1
import base64
2
import zlib
3
def xor(data, key):
4
    key_len = len(key)
5
    output = bytearray()
6
    for i in range(len(data)):
7
        output.append(data[i] ^ ord(key[i % key_len]))
8
    return output
9
def decode_payload(payload_b64, key):
10
    encrypted = base64.b64decode(payload_b64)
11
    compressed = xor(encrypted, key)
12
    decrypted = zlib.decompress(compressed)
13
    return decrypted
14
key = "9e94b15e"
15
payloads = [
16
    "Qflyeaz5Yk2XSRd9r+RlShEqaOPWNzUjlWOz",
17
    "QfnqGykd50oWSu77Svj4hOsi3zViuTxs0g==",
18
    "Qflyeaz5Yk2XSRd9r+RlqhAz7oBkMQo4P3s=",
19
    "QfkK4En5HYVzrnB4tRqcTbhVkwZpiQeWazcSwFB7RxaB7wpmEUP1r9lJOTbwIgE=",
20
    "Qflyeaz5Yk2XSRd9r+RlKndJaHypeHmyEswRZbWFM2WtPDCL",
21
    "Qfly/yt9misPVwx7UX2EsYxRjgSxBARRdreMACx95iiMUXaFLod5UI1Rc56H0zdlJ6I1JA=="
22
]
23
for i, p in enumerate(payloads):
24
    result = decode_payload(p, key)
25
    print(result)

1
from PIL import Image
2
import numpy as np
3
from Crypto.Cipher import AES
4
from Crypto.Util.Padding import unpad
5
class AES_LSB_Decryptor:
6
    def __init__(self, key):
7
        self.key = key
8
    def extract_data(self, image_path, bits_per_channel=1):
9
        img = Image.open(image_path)
10
        arr = np.array(img)
11
        height, width, channels = arr.shape
12
        bits = []
13
        for y in range(height):
14
            for x in range(width):
15
                for c in range(min(channels, 3)):
16
                    pixel_value = arr[y, x, c]
17
                    val = pixel_value & ((1 << bits_per_channel) - 1)
18
                    bits.append(format(val, f'0{bits_per_channel}b'))
19
        all_bits = "".join(bits)
20
        def bits_to_bytes(bit_str):
21
            byte_arr = bytearray()
22
            for i in range(0, len(bit_str), 8):
23
                byte = bit_str[i:i+8]
24
                if len(byte) < 8: break
25
                byte_arr.append(int(byte, 2))
26
            return bytes(byte_arr)
27

28
        full_data = bits_to_bytes(all_bits)
29
        data_len = int.from_bytes(full_data[:4], 'big')
30
        encrypted_payload = full_data[4 : 4 + data_len]
31
        return encrypted_payload
32

33
    def decrypt_data(self, encrypted_payload):
34
        iv = encrypted_payload[:16]
35
        ciphertext = encrypted_payload[16:]
36
        cipher = AES.new(self.key, AES.MODE_CBC, iv)
37
        decrypted_padded = cipher.decrypt(ciphertext)
38
        return unpad(decrypted_padded, AES.block_size).decode('utf-8')
39

40
def main_decrypt():
41
    STEGO_IMAGE = "C:\\Users\\CodeAtlantis\\Downloads\\task\\stego.png"
42
    AES_KEY = b"0123456789abcdef0123456789abcdef"
43
    decryptor = AES_LSB_Decryptor(key=AES_KEY)
44
    encrypted_data = decryptor.extract_data(STEGO_IMAGE)
45
    secret_message = decryptor.decrypt_data(encrypted_data)
46
    print(f"{secret_message}")
47

48
if __name__ == "__main__":
49
    main_decrypt()

1
from pwn import *
2

3
host = 'challenge.qsnctf.com'
4
port = 45991
5

6
r = remote(host, port)
7
low = 1 << 127
8
high = (1 << 128) - 1
9
found = False
10
secret = 0
11

12
print("Starting binary search...")
13

14
for i in range(200):
15
    mid = (low + high) // 2
16
    r.recvuntil(b'Choice: ')
17
    r.sendline(b'1')
18
    r.recvuntil(b'Enter a number: ')
19
    r.sendline(str(mid).encode())
20

21
    result = r.recvline().strip().decode()
22

23
    if result == 'less':
24
        low = mid + 1
25
    elif result == 'greater':
26
        high = mid - 1
27
    elif result == 'equal':
28
        secret = mid
29
        found = True
30
        print(f"Secret found: {secret}")
31
        break
32
    else:
33
        print(f"Unexpected response: {result}")
34
        break
35

36
if found:
37
    r.recvuntil(b'Choice: ')
38
    r.sendline(b'2')
39
    r.recvuntil(b'Enter secret number: ')
40
    r.sendline(str(secret).encode())
41

42
    flag = r.recvall().decode()
43
    print("Flag:", flag.strip())
44
else:
45
    print("Failed to find the secret within the attempts.")
46

47
r.close()