Flag tìm được:

text
dalCTF{WhY_$O_L0N5}

Write-up:

bash
file "chall (1).7z"
7z l "chall (1).7z"
7z x "chall (1).7z" -ochall_extract
cd chall_extract
file "chall (1).png"
exiftool "chall (1).png"
strings -a "chall (1).png"
binwalk "chall (1).png"

Kết quả đáng chú ý:

text
chall (1).png: JPEG image data ...
Warning: JPEG format error
binwalk: Zlib compressed data at 0x29
strings: Nothing2SeeHereGoLookSomewhereElse

Ảnh có đuôi .png nhưng header là JPEG. Dump hex thấy cấu trúc giống PNG bị sửa:

text
IHET  -> IHDR
ISAD  -> IDAT
SEND  -> IEND

Script sửa PNG:

python
from pathlib import Path
import zlib

p = bytearray(Path("chall (1).png").read_bytes())

p[0:8] = b"\x89PNG\r\n\x1a\n"
p[8:12] = (13).to_bytes(4, "big")
p[12:16] = b"IHDR"

p = p.replace(b"ISAD", b"IDAT")
p = p.replace(b"SEND", b"IEND")

o = 8
out = bytearray(p[:8])

while o + 8 <= len(p):
    length = int.from_bytes(p[o:o+4], "big")
    typ = bytes(p[o+4:o+8])
    data = bytes(p[o+8:o+8+length])

    crc = zlib.crc32(typ + data) & 0xffffffff
    out += length.to_bytes(4, "big") + typ + data + crc.to_bytes(4, "big")

    o += 12 + length
    if typ == b"IEND":
        break

Path("fixed.png").write_bytes(out)

Chạy:

bash
python3 fix_png.py
file fixed.png

Kết quả:

text
fixed.png: PNG image data, 810 x 110, 8-bit/color RGBA

Ảnh khôi phục là mã rMQR. Decode bằng ZXing:

bash
ZXingReader fixed.png

Output:

text
Text:       "dalCTF{WhY_$O_L0N5}"
Format:     rMQRCode

Flag:

text
dalCTF{WhY_$O_L0N5}

Flag:

text
dalctf{y311e8wi11_4m4eypt_32tni274}

Write-up:

File output.txt là chuỗi bit, còn alphabet.txt chứa ký tự + tần suất/xác suất. Vì vậy hướng đúng là dựng cây Huffman từ bảng alphabet rồi decode bitstream. (output.txt) (alphabet.txt)

Lệnh dùng:

bash
cat output.txt
cat alphabet.txt
python3 solve.py

solve.py:

python
from pathlib import Path
import heapq
import itertools

bits = Path("output.txt").read_text().strip()

items = []
for line in Path("alphabet.txt").read_text().splitlines():
    if not line.strip():
        continue
    ch, prob = line.split()
    items.append((ch, float(prob)))

heap = []
counter = itertools.count()

for ch, prob in items:
    heapq.heappush(heap, (prob, next(counter), ch))

while len(heap) > 1:
    p1, _, n1 = heapq.heappop(heap)
    p2, _, n2 = heapq.heappop(heap)
    heapq.heappush(heap, (p1 + p2, next(counter), (n1, n2)))

root = heap[0][2]
codes = {}

def walk(node, prefix=""):
    if isinstance(node, str):
        codes[node] = prefix
        return
    walk(node[0], prefix + "0")
    walk(node[1], prefix + "1")

walk(root)

rev = {v: k for k, v in codes.items()}

buf = ""
plain = ""

for bit in bits:
    buf += bit
    if buf in rev:
        plain += rev[buf]
        buf = ""

print(plain)

Output:

text
dalctf{y311e8wi11_4m4eypt_32tni274}