下载图片
用隐写工具发现
分析一下发现pk头
Sava bin 另存为zip文件，用7z解压（其他的会报错），发现要密码
就上网找了下wp。。发现密码竟然是YSL对应口红色号的二进制转字符
ps取颜色，然后就去找YSL的口红色号
php脚本
<?php
$data='';
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL,'https://www.yslbeautyus.com/on/demandware.store/Sites-ysl-us-Site/en_US/Product-Variation?pid=194YSL'); //地址
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $data);
//curl_setopt($ch, CURLOPT_HTTPHEADER,$data);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch, CURLOPT_USERAGENT, 'Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION,1);
$rr=curl_exec($ch);
curl_close($ch);
$pat='/style="background-color: #(.*?)" title="(.*?)">/';
preg_match_all($pat,$rr,$dd);
$color=array_flip($dd[1]);
$num=$dd[2];
//print_r($num);die;
$arr=array('BC0B28','D04179','D47A6F','C2696F','EB8262', 'CF1A77','C0083E','BC0B28','BC0B28','D13274', '6A1319','BC0B28','BC0B28','D4121D','D75B59', 'DD8885','CE0A4A','D4121D','7E453A','D75B59', 'DD8885'); //这里是用ps取到的颜色代码
foreach ($arr as $k => $v) {
if(in_array($v,$color))
{
print_r($num[$color[$v]]);
echo "<br />";
}
}
python,这里如果要用python脚本的话，需要下载模块
地址：https://github.com/warnerjon12/libnum
在当前目录下安装，python setup.py install
也可参考：https://www.cnblogs.com/pcat/p/7225782.html
# -*- coding:utf8 -*-
__author__='pcat@chamd5.org'
import requestsimport re
import libnum
def foo():
url=r'https://www.yslbeautyus.com/on/demandware.store/Sites-ysl-us-Site/en_US/Product-Variation?pid=194YSL'
cont=requests.get(url).content
# print cont
pattern=r'YSL_color=(.*?)%20[sS]*?background-color: #(.*?)"'
rst=re.findall(pattern,cont)
dYSL={}
for num,color in rst:
dYSL[color]=int(num.lstrip('0'))
lst=['BC0B28','D04179','D47A6F','C2696F','EB8262', 'CF1A77','C0083E','BC0B28','BC0B28','D13274', '6A1319','BC0B28','BC0B28','D4121D','D75B59', 'DD8885','CE0A4A','D4121D','7E453A','D75B59', 'DD8885']
flag=''.join('{:b}'.format(dYSL[i]) for i in lst)
print libnum.b2s(flag)
pass
if __name__ == '__main__':
foo()
print 'ok'
用python就不需要转了，php的话需要色号转二进制
现在就可以将这些色号编码转为二进制。。然后再转为字符串。。
这里就需要用python了。。(因为这个转换不难。。刚好会)
# -*- coding:utf8 -*-
import sys
import libnum
ss=''
s=[1,27,59,11,23,7,57,1,1,76,222,1,1,50,214,6,77,50,53,214,6]
for i in s:
ss+=bin(i)[2:]
print ss
type = sys.getfilesystemencoding()
print libnum.b2s(ss).decode('utf-8').encode(type)
输出后为白学家，密码就是这个
解压即可得到flag
