2026-10-15 13:25:26 网络安全文章来源：ZONE.CI 全球网 0 阅读模式

2025 HKCERT CTF MISC WRITEUP

佚名
佚名

Gh0xE9

2026年10月11日 12:51
北京

在小说阅读器读本章

去阅读

在公众号小说中沉浸阅读

Little Wish [solved]

gift文件尾有一个压缩包，然后打开发现是提示
Ⅰ. Look at that, what is \"9a\" ...? And what is the difference between \"9a\" and \"7a\"?

Ⅱ. Seek out the \"P\" above all, since the key clue lies there.

Ⅲ. But what is \"P\"? It can't be a pillow, right? Because if it were, I'd want to go to bed right now! (-:

̷͒͘Ⅳ̧͓̄.̹̀͒
̛͍̑?̻̀̆
̼̐͘Ȃ̴͍
̢͓̄n̵̻͗
̢͎̐y̴̻͒
̧͎̄t͈̐͘
̹̕h̷̨
͓̕į̻
̢͇͒n̵͓̐
͓̀̍g̶͓̅

̵̹̎é͓̿
́l̢
͇́̆s̡̻̐
͉͒͘e̢̼̿
͎̐͘?̧͉̄

一步一步按照上面进行就可以了
解出来一个密码，但是发现并不能直接解码deepsound
继续往下面看
每一帧前面都有 Graphic Control Extension (0x21F9)，结构为：
21 F9 04 [packed] [delay\_lo] [delay\_hi] [transparent] 00
而它的 delay\_lo 恰好被用来藏 ASCII 字母。
提取 14 帧的 delay\_lo 后拼出来是：
MENGMENG\_XIANG

#!/usr/bin/env python3
# -*- coding: utf-8 -*-

import struct

deffix_gif_header(raw: bytes) -> bytes:
    if raw[:6] == b\"GIFT9a\":
        returnb\"GIF89a\" + raw[6:]
    return raw

defparse_gct(gif: bytes) -> bytes:
    packed = gif[10]
    gct_flag = (packed >> 7) & 1
    ifnot gct_flag:
        raise ValueError(\"No Global Color Table\")
    gct_size = 2 ** ((packed & 7) + 1)
    gct_off = 13
    return gif[gct_off:gct_off + 3 * gct_size], gct_off + 3 * gct_size

defbits_to_bytes(bits, pack=\"msb\"):
    out = bytearray()
    cur = 0
    n = 0
    if pack == \"msb\":
        for b in bits:
            cur = (cur << 1) | b
            n += 1
            if n == 8:
                out.append(cur)
                cur = 0
                n = 0
    else:
        for b in bits:
            cur |= (b << n)
            n += 1
            if n == 8:
                out.append(cur)
                cur = 0
                n = 0
    returnbytes(out)

defextract_pwd_from_palette(gif: bytes):
    gct, pos = parse_gct(gif)
    bits = [(b >> 0) & 1for b in gct]
    msg = bits_to_bytes(bits, pack=\"msb\")
    return msg

defextract_delay_message(gif: bytes, start_pos: int):
    pos = start_pos
    letters = []
    while pos < len(gif):
        b = gif[pos]
        if b == 0x3B:  # trailer
            break
        if b == 0x21and gif[pos+1] == 0xF9:
            # Graphic Control Extension
            block_size = gif[pos+2]      # should be 0x04
            packed = gif[pos+3]
            delay_lo = gif[pos+4]
            delay_hi = gif[pos+5]
            delay = delay_lo + (delay_hi << 8)
            # delay_lo is used as ASCII
            if32 <= delay_lo < 127:
                letters.append(chr(delay_lo))
            pos += 2 + 1 + block_size + 1# 21 F9 + size + data + terminator
        elif b == 0x21:
            # other extension: skip subblocks
            pos += 2
            whileTrue:
                size = gif[pos]
                pos += 1
                if size == 0:
                    break
                pos += size
        elif b == 0x2C:
            # Image Descriptor: skip image data
            ipacked = gif[pos+9]
            lct_flag = (ipacked >> 7) & 1
            lct_size = 2 ** ((ipacked & 7) + 1) if lct_flag else0
            pos += 10 + 3*lct_size
            pos += 1# LZW min code size
            whileTrue:
                size = gif[pos]
                pos += 1
                if size == 0:
                    break
                pos += size
        else:
            pos += 1
    return\"\".join(letters)

defmain():
    raw = open(\"tellme.gift\", \"rb\").read()
    gif = fix_gif_header(raw)

    pwd_bytes = extract_pwd_from_palette(gif)
    print(\"[+] palette bit0(msb) =>\", pwd_bytes)

    _, pos_after_gct = parse_gct(gif)
    delay_msg = extract_delay_message(gif, pos_after_gct)
    print(\"[+] GCE delay_lo =>\", delay_msg)

if __name__ == \"__main__\":
    main()

得到deepsound的密码MENGMENG\_XIANG，解出一个压缩包，然后用上面的密码得到flag。
flag{1Ch1B4n\_SuK1\_N4\_W4t4sh1\_N1N4RuN0~}

Chimedal's goddess [solved]

文件名base62解码
发现是CCIR476，然后
写脚本

control = {
    \"1111000\": \"[CR]\",
    \"1101100\": \"[LF]\",
    \"1011010\": \"[LTRS]\",
    \"0110110\": \"[FIGS]\",
    \"1011100\": \" \",  # space
    \"1101010\": \"[BLK]\",
}

letters = {
    \"1000111\": \"A\",
    \"1110010\": \"B\",
    \"0011101\": \"C\",
    \"1010011\": \"D\",
    \"1010110\": \"E\",
    \"0011011\": \"F\",
    \"0110101\": \"G\",
    \"1101001\": \"H\",
    \"1001101\": \"I\",
    \"0010111\": \"J\",
    \"0011110\": \"K\",
    \"1100101\": \"L\",
    \"0111001\": \"M\",
    \"1011001\": \"N\",
    \"1110001\": \"O\",  # 修正：应该是字母O，不是数字0
    \"0101101\": \"P\",
    \"0101110\": \"Q\",
    \"1010101\": \"R\",
    \"1001011\": \"S\",
    \"1110100\": \"T\",
    \"1001110\": \"U\",
    \"0111100\": \"V\",
    \"0100111\": \"W\",
    \"0111010\": \"X\",
    \"0101011\": \"Y\",
    \"1100011\": \"Z\",
}

figures = {  # U.S. TTYs
    \"1000111\": \"-\",
    \"1110010\": \"?\",
    \"0011101\": \":\",
    \"1010011\": \"[WRU]\",  # Who are you
    \"1010110\": \"3\",
    \"0011011\": \"!\",
    \"0110101\": \"&\",
    \"1101001\": \"#\",
    \"1001101\": \"8\",
    \"0010111\": \"´\",
    \"0011110\": \"(\",
    \"1100101\": \")\",
    \"0111001\": \".\",
    \"1011001\": \",\",
    \"1110001\": \"9\",
    \"0101101\": \"0\",
    \"0101110\": \"1\",
    \"1010101\": \"4\",
    \"1001011\": \"'\",
    \"1110100\": \"5\",
    \"1001110\": \"7\",
    \"0111100\": \";\",
    \"0100111\": \"2\",
    \"0111010\": \"/\",
    \"0101011\": \"6\",
    \"1100011\": \"\\\"\",
}

# 二进制字符串
code = \"101101010010110110110010111010110101100101110010101010111101010100110111101001101010011100101101101010101101101000111100110110101011010110101001011110101001101101110100101101010101101011001100101101101101010110110101010110101110100011011001011011101010101101001101011110001110101011101000100111011011001011011000111101101001001110110110101010110110100101011\"

char_set = letters  # 默认从字母集开始
result = []

for i inrange(0, len(code), 7):
    c = code[i:i+7]

    if c in control:
        if control[c] == \"[LTRS]\":
            char_set = letters
        elif control[c] == \"[FIGS]\":
            char_set = figures
        else:
            # 只添加有意义的控制字符，跳过[CR]和[LF]等
            if control[c] notin [\"[CR]\", \"[LF]\"]:
                result.append(control[c])
    elif c in char_set:
        result.append(char_set[c])
    else:
        # 如果找不到对应的字符，添加未知标记
        result.append(f\"[UNKNOWN:{c}]\")

flag = \"flag{%s}\" % \"\".join(result)
print(flag)

最后按照要求改一下
flag{S1LLY IT M4K3S 5ENS3 T0 GO TW0\_W4Y}