ISCC2018MISC猫的心事writeup

 

 

用winhex打开   明显看到WPS office 还有罗马字体什么鬼    猜测图片后面藏了一个

Word文档

 

搜索DOC文件头D0CF11E0

 

 

可以看到FFD9 jpg结束标志

下面就是DOC文件头

 

一直从文件头选中到最后非0部分

保存为新文件   命名XXX.doc

 

打开XXX 发现是大段佛语   想到是与佛论禅  一种加密手法

方法参考：  

https://blog.****.net/xiangshangbashaonian/article/details/80171460

 

解密后 

 

523156615245644E536C564856544E565130354B553064524D6C524E546B4A56535655795645644F5530524857544A4553553943566B644A4D6C524E546C7052523155795645744F536C5248515670555330354452456456576B524854554A585231457956554E4F51305A4855544E4553303153566B64424D6C524A546B7058527A525A5245744F576C5A4854544A5554553554513063304E46524C54564A5652316B795255744F51305A4856544E5554564661566B6C464D6B5252546B70595231557A5245394E516C5A4856544A555355354B566B644E5756524E5455705752316B7A5255564F55305248566B465553564A4356306C4E4D6C524E546B4A565231557952453152556C564A56544A455555354B5530644E5756525054554A56523030795645314F516C5A4857544A4553303143566B64464D305648546B744352314A425645744F576C5A4855544A4651303543566B64564D6B524854554A555230557A52454E4F536C644855544A5554553543566B645A4D6B564A546C4E445231566152456C52576C5A4855544A5553303544516B64564D6C524C54564A55523045795245314F556C4A4856544E455355354B56556C564D6B564E546B70535230315A52457452536C564951544A555455354B565564535156524A54564A575230457956456C4E576C46485454525553303143566B6446576C564A54544A46

 

还是复制到winhex

 

把右侧字符复制出来

 

猜测为base64加密

解密后再base32

再base16

 

接着再来一轮base全家桶

 

即可得到flag