[BUUCTF-misc] 二维码

拿到一个二维码.

使用WEBQR没扫出什么.

暗示从文件包含入手(本来就是1分题能有啥Trick)
binwalk拿到一个压缩包

有密码,暗示4位数字.
那直接上fcrackzip暴力破.

fcrackzip -b -l 4-4 -c 1 -p 0000 /root/桌面/Chanel/_QR_code.png.extracted/1D7.zip

也不是很多.但是懒得手输直接上脚本.
源码如下:

'''
@Description:Unzip Script
@Date: 2020-01-14 17:22:16
@Author: I-Hsien
@LastEditors  : I-Hsien
@LastEditTime : 2020-01-14 17:31:07
'''
import os
if __name__=="__main__":
	codelist=['0149','0690','1106','1358','1739','1786','1801','2316','2389','2773','2845','2988','3149','3151','3717','3720','3757','3854','4281','4363','4560','4884','4985','6207','6246','6325','6326','6398','6851','6962','6985','7127','7639','7803','8409','8430','8522']
	print("Start Listing...")
	for i in codelist:
		command="unzip -c -P "+i+" /root/桌面/Chanel/_QR_code.png.extracted/1D7.zip"
		print(command)
		print (os.system(command))
	print("Finished")

codelist是用正则从输出文本筛选出来的.
用Python3跑一遍,输出结果到log里
python3 /root/桌面/Chanel/unzip_script.py > output.log

发现flag,拿下.