DASCTF X CBCTF 2023 Misc Justlisten WP

DASCTF X CBCTF 2023 Misc Justlisten WP

又是一道很抽象的misc题
首先附件给了一个汉信码，扫码得到：

提示我们使用oursecret：
password为0urS3cret，得到

haha.txt里有一串疑似编码表的东西

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890_}{-?!

然后附件里还有一串音频：

看起来频率分布比较奇怪
先用python统计出音频的总样本数：

from scipy.io import wavfile

# 读取.wav文件
sample_rate, audio_data = wavfile.read(r"D:\download\justlisten\justlisten\嘘.wav")
total_samples = len(audio_data)

# 输出音频的总样本数
print(f"总样本数: {total_samples}")

该音频共37.8秒

于是每0.1秒就有4410个样本
我们对音频进行处理：

from scipy.io import wavfile

# 读取.wav文件
sample_rate, audio_data = wavfile.read(r"D:\download\justlisten\justlisten\嘘.wav")

# 每4410个样本为一段
segment_length = 4410

# 获取音频数据的长度
audio_length = len(audio_data)

# 初始化列表来存储统计结果
first_values_statistics = []
second_values_statistics = []

# 分段、处理和存储值的统计结果
for i in range(1, audio_length, segment_length):
    segment = audio_data[i:i + segment_length]
    first_values=segment[0]
    second_values = segment[1]  
    first_values_statistics.append(first_values)
    second_values_statistics.append(second_values)
print(first_values_statistics)
print(second_values_statistics)

得到：

[3726, 7859, 3726, 3726, 3726, 5114, 3726, 7859, 3726, 6949, 3726, 3726, 3726, 5114, 3726, 7859, 4190, 3726, 3726, 3726, 3726, 5114, 4190, 3726, 3726, 3726, 3726, 6949, 4190, 3726, 3726, 5114, 3726, 6949, 4190, 3726, 3726, 3726, 4652, 4652, 3726, 6949, 3726, 5114, 4190, 3726, 3726, 6034, 4190, 7859, 4652, 4652, 3726, 5114, 4652, 3726, 5114, 5575, 5114, 4652, 4652, 7405, 5575, 5575, 4652, 6492, 4652, 7405, 5575, 6949, 5114, 6034, 4652, 6949, 5575, 7405, 5114, 6492, 4652, 7859, 4652, 6949, 5575, 4652, 5575, 4652, 5575, 7405, 5575, 4652, 5575, 6492, 5114, 4190, 5575, 6949, 4652, 7405, 4652, 6949, 5114, 5575, 5575, 4652, 5575, 7405, 5114, 6949, 5114, 6492, 4652, 7859, 5575, 4652, 5114, 5114, 5575, 6492, 3726, 6949, 4652, 3726, 3726, 7405, 3726, 6492, 4652, 5575, 3726, 6492, 4190, 7405, 4190, 4190, 4190, 3726, 3726, 4652, 4190, 5114, 4190, 7405, 3726, 5575, 3726, 4190, 3726, 3726, 3726, 7859, 4652, 3726, 4190, 5575, 3726, 5114, 3726, 7405, 4190, 4190, 4190, 3726, 3726, 3726, 4190, 7405, 4190, 5114, 4652, 4190, 3726, 3726, 4190, 5575, 4190, 4190, 4652, 4652, 3726, 6034, 4190, 5114, 3726, 4652, 4190, 3726, 4652, 3726, 3726, 4190, 3726, 3726, 3726, 6492, 4652, 4190, 4190, 7405, 4190, 5575, 3726, 7405, 5114, 6949, 5114, 5114, 5114, 6492, 4652, 7405, 4190, 5114, 4190, 3726, 3726, 5114, 3726, 4190, 3726, 7859, 4652, 4190, 3726, 7405, 4652, 3726, 4190, 7405, 3726, 5575, 3726, 7405, 3726, 6034, 4190, 4190, 3726, 6949, 3726, 3726, 4652, 4652, 4190, 5114, 4190, 3726, 4652, 4190, 3726, 4190, 3726, 7859, 4190, 3726, 3726, 5114, 4652, 4190, 4190, 4190, 3726, 5575, 4190, 7405, 4190, 3726, 3726, 3726, 3726, 6034, 4190, 5114, 4190, 3726, 3726, 3726, 4652, 4652, 4190, 6034, 4190, 5575, 3726, 6034, 4190, 5575, 4190, 6034, 3726, 3726, 3726, 6034, 4190, 5575, 4652, 7859, 4652, 6492, 5575, 5575, 4652, 7405, 5575, 6034, 5114, 4190, 6492, 5575, 5575, 7405, 3726, 6949, 6034, 4652, 4190, 7405, 4190, 7859, 4190, 4190, 3726, 7405, 4190, 5114, 3726, 6492, 6492, 4652, 4190, 7859, 6492, 4190, 6492, 4652, 4652, 7405, 4190, 5575, 4190, 5114, 4652, 4190, 3726, 5575, 4652, 5575, 6492, 4652, 3726, 7405, 4190, 5114, 3726, 6034, 4190, 5575, 4190, 6949, 4190, 4652, 3726, 3726, 4190, 7859, 6034, 4652, 4190, 5575, 4190, 5114, 6492, 6949, 6492, 6949, 6492, 6949, 6492, 5114]
[7405, 15259, 7405, 7405, 7405, 10103, 7405, 15259, 7405, 13583, 7405, 7405, 7405, 10103, 7405, 15259, 8311, 7405, 7405, 7405, 7405, 10103, 8311, 7405, 7405, 7405, 7405, 13583, 8311, 7405, 7405, 10103, 7405, 13583, 8311, 7405, 7405, 7405, 9211, 9211, 7405, 13583, 7405, 10103, 8311, 7405, 7405, 11862, 8311, 15259, 9211, 9211, 7405, 10103, 9211, 7405, 10103, 10987, 10103, 9211, 9211, 14427, 10987, 10987, 9211, 12728, 9211, 14427, 10987, 13583, 10103, 11862, 9211, 13583, 10987, 14427, 10103, 12728, 9211, 15259, 9211, 13583, 10987, 9211, 10987, 9211, 10987, 14427, 10987, 9211, 10987, 12728, 10103, 8311, 10987, 13583, 9211, 14427, 9211, 13583, 10103, 10987, 10987, 9211, 10987, 14427, 10103, 13583, 10103, 12728, 9211, 15259, 10987, 9211, 10103, 10103, 10987, 12728, 7405, 13583, 9211, 7405, 7405, 14427, 7405, 12728, 9211, 10987, 7405, 12728, 8311, 14427, 8311, 8311, 8311, 7405, 7405, 9211, 8311, 10103, 8311, 14427, 7405, 10987, 7405, 8311, 7405, 7405, 7405, 15259, 9211, 7405, 8311, 10987, 7405, 10103, 7405, 14427, 8311, 8311, 8311, 7405, 7405, 7405, 8311, 14427, 8311, 10103, 9211, 8311, 7405, 7405, 8311, 10987, 8311, 8311, 9211, 9211, 7405, 11862, 8311, 10103, 7405, 9211, 8311, 7405, 9211, 7405, 7405, 8311, 7405, 7405, 7405, 12728, 9211, 8311, 8311, 14427, 8311, 10987, 7405, 14427, 10103, 13583, 10103, 10103, 10103, 12728, 9211, 14427, 8311, 10103, 8311, 7405, 7405, 10103, 7405, 8311, 7405, 15259, 9211, 8311, 7405, 14427, 9211, 7405, 8311, 14427, 7405, 10987, 7405, 14427, 7405, 11862, 8311, 8311, 7405, 13583, 7405, 7405, 9211, 9211, 8311, 10103, 8311, 7405, 9211, 8311, 7405, 8311, 7405, 15259, 8311, 7405, 7405, 10103, 9211, 8311, 8311, 8311, 7405, 10987, 8311, 14427, 8311, 7405, 7405, 7405, 7405, 11862, 8311, 10103, 8311, 7405, 7405, 7405, 9211, 9211, 8311, 11862, 8311, 10987, 7405, 11862, 8311, 10987, 8311, 11862, 7405, 7405, 7405, 11862, 8311, 10987, 9211, 15259, 9211, 12728, 10987, 10987, 9211, 14427, 10987, 11862, 10103, 8311, 12728, 10987, 10987, 14427, 7405, 13583, 11862, 9211, 8311, 14427, 8311, 15259, 8311, 8311, 7405, 14427, 8311, 10103, 7405, 12728, 12728, 9211, 8311, 15259, 12728, 8311, 12728, 9211, 9211, 14427, 8311, 10987, 8311, 10103, 9211, 8311, 7405, 10987, 9211, 10987, 12728, 9211, 7405, 14427, 8311, 10103, 7405, 11862, 8311, 10987, 8311, 13583, 8311, 9211, 7405, 7405, 8311, 15259, 11862, 9211, 8311, 10987, 8311, 10103, 12728, 13583, 12728, 13583, 12728, 13583, 12728, 10103]

发现每个列表中都只有10种不同的数值
我们对第二个列表进行分析（第一个也行）：

得到所有值从小到大排列的列表：

sorted_values = [7405, 8311, 9211, 10103, 10987, 11862, 12728, 13583, 14427, 15259]

然后按顺序将第二个列表中对应的依次替换为0~9：

sorted_values = [7405, 8311, 9211, 10103, 10987, 11862, 12728, 13583, 14427, 15259]
data = [7405, 15259, 7405, 7405, 7405, 10103, 7405, 15259, 7405, 13583, 7405, 7405, 7405, 10103, 7405, 15259, 8311,
        7405, 7405, 7405, 7405, 10103, 8311, 7405, 7405, 7405, 7405, 13583, 8311, 7405, 7405, 10103, 7405, 13583, 8311,
        7405, 7405, 7405, 9211, 9211, 7405, 13583, 7405, 10103, 8311, 7405, 7405, 11862, 8311, 15259, 9211, 9211, 7405,
        10103, 9211, 7405, 10103, 10987, 10103, 9211, 9211, 14427, 10987, 10987, 9211, 12728, 9211, 14427, 10987, 13583,
        10103, 11862, 9211, 13583, 10987, 14427, 10103, 12728, 9211, 15259, 9211, 13583, 10987, 9211, 10987, 9211,
        10987, 14427, 10987, 9211, 10987, 12728, 10103, 8311, 10987, 13583, 9211, 14427, 9211, 13583, 10103, 10987,
        10987, 9211, 10987, 14427, 10103, 13583, 10103, 12728, 9211, 15259, 10987, 9211, 10103, 10103, 10987, 12728,
        7405, 13583, 9211, 7405, 7405, 14427, 7405, 12728, 9211, 10987, 7405, 12728, 8311, 14427, 8311, 8311, 8311,
        7405, 7405, 9211, 8311, 10103, 8311, 14427, 7405, 10987, 7405, 8311, 7405, 7405, 7405, 15259, 9211, 7405, 8311,
        10987, 7405, 10103, 7405, 14427, 8311, 8311, 8311, 7405, 7405, 7405, 8311, 14427, 8311, 10103, 9211, 8311, 7405,
        7405, 8311, 10987, 8311, 8311, 9211, 9211, 7405, 11862, 8311, 10103, 7405, 9211, 8311, 7405, 9211, 7405, 7405,
        8311, 7405, 7405, 7405, 12728, 9211, 8311, 8311, 14427, 8311, 10987, 7405, 14427, 10103, 13583, 10103, 10103,
        10103, 12728, 9211, 14427, 8311, 10103, 8311, 7405, 7405, 10103, 7405, 8311, 7405, 15259, 9211, 8311, 7405,
        14427, 9211, 7405, 8311, 14427, 7405, 10987, 7405, 14427, 7405, 11862, 8311, 8311, 7405, 13583, 7405, 7405,
        9211, 9211, 8311, 10103, 8311, 7405, 9211, 8311, 7405, 8311, 7405, 15259, 8311, 7405, 7405, 10103, 9211, 8311,
        8311, 8311, 7405, 10987, 8311, 14427, 8311, 7405, 7405, 7405, 7405, 11862, 8311, 10103, 8311, 7405, 7405, 7405,
        9211, 9211, 8311, 11862, 8311, 10987, 7405, 11862, 8311, 10987, 8311, 11862, 7405, 7405, 7405, 11862, 8311,
        10987, 9211, 15259, 9211, 12728, 10987, 10987, 9211, 14427, 10987, 11862, 10103, 8311, 12728, 10987, 10987,
        14427, 7405, 13583, 11862, 9211, 8311, 14427, 8311, 15259, 8311, 8311, 7405, 14427, 8311, 10103, 7405, 12728,
        12728, 9211, 8311, 15259, 12728, 8311, 12728, 9211, 9211, 14427, 8311, 10987, 8311, 10103, 9211, 8311, 7405,
        10987, 9211, 10987, 12728, 9211, 7405, 14427, 8311, 10103, 7405, 11862, 8311, 10987, 8311, 13583, 8311, 9211,
        7405, 7405, 8311, 15259, 11862, 9211, 8311, 10987, 8311, 10103, 12728, 13583, 12728, 13583, 12728, 13583, 12728,
        10103]
new_data = []
for i in data:
    if i == sorted_values[0]:
        new_data.append(0)
    if i == sorted_values[1]:
        new_data.append(1)
    if i == sorted_values[2]:
        new_data.append(2)
    if i == sorted_values[3]:
        new_data.append(3)
    if i == sorted_values[4]:
        new_data.append(4)
    if i == sorted_values[5]:
        new_data.append(5)
    if i == sorted_values[6]:
        new_data.append(6)
    if i == sorted_values[7]:
        new_data.append(7)
    if i == sorted_values[8]:
        new_data.append(8)
    if i == sorted_values[9]:
        new_data.append(9)
for i in new_data:
    print(i, end='')

得到一个字符串：

090003090700030910000310000710030710002207031005192203203432284426284735274836292742424842463147282734424837362942334607200806240618111002131804010009201403081110001813210014112205130210200100062118140837333628131003010921082018040805110700221310210109100321110418100005131000221514051415000514292644284531644807521819110813066219616228141321042462081305141712001952141367676763

然后将它们两两分组，转化为数字：

str = "090003090700030910000310000710030710002207031005192203203432284426284735274836292742424842463147282734424837362942334607200806240618111002131804010009201403081110001813210014112205130210200100062118140837333628131003010921082018040805110700221310210109100321110418100005131000221514051415000514292644284531644807521819110813066219616228141321042462081305141712001952141367676763"

# 将每两个字符转换为十进制数
decimal_values = [int(str[i:i + 2], 10) for i in range(0, len(str), 2)]

# 输出转换后的十进制数
for value in decimal_values:
    print(value, end=',')

得到：

9,0,3,9,7,0,3,9,10,0,3,10,0,7,10,3,7,10,0,22,7,3,10,5,19,22,3,20,34,32,28,44,26,28,47,35,27,48,36,29,27,42,42,48,42,46,31,47,28,27,34,42,48,37,36,29,42,33,46,7,20,8,6,24,6,18,11,10,2,13,18,4,1,0,9,20,14,3,8,11,10,0,18,13,21,0,14,11,22,5,13,2,10,20,1,0,6,21,18,14,8,37,33,36,28,13,10,3,1,9,21,8,20,18,4,8,5,11,7,0,22,13,10,21,1,9,10,3,21,11,4,18,10,0,5,13,10,0,22,15,14,5,14,15,0,5,14,29,26,44,28,45,31,64,48,7,52,18,19,11,8,13,6,62,19,61,62,28,14,13,21,4,24,62,8,13,5,14,17,12,0,19,52,14,13,67,67,67,63

将上面的与abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890_}{-?!这个一一对应

num_list = [9,0,3,9,7,0,3,9,10,0,3,10,0,7,10,3,7,10,0,22,7,3,10,5,19,22,3,20,34,32,28,44,26,28,47,35,27,48,36,29,27,42,42,48,42,46,31,47,28,27,34,42,48,37,36,29,42,33,46,7,20,8,6,24,6,18,11,10,2,13,18,4,1,0,9,20,14,3,8,11,10,0,18,13,21,0,14,11,22,5,13,2,10,20,1,0,6,21,18,14,8,37,33,36,28,13,10,3,1,9,21,8,20,18,4,8,5,11,7,0,22,13,10,21,1,9,10,3,21,11,4,18,10,0,5,13,10,0,22,15,14,5,14,15,0,5,14,29,26,44,28,45,31,64,48,7,52,18,19,11,8,13,6,62,19,61,62,28,14,13,21,4,24,62,8,13,5,14,17,12,0,19,52,14,13,67,67,67,63]
print()
character_table = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890_}{-?!"

# 将十进制数映射到字符表
result = [character_table[value] for value in num_list]

# 输出转换后的字符
for char in result:
    print(char, end='')

得到：

jadjhadjkadkahkdhkawhdkftwduIGCSACVJBWKDBQQWQUFVCBIQWLKDQHUhuigygslkcnsebajuodilkasnvaolwfnckubagvsoiLHKCnkdbjviuseiflhawnkvbjkdvleskafnkawpofopafoDASCTF{Wh1stling_t0_Convey_informat1on!!!}

flag为：DASCTF{Wh1stling_t0_Convey_informat1on!!!}

• 总结：也是非常离谱的一道题了

附完整exp：

from scipy.io import wavfile

# 读取.wav文件
sample_rate, audio_data = wavfile.read(r"D:\download\justlisten\justlisten\嘘.wav")

# 每4410个样本为一段
segment_length = 4410

# 获取音频数据的长度
audio_length = len(audio_data)

# 初始化一个列表来存储第二个值的统计结果
first_values_statistics = []
second_values_statistics = []

# 分段、处理和存储第二个值的统计结果
for i in range(1, audio_length, segment_length):
    segment = audio_data[i:i + segment_length]
    first_values=segment[0]
    second_values = segment[1]  # 获取第二个值
    first_values_statistics.append(first_values)
    second_values_statistics.append(second_values)
print(first_values_statistics)
print(second_values_statistics)
# 遍历并按照音频中的顺序输出第二个值的统计结果
for idx, stats in enumerate(second_values_statistics):
    print(stats, end=',')
print()
values = [7405, 15259, 10103, 13583, 8311, 9211, 11862, 14427, 10987, 12728]
values.sort()
sorted_values = [7405, 8311, 9211, 10103, 10987, 11862, 12728, 13583, 14427, 15259]
for i in values:
    print(i, end=',')
data = [7405, 15259, 7405, 7405, 7405, 10103, 7405, 15259, 7405, 13583, 7405, 7405, 7405, 10103, 7405, 15259, 8311,
        7405, 7405, 7405, 7405, 10103, 8311, 7405, 7405, 7405, 7405, 13583, 8311, 7405, 7405, 10103, 7405, 13583, 8311,
        7405, 7405, 7405, 9211, 9211, 7405, 13583, 7405, 10103, 8311, 7405, 7405, 11862, 8311, 15259, 9211, 9211, 7405,
        10103, 9211, 7405, 10103, 10987, 10103, 9211, 9211, 14427, 10987, 10987, 9211, 12728, 9211, 14427, 10987, 13583,
        10103, 11862, 9211, 13583, 10987, 14427, 10103, 12728, 9211, 15259, 9211, 13583, 10987, 9211, 10987, 9211,
        10987, 14427, 10987, 9211, 10987, 12728, 10103, 8311, 10987, 13583, 9211, 14427, 9211, 13583, 10103, 10987,
        10987, 9211, 10987, 14427, 10103, 13583, 10103, 12728, 9211, 15259, 10987, 9211, 10103, 10103, 10987, 12728,
        7405, 13583, 9211, 7405, 7405, 14427, 7405, 12728, 9211, 10987, 7405, 12728, 8311, 14427, 8311, 8311, 8311,
        7405, 7405, 9211, 8311, 10103, 8311, 14427, 7405, 10987, 7405, 8311, 7405, 7405, 7405, 15259, 9211, 7405, 8311,
        10987, 7405, 10103, 7405, 14427, 8311, 8311, 8311, 7405, 7405, 7405, 8311, 14427, 8311, 10103, 9211, 8311, 7405,
        7405, 8311, 10987, 8311, 8311, 9211, 9211, 7405, 11862, 8311, 10103, 7405, 9211, 8311, 7405, 9211, 7405, 7405,
        8311, 7405, 7405, 7405, 12728, 9211, 8311, 8311, 14427, 8311, 10987, 7405, 14427, 10103, 13583, 10103, 10103,
        10103, 12728, 9211, 14427, 8311, 10103, 8311, 7405, 7405, 10103, 7405, 8311, 7405, 15259, 9211, 8311, 7405,
        14427, 9211, 7405, 8311, 14427, 7405, 10987, 7405, 14427, 7405, 11862, 8311, 8311, 7405, 13583, 7405, 7405,
        9211, 9211, 8311, 10103, 8311, 7405, 9211, 8311, 7405, 8311, 7405, 15259, 8311, 7405, 7405, 10103, 9211, 8311,
        8311, 8311, 7405, 10987, 8311, 14427, 8311, 7405, 7405, 7405, 7405, 11862, 8311, 10103, 8311, 7405, 7405, 7405,
        9211, 9211, 8311, 11862, 8311, 10987, 7405, 11862, 8311, 10987, 8311, 11862, 7405, 7405, 7405, 11862, 8311,
        10987, 9211, 15259, 9211, 12728, 10987, 10987, 9211, 14427, 10987, 11862, 10103, 8311, 12728, 10987, 10987,
        14427, 7405, 13583, 11862, 9211, 8311, 14427, 8311, 15259, 8311, 8311, 7405, 14427, 8311, 10103, 7405, 12728,
        12728, 9211, 8311, 15259, 12728, 8311, 12728, 9211, 9211, 14427, 8311, 10987, 8311, 10103, 9211, 8311, 7405,
        10987, 9211, 10987, 12728, 9211, 7405, 14427, 8311, 10103, 7405, 11862, 8311, 10987, 8311, 13583, 8311, 9211,
        7405, 7405, 8311, 15259, 11862, 9211, 8311, 10987, 8311, 10103, 12728, 13583, 12728, 13583, 12728, 13583, 12728,
        10103]
new_data = []
for i in data:
    if i == sorted_values[0]:
        new_data.append(0)
    if i == sorted_values[1]:
        new_data.append(1)
    if i == sorted_values[2]:
        new_data.append(2)
    if i == sorted_values[3]:
        new_data.append(3)
    if i == sorted_values[4]:
        new_data.append(4)
    if i == sorted_values[5]:
        new_data.append(5)
    if i == sorted_values[6]:
        new_data.append(6)
    if i == sorted_values[7]:
        new_data.append(7)
    if i == sorted_values[8]:
        new_data.append(8)
    if i == sorted_values[9]:
        new_data.append(9)
print()
for i in new_data:
    print(i, end='')
print()
str = "090003090700030910000310000710030710002207031005192203203432284426284735274836292742424842463147282734424837362942334607200806240618111002131804010009201403081110001813210014112205130210200100062118140837333628131003010921082018040805110700221310210109100321110418100005131000221514051415000514292644284531644807521819110813066219616228141321042462081305141712001952141367676763"

# 将每两个字符转换为十进制数
decimal_values = [int(str[i:i + 2], 10) for i in range(0, len(str), 2)]

# 输出转换后的十进制数
for value in decimal_values:
    print(value, end=',')
num_list = [9,0,3,9,7,0,3,9,10,0,3,10,0,7,10,3,7,10,0,22,7,3,10,5,19,22,3,20,34,32,28,44,26,28,47,35,27,48,36,29,27,42,42,48,42,46,31,47,28,27,34,42,48,37,36,29,42,33,46,7,20,8,6,24,6,18,11,10,2,13,18,4,1,0,9,20,14,3,8,11,10,0,18,13,21,0,14,11,22,5,13,2,10,20,1,0,6,21,18,14,8,37,33,36,28,13,10,3,1,9,21,8,20,18,4,8,5,11,7,0,22,13,10,21,1,9,10,3,21,11,4,18,10,0,5,13,10,0,22,15,14,5,14,15,0,5,14,29,26,44,28,45,31,64,48,7,52,18,19,11,8,13,6,62,19,61,62,28,14,13,21,4,24,62,8,13,5,14,17,12,0,19,52,14,13,67,67,67,63]
print()
character_table = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890_}{-?!"

# 将十进制数映射到字符表
result = [character_table[value] for value in num_list]

# 输出转换后的字符
for char in result:
    print(char, end='')