[ misc 知识点 ] 例题：音视频隐写

例题-音视频隐写

← 返回 2.音视频隐写

[SWPU 2019]神奇的二维码

• 波形图
• 摩斯密码
• base64多层解码

扫码获得swpuctf{flag_is_not_here}假flag

010打开看到一整段rar

如果复制出来单独作为.rar 或者把.png后缀改成.rar 都可能会漏文件

binwalk分离binwalk -eM /home/kali/Desktop/2wm.png

文件encode.txt经过base64解码获得asdfghjkl1234567890 是看看flag在不在里面^_^.rar的密码

flag.doc跑一个多次base64解码的脚本

import base64
import sys
import re

def is_base64(s):
    """判断字符串是否可能是 Base64 编码"""
    if isinstance(s, str):
        # Base64 只包含字母、数字、+、/，结尾最多两个 '='
        s = s.strip()
        if len(s) == 0:
            return False
        if not re.fullmatch(r'[A-Za-z0-9+/]*={0,2}', s):
            return False
        # 长度必须是 4 的倍数
        if len(s) % 4 != 0:
            return False
        return True
    return False

def multi_decode(data):
    """多次 Base64 解码，直到失败或得到非 Base64 内容"""
    current = data.encode() if isinstance(data, str) else data
    step = 0

    while True:
        try:
            # 尝试 Base64 解码
            decoded = base64.b64decode(current)
            step += 1
            print(f"[Step {step}] Decoded: {decoded}")

            # 检查解码后的内容是否仍是 Base64 字符串（作为文本）
            try:
                decoded_str = decoded.decode('utf-8')
                if is_base64(decoded_str):
                    current = decoded  # 下一轮用 bytes 继续解码
                    continue
                else:
                    print("\n[+] Final result (not Base64 anymore):")
                    print(decoded_str)
                    return decoded_str
            except UnicodeDecodeError:
                # 如果不是文本（比如是二进制），则停止
                print("\n[+] Final result is binary data:")
                print(decoded)
                return decoded

        except Exception as e:
            print(f"\n[!] Decoding stopped at step {step}: {e}")
            try:
                print("Last readable content:", current.decode('utf-8', errors='replace'))
            except:
                print("Last content (binary):", current)
            return current

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print("Usage:")
        print("  python multi_base64_decode.py <string>")
        print("  python multi_base64_decode.py file:<filename>")
        sys.exit(1)

    input_arg = sys.argv[1]

    if input_arg.startswith("file:"):
        filename = input_arg[5:]
        with open(filename, 'r') as f:
            content = f.read().strip()
    else:
        content = input_arg.strip()

    print("[*] Starting multi-layer Base64 decoding...")
    print("[Input]:", content)
    print("-" * 50)
    multi_decode(content)

comEON_YOuAreSOSoS0great是18394的密码

用Audacity打开 是摩斯密码

-- --- .-. ... . .. ... ...- . .-. -.-- ...- . .-. -.-- . .- ... -.--

flag{morseisveryeasy}

那个龙图表情包是干扰项

[SWPU 2020]找找吧

• 波形图
• 摩斯密码
• md5

010打开找找吧.rar末尾获得findme.mp3的密码PPPaAaS

音乐末尾提取摩斯密码 解码获得D43963E92B012AAB

并不是secret.rar的密码

https://www.somd5.com/ 解码获得n1ce_try

不知道为什么n1ce_try这个密码不行了 断了 何意味

010打开findme.mp3发现是rar文件 后缀名改成.rar

解压获得采茶纪.mp3和哈哈哈.png

[SWPU 2024 新生引导]一段有规律的声音

**关注异世界情绪小姐谢谢喵~
**答案格式为一串能连成话的简单英语主谓宾句子，请所有字母全部大写,空格用_代替后包裹NSSCTF{}

• 摩斯密码

好好听的歌（关注异世界情绪小姐谢谢喵），诶，前面这段声音为什么这么有规律，难不成这藏了什么信息？怎么听着好像是几段重复的？
答案格式为一串能连成话的简单英语主谓宾句子，请所有字母全部大写,空格用_代替后包裹NSSCTF{}(提示：不止一种解法)

听音乐听出来旋律重复 而且只有两个音 听了半天主要不知道怎么断这个摩斯密码

仔细听了一会就能断句了

听歌识曲你赢了

flag{I_LOVE_YOU}其实这个题应该算波形图捏

[NewStarCTF2025w2]美妙的音乐

midi隐写 理论上要用miditrail查看 但是AU就可以了

flag{thi5_1S_m1Di_5tEG0}

[HDCTF 2023]MasterMisc

• 拼接文件碎片
• 暴力破解
• png宽高修改
• 频谱图

010打开发现 这些topic碎片拼接起来就是一个完整的topic.zip

import os

## [UTCTF 2020]Spectre

- [x] 频谱图

![例题-音视频隐写-12](/img/obsidian/misc-examples-av/例题-音视频隐写-12.png)

`utflag{sp3tr0gr4m0ph0n3}`

[LitCTF 2024]Every Where We Go

**去到每一度，点解总会有得嘈~****| flag头改为LitCTF{}**

- [x] 频谱图

![例题-音视频隐写-13](/img/obsidian/misc-examples-av/例题-音视频隐写-13.png)

`LitCTF{Calculate_Step_By_Step}`

## [GHCTF 2025]mywav

**来源于实验者，亦可用实验去之**

- [x] 波形图
- [x] 二进制高低频提取（py脚本）
- [x] `From Binary`
- [ ] 维吉尼亚密码无密钥
- [x] Oursecret

听得我感觉鼓膜要穿孔了（思考 应该是高频低频交替的噪音 可能使用频率调制编码二进制数据

点放大 放大 放大 高频段和低频段交替出现 每个频率段持续时间也相同

推断这是二进制编码 暂定高频是1 低频是0

写个脚本提取二进制数据

![例题-音视频隐写-14](/img/obsidian/misc-examples-av/例题-音视频隐写-14.png)

![例题-音视频隐写-15](/img/obsidian/misc-examples-av/例题-音视频隐写-15.png)

import numpy as np
from scipy.io import wavfile

def extract_binary_from_wav(file_path, threshold_freq, output_path):
sample_rate, data = wavfile.read(file_path)

if len(data.shape) > 1:
    data = data[:, 0]

window_size = int(sample_rate * 0.01)  # 10ms窗口
binary_data = []

for i in range(0, len(data), window_size):
    window = data[i:i + window_size]
    if len(window) < window_size:
        break

    fft_result = np.fft.fft(window)
    freqs = np.fft.fftfreq(len(window), d=1/sample_rate)
    
    magnitude = np.abs(fft_result)
    
    max_index = np.argmax(magnitude[:len(magnitude)//2])
    dominant_freq = freqs[max_index]

    binary_value = 1 if dominant_freq >= threshold_freq else 0
    binary_data.append(binary_value)

with open(output_path, "w") as f:
    binary_string = "".join(map(str, binary_data))
    f.write(binary_string)
print(f"提取的二进制数据已保存到 {output_path}")

file_path = “attachment.wav”
output_path = “output.txt”
threshold_freq = 500 # 设定高低频的分界点
extract_binary_from_wav(file_path, threshold_freq, output_path)

`pip install scipy`

`python xxx.py`

获得的二进制数据`From Binary`

![例题-音视频隐写-16](/img/obsidian/misc-examples-av/例题-音视频隐写-16.png)

数字未被加密，说明是维吉尼亚密码。因为维吉尼亚是多表替换，数字通常保留原样

单表替换（如凯撒）无法保留数字不变且产生如此长的类英文文本。

维吉尼亚密文在密钥较长时，IC接近 0.038–0.045，适合无密钥破解

YbAgLvWkQbFp qk k 2021 Gfgbyue gxriobzqgx hpyau utnkxmgz Jpwx Dfcmocn ngj Bn Flvytmc. Gh cu bnlkh hg apw Mlglsmg nbokp Lxjzwdw gl hbg Lnmzmvx. Apw cipgsm ciexj sg Fhvyy XT dfio Ahzawm 10 nubav Eseimv 26, 2021.

Tux yikbla zkw qsfjcsfxj e vntcdkxgts pkejxxwabw wx 1.3 lmjjwip apkuwl ohzayyq nzuvfbksw, bgjtmnmle Aupgb MB’w whtmkdma ydjniptzmhg, FwmDyzc, ohf Tutoptgk BjeiGB.

Gspoclow

Mal awbmcq hynlf mni lmvzq yj y qijgrvhx egw bvjepw aogruf fgpx zvl Rrss Qwswe (Pakr Salgmkr) ylr u jenwyxkhuo, kdyzzclp, aaw rsoxsg Usrbcfynln zove, Wpvy Hmyl (Lo Oeazpmx). Yywe liglu gwthtrpr xekdewgts ncbyxsemxz il cgfmcf vo oxisfbuo wkgf mhbgr’f eojxevvy msknohkoal or malqj tsspbya tukuyza fwmdl. Yjhbquta zlxr jwmvhl’r gncnq xgga hapwb er dwlut, gakc vhtm ly ennfyeinmk itvo wlrip’q gnteazzll bu bzomp bos-vo-qte mgmlzsmxgmbm.

Oavg

Ilxg Gpwiyyl om Bhbn Ymrnl
I qyyle, vupdfhsi lvowdkv ufc yzuqxy eg tpz gp ejmczpefl grw bubwvpgeshee. Qxytbml pac gmjr upd qbyxtga mpdipgcl, je chywxlzmk k kclhfg aaw jimxyuaxib lonwrr mnem wyqnow fga nq phkyyx apa axrcpaiut qxymkxz. Qf dlc dowg os ygqbef kzkpjcbags, ux xiftpvk biqmzove vg nml ibzkemr mt bks qkkefl.

Ec Eorehwy cs Qbtk Qbhv
Sx yluopgrvgm egw kmlovkgbyf ybntk phtif glm lspgr gnxrl tdiq pvmk qbclyxtkxl bvlsp qfs zccrl gr bgzcjwsslhudlr hhwmtjtw. Rip jwzg uawkvpxub s nvykonkc gkgrlyvzekxgmb qjea lni kxswukxcb tlqm n lseee awox xm Qvyphnb Immr. Pvxvyclqyf bl akv rhbbzpyj gajwlfbbigxza kri qfcqeafx nik ypmjmi bchytmvggxbhu ifn yluopgrvgm tnkzcad sd fsl ioney.

Whflbzsre Nomuwbkj

WhecmA7DsE3rTf4i

没思路 搜了一下wp 维吉尼亚密码无密钥 实在找不到网址 先搜个解码结果做下去

[https://www.dcode.fr/vigenere-cipher](https://www.dcode.fr/vigenere-cipher)

我找到这个网址 实在不会用 保留

AnGeLiDeMiMi is a 2021 Chinese television drama starring Chen Zheyuan and Xu Mengjie. It is based on the Chinese novel Secrets in the Lattice. The series aired on Mango TV from August 10 until August 26, 2021.

The series has surpassed a cumulative viewership of 1.3 billion across various platforms, including Mango TV’s domestic application, YouTube, and Thailand TrueID.

Synopsis

The series tells the story of a superior and unruly campus male god Zhou Siyue (Chen Zheyuan) and a headstrong, stubborn, and lovely Cinderella girl, Ding Xian (Xu Mengjie). From being mutually exclusive tablemates at school to becoming each other’s lifelong companions in their journey through youth. Although they couldn’t stand each other at first, they come to appreciate each other’s strengths in their day-to-day interactions.

Main

Chen Zheyuan as Zhou Siyue
A young, handsome scholar who exudes an air of aloofness and intelligence. Despite his cold and distant exterior, he possesses a gentle and determined nature that drives him to pursue his innermost desires. In the face of family challenges, he remains resolute in his pursuit of his dreams.

Xu Mengjie as Ding Xian
An unwavering and determined young woman who never turns away from challenges until she faces an insurmountable obstacle. Her life underwent a dramatic transformation when she relocated from a small town to Shenhai City. Influenced by her youthful impulsiveness she showcase her fierce determination and unwavering pursuit of her goals.

Something Password

SolveI7ToG3tFl4g
————————————————
版权声明：本文为CSDN博主「mrl64」的原创文章，遵循CC 4.0 BY-SA版权协议，转载请附上原文出处链接及本声明。
原文链接：https://blog.csdn.net/qq_63923205/article/details/146015873

明显的密钥`SolveI7ToG3tFl4g`

还是电视剧《暗格里的秘密》的英文维基介绍

![例题-音视频隐写-17](/img/obsidian/misc-examples-av/例题-音视频隐写-17.png)

提示使用工具`OurSecret`

![例题-音视频隐写-18](/img/obsidian/misc-examples-av/例题-音视频隐写-18.png)

`NSSCTF{9c99897d-5ea3-481c-b0a5-029fec9eaf42}`

## [GDOUCTF 2023]t3stify

![例题-音视频隐写-19](/img/obsidian/misc-examples-av/例题-音视频隐写-19.png)

原始声道是双声道的WAV

用Audacity把他拆成两个单声道文件：

`l`:左声道（右声道部分被清零）

`r`:右声道（左声道部分被清零）

每个采样点在wav中通常占据4字节（2字节左 2字节右）

即使拆开以后 AU仍然保持4字节结构 只是不用的那个声道填0

左右两个单声道WAV文件，通过计算它们每一时刻音频数据的差值，生成一个新的“差值音频”文件

![例题-音视频隐写-20](/img/obsidian/misc-examples-av/例题-音视频隐写-20.png)

右键轨道 选择`分离立体声到单声道`

![例题-音视频隐写-21](/img/obsidian/misc-examples-av/例题-音视频隐写-21.png)

![例题-音视频隐写-22](/img/obsidian/misc-examples-av/例题-音视频隐写-22.png)

分别导出左声道`l.raw`和右声道`r.raw` 跑一下差值脚本

[SWPUCTF 2023 秋季新生赛]升天

魔法邮票嗑大了以至于我能看见她在唱什么****hint1：右声道存在SSTV

[NSSRound#4 SWPU]Type Message

使用在线工具

https://dtmf.netlify.app/

NSSCTF{DTMFISREALLYEASY}

[WUSTCTF 2020]girlfriend

I want a girl friend !!!

Decoded: 999*666*88*2*777*33*6*99*4*444*777*555*333*777*444*33*66*3*7777

手机键盘加密 自己掏出手机用九键试试完了

flag{youaremygirlfriends}

[SWPUCTF 2022 新生赛]Call the Alien

Hear, this voice maybe in space

cd /home/kali/Desktop

sox "Call_the_Alien.wav" -r 48000 -b 16 -c 1 output.wav

NSSCTF{5a0025e4-

5063-4632-95e5-a32742ea312d}

NSSCTF{5a0025e4-5063-4632-95e5-a32742ea312d}

[HGAME 2022 week1]群青 (其实是幽灵东京)

好的好的 拿到密码就try try

看频谱图获得密码Yoasobi我也很喜欢夜游嗯嗯

[SCTF 2020]Can you hear

我们用接收机收到了来自空间站传来的信息, 尝试解开答案

cd /home/kali/Desktop

sox "cuh.wav" -r 48000 -b 16 -c 1 output.wav

SCTF{f78fsd1423fvsa}

[SWPU 2020]耗子尾汁

binwalk分离

http://kaibaflow.com/

c2lnbl9pbg==``base64解码获得sign_in作为密码可以打开2B8937.zip

R1pCVE9OUlhHVTNES05SWkdZWVRNUVJYSEEzVEtOUlVHNFpUT09KWEdFM0RLTlJZRzRaVE9RSlhHRTNEUU5aWkdaQkRNTlpXRzQzVEdOWlpHNDRUTVFaV0lJM1RNTlpXR1k0UT09PT0=

//The last layer is the single table replacement password

From Base64>>From Base32>>From Hex

lvueiakxudsyqehszqhykggsyylkvvi

最后一层是仿射密码 密码是文件名 19和20

http://www.hiencode.com/affine.html

flag{youhavesignedinsuccessfully}

[FSCTF 2023]夜深人静的时候也会偷偷emo

想哭，想听歌。凌晨三点的大街还是那么冰冷

爆破获得密码12345

cd C:\Users\13964\Desktop\MP3Stego\MP3Stego

Decode.exe -X -P 12345 flag.mp3

FSCTF{CemMEnt_Se@1s_tHe_heaaaaaart_foR_An0ther_D@y}

[SWPU 2019]Network