Keys1133b19021 93c4a78d 9ceed9311213bkcrack -C flag.zip -c flag.txt -k 33b19021 93c4a78d 9ceed931 -d flag.txt14bkcrack 1.7.1 - 2024-12-2115[00:53:11] Writing deciphered data flag.txt16Wrote deciphered data (not compressed).

1flag{Y0u_r_th3_Z1p_k1ng!!!!!}

1zsteg treasure.bmp2[.] treasure.bmp3imagedata           .. text: "z`}~`}~_"4b2,lsb,bY           .. text: "$,7#F,`f"5b1,rgb,lsb,xY       .. text: "PixelWhisper"6b3,g,msb,xY         .. text: "$@IR\"Kr\""7b4,r,lsb,xY         .. text: "gwvfgvgfgwvg"8b4,r,msb,xY         .. text: "UUUUUUUUU"9b4,g,lsb,xY         .. text: "\"\"\"\"#DEUDVUUfwffeeDC3"10b4,b,lsb,xY         .. text: "FDETUDEETDEEV"11b4,rgb,lsb,xY       .. text: "iGugVthG"12b4,bgr,lsb,xY       .. text: "IewWdvHd"

1steghide extract -sf treasure.bmp -p PixelWhisper2wrote extracted data to "flag.txt".

1flag{a9a3c2872e428b6d859a0e63458a43f8}

1import numpy as np2from PIL import Image3 4img = Image.open('blue.png')5img_array = np.array(img)6blue_channel = img_array[:, :, 2]7blue_bytes = blue_channel.tobytes()8 9high_nibbles = []10for byte in blue_bytes:11    high_nibble = (byte >> 4) & 0x0F12    high_nibbles.append(high_nibble)13 14combined_bytes = bytearray()15for i in range(0, len(high_nibbles) - len(high_nibbles) % 2, 2):16    combined_byte = (high_nibbles[i] << 4) | high_nibbles[i + 1]17    combined_bytes.append(combined_byte)18 19with open('blue.zip', 'wb') as f:20    f.write(combined_bytes)

1bkcrack -C blue.zip -c xor.png -x 0 89504E470D0A1A0A0000000D494844522bkcrack 1.7.1 - 2024-12-213[22:32:15] Z reduction using 9 bytes of known plaintext4100.0 % (9 / 9)5[22:32:16] Attack on 707085 Z values at index 66Keys: 68cc45ab 864060ce ac958caa729.1 % (206111 / 707085)8Found a solution. Stopping.9You may resume the attack with the option: --continue-attack 20611110[22:34:01] Keys1168cc45ab 864060ce ac958caa12 13bkcrack -C blue.zip -k 68cc45ab 864060ce ac958caa -D blue_.zip14bkcrack 1.7.1 - 2024-12-2115[22:35:03] Writing decrypted archive blue_.zip16100.0 % (1 / 1)17Zip error: could not find end of central directory record.

1python bwmforpy3.py decode 00000000.png xor.bmp output.png2image<00000000.png> + image(encoded)<xor.bmp> -> watermark<output.png>3[ WARN:0@4.538] global loadsave.cpp:848 cv::imwrite_ Unsupported depth image for selected encoder is fallbacked to CV_8U.

1flag{a5e2ffeb-133e-4eb0-9855-d4d0078326ee}

1<w:r>2    <w:rPr>3        <w:color w:val="1A23A5"/>4    </w:rPr>5    <w:t xml:space="preserve"> </w:t>6</w:r>

1import re2from PIL import Image3import math4 5def get_closest_dimensions(total):6    root = int(math.sqrt(total))7    for w in range(root, 0, -1):8        if total % w == 0:9            h = total // w10            return w, h11    return 1, total12 13def main():14    try:15        with open('document.xml', 'r', encoding='utf-8') as f:16            content = f.read()17    except FileNotFoundError:18        return19 20    # 提取被单独封装在一个 Run 里的彩色空格21    pattern = r'<w:r><w:rPr><w:color w:val="([0-9A-Fa-f]{6})"/></w:rPr><w:t xml:space="preserve"> </w:t></w:r>'22 23    colors = re.findall(pattern, content)24    total_pixels = len(colors)25 26    if total_pixels == 0:27        return28 29    # 计算宽高30    w_base, h_base = get_closest_dimensions(total_pixels)31 32    dimensions = [(w_base, h_base)]33    if w_base != h_base:34        dimensions.append((h_base, w_base))35 36    for _, (width, height) in enumerate(dimensions):37        img = Image.new('RGB', (width, height))38 39        for i in range(total_pixels):40            hex_color = colors[i]41            r = int(hex_color[0:2], 16)42            g = int(hex_color[2:4], 16)43            b = int(hex_color[4:6], 16)44 45            x = i % width46            y = i // width47            img.putpixel((x, y), (r, g, b))48 49        img.save('result.png')50 51if __name__ == '__main__':52    main()

14e 65 74 77 6f 72 6b 20 73 65 63 75 72 69 74 79 20 69 73 20 61 6e 20 75 6d 62 72265 6c 6c 61 20 74 65 72 6d 20 74 6f 20 64 65 73 63 72 69 62 65 20 73 65 63 75 72369 74 79 20 63 6f 6e 74 72 6f 6c 73 2c 20 70 6f 6c 69 63 69 65 73 2c 20 70 72 6f 63465 73 73 65 73 20 61 6e 64 20 70 72 61 63 74 69 63 65 73 20 61 64 6f 70 74 65 64520 74 6f 20 70 72 65 76 65 6e 74 2c 20 64 65 74 65 63 74 20 61 6e 64 20 6d 6f 6e 69674 6f 72 20 75 6e 61 75 74 68 6f 72 69 7a 65 64 20 61 63 63 65 73 73 2c 20 6d 69 73775 73 65 2c 20 6d 6f 64 69 66 69 63 61 74 69 6f 6e 2c 20 6f 72 20 64 65 6e 69 61 6c820 6f 66 20 61 20 63 6f 6d 70 75 74 65 72 20 6e 65 74 77 6f 72 6b 20 61 6e 64 20 6e965 74 77 6f 72 6b 2d 61 63 63 65 73 73 69 62 6c 65 20 72 65 73 6f 75 72 63 65 73 2e104e 65 74 77 6f 72 6b 20 73 65 63 75 72 69 74 79 20 69 6e 76 6f 6c 76 65 73 20 74 681165 20 61 75 74 68 6f 72 69 7a 61 74 69 6f 6e 20 6f 66 20 61 63 63 65 73 73 20 74 6f1220 64 61 74 61 20 69 6e 20 61 20 6e 65 74 77 6f 72 6b 20 76 65 72 61 63 72 79 701374 2c 20 77 68 69 63 68 20 69 73 20 63 6f 6e 74 72 6f 6c 6c 65 64 20 62 79 20 74 681465 20 6e 65 74 77 6f 72 6b 20 61 20 69 73 20 36 3f 2c 20 62 20 69 73 20 3f 37 2c 201573 20 69 73 20 3f 2c 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 2e 20 55 73 65 72 731620 63 68 6f 6f 73 65 20 6f 72 20 61 72 65 20 61 73 73 69 67 6e 65 64

1Network security is an umbrella term to describe security controls, policies, processes and practices adopted to prevent, detect and monitor unauthorized access, misuse, modification, or denial of a computer network and network-accessible resources.Network security involves the authorization of access to data in a network veracrypt, which is controlled by the network a is 6?, b is ?7, s is ?, administrator. Users choose or are assigned

1from PIL import Image2 3input_filename = 'result.png'4output_filename = 'result'5 6try:7    with Image.open(input_filename) as img:8        img = img.convert('RGB')9        pixels = list(img.getdata())10    11    total_pixels = len(pixels)12    print(f"原始图片总像素数: {total_pixels}")13 14    hex_parts = []15    16    # 遍历有效的像素17    for r, g, b in pixels:18        # 拼接顺序 R, G, B19        hex_r = format(r, '02x')20        hex_g = format(g, '02x')21        hex_b = format(b, '02x')22 23        hex_parts.append(hex_r)24        hex_parts.append(hex_g)25        hex_parts.append(hex_b)26 27    full_hex_string = "".join(hex_parts)28    binary_data = bytes.fromhex(full_hex_string)29    30    with open(output_filename, 'wb') as f_out:31        f_out.write(binary_data)32        33except Exception as e:34    print(f"处理过程中发生错误: {e}")

1flag{0671b07f6b7908bd718dc969b056ab26}