题目LilacCTF 2026https://adworld.xctf.org.cn/match/guide?event_hash7b528ca2-f4da-11f0-bf63-000c297261bbMISC里面的Welcome题789c0540b10980400c5ce92442067849153bc1f278ae1031ad95b87bc8bba6c611df6925ec46076bc955f2e0056ccc773c7f03fb580c81解题观察数据特征开头789c是zlib 压缩数据的常见魔数如果压缩级别默认用 deflate 压缩格式时经常以78 9c开头。给出的是一串十六进制字符789c0540b10980400c5ce92442067849153bc1f278ae1031ad95b87bc8bba6c611df6925ec46076bc955f2e0056ccc773c7f03fb580c81长度看起来不像是单纯文本可能是压缩后的二进制数据。尝试解压缩方法一代码实现importzlibimportbinascii hex_str789c0540b10980400c5ce92442067849153bc1f278ae1031ad95b87bc8bba6c611df6925ec46076bc955f2e0056ccc773c7f03fb580c81databinascii.unhexlify(hex_str)try:decompressedzlib.decompress(data)print(解压后 (raw):,decompressed)print(解压后 (hex):,decompressed.hex())print(解压后 (repr):,repr(decompressed))exceptExceptionase:print(解压失败:,e)运行结果解压后 (raw): bLilacCTF{W3lc0M3_70_l1L4cc7F_g00D_LuCk} 解压后 (hex): 4c696c61634354467b57336c63304d335f37305f6c314c34636337465f673030445f4c75436b7d 解压后 (repr): bLilacCTF{W3lc0M3_70_l1L4cc7F_g00D_LuCk}方法二CyberChef实现答案LilacCTF{W3lc0M3_70_l1L4cc7F_g00D_LuCk}附录如果是以 1f8b08 开头 可能是 gzip 文件可以看到解压后输出的内容以1f8b08开头 —— 这是gzip 文件的魔数。解压步骤importgzip hex_str789c0540b10980400c5ce92442067849153bc1f278ae1031ad95b87bc8bba6c611df6925ec46076bc955f2e0056ccc773c7f03fb580c81databinascii.unhexlify(hex_str)decompressedzlib.decompress(data)try:# 用 gzip 解压furthergzip.decompress(decompressed)print(二次解压后:,further)exceptExceptionase:print(gzip 解压失败:,e)
