1.解压附件,得到mmm.png
2.mmm.png第0位bgr隐写,可用zsteg检测到:

3.使用stegsolve.jar 提取第0位bgr数据
4.修正png数据头 89504E7
5.修正高宽,高19,20字节,宽23,24字节
6.stegsolve.jar XOR 图像得到正确二维码或QR_Research自动修正读取
7.通过二维码得到url,并下载到flag.rar文件
8.解压得到flag.txt,注意:解压工具可能忽略ntfs流
9.ntfsStreamsEditor0将隐写数据导出flag.pyc
10.uncompyle6 flag.pyc > flag.py
11.据encode,编写decode
def encode():
flag = '*************'
ciphertext = []
for i in range(len(flag)):
s = chr(i ^ ord(flag[i]))
if i % 2 == 0:
s = ord(s) + 10
else:
s = ord(s) - 10
ciphertext.append(str(s))
return ciphertext[::-1]ciphertext = ['96', '65', '93', '123', '91', '97', '22', '93', '70', '102', '94', '132', '46', '112', '64', '97', '88', '80', '82', '137', '90', '109', '99', '112']
def decode():
flag=[]
for i,v in enumerate(ciphertext[::-1]):
s=int(v)
if i%2==0:
s-=10
else:
s+=10
flag.append(chr(i^s))
print(''.join(flag))decode()