pangushi2025

Y0ungK1ng

2025-05-13

电子取证

检材容器加载密码：01tn0GdE0]BF00pT0T&f00&u0k-q0Up41UhA00N,0-L0kRr0j-p0T&R1F&=0\Ni1GR]

本文学习
第三届盘古石杯初赛复现 | Aura Blog

VR

计算机

分析贾韦码计算机检材，计算机系统Build版本为？【标准格式：19000】 Analyze Jia Wei Ma(贾韦码)’s computer sample: What is the system Build number? [Answer format: 19000]

答案:18362

计算机最后一次正常关机的时间为？UTC +0【标准格式：2025-05-06 09:00:00】 When was the computer last shut down normally (UTC +0)? [Answer format: 2025-05-06 09:00:00]

答案:2025-04-18 3:20:54

这个是我们的UTC+8时间，要减去8小时

计算机网卡的MAC地址为？【标准格式：00-0B-00-A0-00-00】 What is the MAC address of the computer’s network interface card? [Answer format: 00-0B-00-A0-00-00]

答案:00-0C-29-0F-69-00

计算机用户“贾韦码” 安全标识符SID为？【标准格式：S-X-X-X-X-X-X-X】 What is the SID of user “贾韦码”? [Answer format: S-X-X-X-X-X-X-X]

答案:S-1-5-21-3733482367-3411043098-2536183883-1001

计算机默认浏览器为？【标准格式：Mozilla Firefox】 What is the default browser on the computer? [Answer example: Mozilla Firefox]

答案:S-1-5-21-3733482367-3411043098-2536183883-1001

计算机默认浏览器版本为？【标准格式：000.0.0000.00】 What is the version of the default browser? [Answer format: 000.0.0000.00]

答案:135.0.7049.95

答案:Telegram

机主的邮箱账号为？【标准格式：pgscup@pgs.com】 What is the owner‘s email account? [Answer format: pgscup@pgs.com]

答案:tqmdavidjohnson300@gmail.com

计算机安装过一款反取证软件为？ [答案格式：Encrypt.exe]

答案:VeraCrypt.exe

计算机通过Xshell远程连接的ip地址为？【标准格式：127.0.0.1】 What IP address did the computer connect to via Xshell? [Answer format: 127.0.0.1]

答案:192.168.56.129

机主曾买过一个美国的TG账号，请给该账号的原两步验证密码？【标准格式：8位数字】 The owner purchased an US Telegram account. Provide its original two-step verification password. [Answer format: 8 digits]

答案:192.168.56.129

给出其电脑内加密容器的解密密码？【标准格式：Abc@123】 What is the decryption password for the encrypted container on the computer. [Answer format: Abc@123]

答案:Pgs8521d3j

根据下述规则进行解密

找到可疑数据

用爆破或者掩码

给出其电脑内加密容器挂载的盘符？【标准格式：C】 What drive letter is assigned to the mounted encrypted container? [Answer format: C]

答案:F

给出其电脑内存放了多少张伪造身份证？【标准格式：10】 How many forged ID cards are stored on the computer? [Answer format: 10]

答案:1023

给出任敏的身份证编号？ [答案格式：18位]

答案:430529195112085460

找出其电脑内存放的密钥文件，计算其MD5?【标准格式：字母小写】 Find the MD5 hash of the key file stored on the computer. [Answer format: lowercase letters]

答案:1022cc083a4a5a9e2036065e2822c48e

有个 3pgscup.rar，火眼中只有快捷方式

直接 xwf 爆搜 rar 文件头 Rar!
列出所有的搜索结果

找到密钥内容keyfile
emZz5Yqg5a+GcG9vbOWvhumSpeaWh+S7tg==

找出其电脑内存放的密钥文件，解密此密钥文件，给出其内容？【标准格式：第3届pgscup】 Decrypt the key file stored on the computer and give the content. [Answer format: 第3届pgscup]

答案:zfs加密pool密钥文件

base64解密即可

对macOS系统进行解析，登陆的电子邮件服务是谁提供的？【标准格式:pgscup】 Analyze the macOS system. Who provides the email service you log in to? [Standard format: pgscup]

答案:outlook

系统备忘录的包名是什么？【标准格式:com.dfefef.note】 What is the package name of the system’s Notes app? [Answer format: com.dfefef.note]

答案:com.apple.Notes

图片中隐藏的内容是什么？ [答案格式：隐藏内容刷子戏子痞子]

答案:位移加密正向位移操作

备忘录里提示在下载中有图片

red plane 0通道二维码

被加密文件的扩展名是什么？【标准格式：123】 What is the file extension of the encrypted files? [Answer format: 123]

答案:enc

被加密的文件总共有几个？ [答案格式：5]

答案:1

只有桌面的一个

贾韦码家使用的智能门锁品牌型号是什么？【标准格式：小米X号】 What is the brand and model of the smart lock used in Jia Wei Ma(贾韦码)’s home? [Answer example: 小米X号]

答案:``

需要先mac取证
解密苹果电脑的 贾韦码资料.rar.enc

mac应用取证

对mac电脑中的加密程序进行分析，使用了一个特定的数作为密钥生成的种子，请问这个数是什么？[标准格式：1234]

答案:42

加密程序在mac桌面

导出到桌面,运行后发现缺少模块，可以看到可能是加密模块

解压python38，找到加密模块，解压出来用 uncompyle6 或者在线![https://pylingual.io]反编译一下（这里注意uncompyle6反编译笔者遇到未完全的问题）。

分析文件头部元素并确定它们的正确顺序。将字段名称按顺序连接并提交？[标准格式：字段1_字段2_字段3…]

答案:iv_encrypted_data

需要pylingual反编译结果

# Decompiled with PyLingual (https://pylingual.io)
# Internal filename: encrypt_deobfuscated.pyc
# Bytecode version: 3.8.0rc1+ (3413)
# Source timestamp: 2025-04-17 01:58:27 UTC (1744855107)

import os
import sys
import tkinter as tk
from tkinter import filedialog, messagebox
from Crypto.Cipher import AES
import base64
import hashlib
import time
import random

  

class EncryptionTool:
  
    def __init__(self):
        self._generate_key()

    def _generate_key(self):
        seed_values = [(19, 7, 83), (5, 31, 69), (13, 11, 86), (41, 3, 76), (2, 57, 55), (23, 5, 96), (17, 13, 58), (29, 7, 94), (11, 19, 102), (7, 17, 42), (43, 3, 48), (37, 11, 51), (3, 43, 52), (59, 7, 53), (47, 5, 54)]

        key_parts = []

        for a, b, base in seed_values:
            val = (a * b % 60 + base) % 256

            if val % 2 == 0:
                val = (val + 13) % 256

            else:
                val = (val + 7) % 256

            key_parts.append(chr(val))
        scrambled = []
        indices = [3, 7, 2, 12, 0, 11, 5, 14, 9, 1, 6, 4, 10, 8, 13]
        for idx in indices:
            scrambled.append(key_parts[idx])
        raw_key = ''.join(scrambled)
        timestamp = int(time.time()) % 1000
        random_val = random.randint(1, 255)
        entropy = chr(timestamp % 256) + chr(random_val)
        temp_key = hashlib.sha256((raw_key + entropy).encode()).digest()
        self._descramble_key(temp_key)

  

    def _descramble_key(self, temp_key):
        mixed_base = b''.join([bytes([b ^ 42]) for b in temp_key[:10]])
        actual_key = 'SecureKey123456'
        self.enhanced_key = self.enhance_key(actual_key)

  

    def enhance_key(self, key):
        round1 = self._add_salt(key)
        round2 = self._ascii_transform(round1)
        round3 = self._xor_transform(round2)
        round4 = round3[::-1]
        final_key = hashlib.md5(round4.encode()).digest()
        return final_key

  

    def _add_salt(self, key):
        salt_components = ['salt', '_', 'value']
        return key + ''.join(salt_components)

  

    def _ascii_transform(self, text):
        result = ''
        for i in range(len(text)):
            ascii_val = ord(text[i])
            if i % 3 == 0:
                result += chr((ascii_val + 7) % 256)
            elif i % 3 == 1:
                result += chr((ascii_val ^ 15) % 256)
            else:
                result += chr(ascii_val * 5 % 256)

        return result

  

    def _xor_transform(self, text):
        xor_keys = ['XorKey123456789', 'AnotherKey987654']
        result = text
        for xor_key in xor_keys:
            temp = ''
            for i in range(len(result)):
                temp += chr(ord(result[i]) ^ ord(xor_key[i % len(xor_key)]))
            result = temp

        return result

  

    def pad_data(self, data):
        block_size = AES.block_size
        padding_length = block_size - len(data) % block_size
        padding = bytes([padding_length]) * padding_length
        return data + padding

  

    def unpad_data(self, data):

        padding_length = data[-1]

        return data[:-padding_length]

  

    def encrypt_file(self, input_file, output_file=None):

        if not output_file:
            output_file = input_file + '.enc'

        try:

            cipher = AES.new(self.enhanced_key, AES.MODE_CBC)
            iv = cipher.iv
            with open(input_file, 'rb') as f:
                file_data = f.read()
            padded_data = self.pad_data(file_data)
            encrypted_data = cipher.encrypt(padded_data)
            with open(output_file, 'wb') as f:
                f.write(iv + encrypted_data)
            return (True, output_file)

        except Exception as e:
            return (False, str(e))

  

class EncryptionGUI:

  

    def __init__(self, root):
        self.root = root
        self.root.title('File Encryption Tool')
        self.root.geometry('500x300')
        self.root.resizable(False, False)
        self.encryptor = EncryptionTool()
        self.setup_ui()

  

    def setup_ui(self):
        file_frame = tk.Frame(self.root, pady=20)
        file_frame.pack(fill='x')
        tk.Label(file_frame, text='Select File to Encrypt:').pack(side='left', padx=10)
        self.file_path = tk.StringVar()
        tk.Entry(file_frame, textvariable=self.file_path, width=30).pack(side='left', padx=5)
        tk.Button(file_frame, text='Browse', command=self.browse_file).pack(side='left', padx=5)
        action_frame = tk.Frame(self.root, pady=20)
        action_frame.pack()
        tk.Button(action_frame, text='Encrypt File', command=self.encrypt_file, bg='#4CAF50', fg='white', width=15, height=2).pack(pady=10)
        status_frame = tk.Frame(self.root, pady=10)
        status_frame.pack(fill='x')
        self.status_var = tk.StringVar()
        self.status_var.set('Ready')
        tk.Label(status_frame, textvariable=self.status_var, bd=1, relief=tk.SUNKEN, anchor=tk.W).pack(fill='x', padx=10)

  

    def browse_file(self):
        filename = filedialog.askopenfilename(title='Select File to Encrypt')
        if filename:
            self.file_path.set(filename)

  

    def encrypt_file(self):
        file_path = self.file_path.get()
        if not file_path:
            messagebox.showerror('Error', 'Please select a file first!')
            return

        self.status_var.set('Encrypting...')
        self.root.update()
        success, result = self.encryptor.encrypt_file(file_path)

        if success:
            self.status_var.set(f'Encryption complete! Output: {result}')
            messagebox.showinfo('Success', f'File encrypted successfully!\nOutput: {result}')

        else:
            self.status_var.set(f'Encryption failed: {result}')
            messagebox.showerror('Error', f'Encryption failed: {result}')

  

def main():
    root = tk.Tk()
    app = EncryptionGUI(root)
    root.mainloop()

if __name__ == '__main__':
    main()