[ misc 知识点 ] 例题：压缩包分析

例题-压缩包分析

← 返回 4.压缩包分析

[GHCTF 2025]mybrave

C:\Users\13964>cd C:\Users\13964\Desktop\mybrave

C:\Users\13964\Desktop\mybrave>bkcrack.exe -C mybrave.zip -c mybrave.png -x 0 89504E470D0A1A0A0000000D49484452
bkcrack 1.8.1 - 2025-10-25
[00:04:49] Z reduction using 9 bytes of known plaintext
100.0 % (9 / 9)
[00:04:49] Attack on 704864 Z values at index 6
Keys: 97d30dcc 173b15a8 6e0e7455
34.5 % (242989 / 704864)
Found a solution. Stopping.
You may resume the attack with the option: --continue-attack 242989
[00:06:43] Keys
97d30dcc 173b15a8 6e0e7455

C:\Users\13964\Desktop\mybrave>bkcrack.exe -C mybrave.zip -c mybrave.png -k 97d30dcc 173b15a8 6e0e7455 -d mybrave
bkcrack 1.8.1 - 2025-10-25
[00:08:44] Writing deciphered data mybrave
Wrote deciphered data (not compressed).

C:\Users\13964\Desktop\mybrave>

在mybrave的文件夹里获得mybrave用010查看 是png图片 后缀名改成.png

NSSCTF{I'm_Wh1sp3riNg_OuR_Lu11abY_f0r_Y0u_to_CoMe_B4ck_Home}

[HDCTF 2023]ExtremeMisc

压缩！压缩！压缩！！！

010看出图片中嵌套了压缩包

binwalk -eM

bandzip打开获得不加密的17C00.zip里面有不加密的Dic.zip里面有加密的Reserve.piz

AECHPR爆破 获得密码haida

010打开Reserve.piz

本应是50 4B 03 04 AB这里却是05 B4 30 40 BA

解压获得两个加密压缩包

ARCHPR爆破获得密码9724

这是secret.zip的密码 解压获得d97a05ab-ded8-4bf8-a3f7-8029315800cd

不知为何到这里明文攻击完成不了 说是无法打开zip文件 检查了半天也没看出问题

NSSCTF{u_a_a_master_@_c0mpRe553d_PaCKe1s}

[HGAME 2022 week1]这个压缩包有点麻烦