forensics-misc

Use when facing digital forensics or misc challenges involving disk images, memory dumps, network captures, steganography, file format analysis, encoding puzzles, sandbox escapes, or archive manipulation

الانتقال إلى التثبيت

المستودع: yhy0/CHYing-agent
آخر نشاط في المصدر: ٢٥ أبريل ٢٠٢٦ في ٠٨:٠٠
لغة SKILL.md المكتشفة: الصينية
النجوم: ٥٢٢
التفرعات: ٤٦

خيارات التثبيت

يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.

التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.

يتجاوز الأمر المباشر Prompt المخصّص للمراجعة. افحص المصدر قبل تشغيله.

npx skills add https://github.com/yhy0/CHYing-agent --skill forensics-misc

يبقى الأمر في سطر واحد. مرّر أفقيًا لمراجعته كاملًا قبل النسخ.

تفضّل نسخة محلية؟ نزّل الملفات المتاحة حاليًا لدى SkillsMP.

مراجعة ملفات المصدر

اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.

مستكشف الملفات

19 ملفات

SKILL.md

تعليمات المصدر · معاينة للقراءة فقط

العودة إلى البحث العودة إلى التثبيت

name	forensics-misc
description	Use when facing digital forensics or misc challenges involving disk images, memory dumps, network captures, steganography, file format analysis, encoding puzzles, sandbox escapes, or archive manipulation

CTF Forensics & Misc Solver

Core Objective

你是专业的 CTF Forensics & Misc 解题助手。工程化逆向出题人思路：系统识别隐藏层 → 自动推理路径 → 生成可执行脚本 → 逐层剥离直到找到 flag。

隐性线索: 文件名、题目描述、出题人名字都可能是密码提示；文件时间戳可能隐藏信息。

Phase 1: 通用初始侦察（对任何文件立即执行）

file <FILE>                                    # 文件类型
xxd <FILE> | head -20                          # 魔数
binwalk <FILE>                                 # 嵌套检测
strings <FILE> | grep -iE "flag\{|ctf|key|pass|secret" | head -20
exiftool <FILE> 2>/dev/null | head -40         # 元数据

Phase 2: 类型识别 + 立即执行命令

根据 Phase 1 识别结果，找到匹配类型，先执行下方命令，再读 module 深入分析。

🖼 图片隐写 (.png / .jpg / .bmp / .gif / .webp)

Module: steganography · stego-image · stego-advanced

# PNG — 立即执行
zsteg -a <FILE> 2>/dev/null | head -40
pngcheck -v <FILE>
python3 -c "from PIL import Image; img=Image.open('<FILE>'); print(f'Size:{img.size} Mode:{img.mode}')"
convert <FILE> -separate /tmp/channel_%d.png   # 通道分离

# JPEG — 立即执行
steghide info <FILE> -p "" 2>&1
steghide extract -sf <FILE> -p "" -f 2>/dev/null
exiftool <FILE> | grep -iE "comment|thumbnail|gps|author"
binwalk -e <FILE>

# BMP/GIF — 立即执行
zsteg -a <FILE> 2>/dev/null | head -40         # BMP also supported
python3 -c "
from PIL import Image
img = Image.open('<FILE>')
print(f'Size:{img.size} Mode:{img.mode} Frames:{getattr(img,\"n_frames\",1)}')
if hasattr(img,'n_frames') and img.n_frames > 1:
    for i in range(min(img.n_frames,50)):
        img.seek(i); img.save(f'/tmp/frame_{i:03d}.png')
    print(f'Extracted {min(img.n_frames,50)} frames to /tmp/frame_*.png')
"

Magic bytes: 89 50 4E 47 → PNG · FF D8 FF → JPEG · 42 4D → BMP · 47 49 46 38 → GIF

🔊 音频隐写 (.wav / .mp3 / .flac / .ogg / .m4a)

Module: stego-advanced (Audio section)

# 频谱图 + DTMF + 字符串
sox <FILE> -n spectrogram -o /tmp/spec.png && echo "Spectrogram: /tmp/spec.png"
multimon-ng -t wav -a DTMF -a MORSE <FILE> 2>/dev/null | head -20
strings <FILE> | grep -iE "flag|ctf|key" | head -10
mediainfo <FILE>

# LSB 音频隐写检查
python3 -c "
import wave, struct
w = wave.open('<FILE>','rb')
frames = w.readframes(min(w.getnframes(), 8000))
samples = struct.unpack(f'{len(frames)//2}h', frames)
lsb = ''.join(str(s & 1) for s in samples[:800])
chars = [chr(int(lsb[i:i+8],2)) for i in range(0,len(lsb)-7,8) if 32<=int(lsb[i:i+8],2)<127]
print('LSB text:', ''.join(chars[:80]))
" 2>/dev/null

# DeepSound 检查
steghide info <FILE> -p "" 2>&1               # steghide also works on WAV

Magic bytes: 52 49 46 46 → WAV · 49 44 33 → MP3 (ID3) · FF FB → MP3 (no ID3)

📡 流量包 (.pcap / .pcapng / .cap)

Module: network · network-advanced

# 会话概览 + 协议分布
tshark -r <FILE> -q -z conv,tcp 2>/dev/null | head -25
tshark -r <FILE> -q -z io,phs 2>/dev/null | head -30

# HTTP 请求/数据
tshark -r <FILE> -Y "http.request" -T fields -e http.request.method -e http.host -e http.request.uri 2>/dev/null | head -30

# DNS 查询（常见隐蔽信道）
tshark -r <FILE> -Y "dns.qry.name" -T fields -e dns.qry.name 2>/dev/null | sort -u | head -30

# 导出 HTTP 对象
mkdir -p /tmp/http_objects && tshark -r <FILE> --export-objects http,/tmp/http_objects 2>/dev/null
ls /tmp/http_objects/ 2>/dev/null | head -20

# FTP/SMTP 数据
tshark -r <FILE> -Y "ftp-data or smtp" -T fields -e data 2>/dev/null | head -20

# 快速 flag 搜索
tshark -r <FILE> -Y "frame contains \"flag{\"" 2>/dev/null | head -5

Magic bytes: D4 C3 B2 A1 / A1 B2 C3 D4 → PCAP · 0A 0D 0D 0A → PCAPNG

🧠 内存镜像 (.raw / .vmem / .dmp / .lime / .vmss)

Module: disk-and-memory

# OS 检测（先 Windows 后 Linux）
vol3 -f <FILE> windows.info 2>/dev/null || vol3 -f <FILE> linux.bash 2>/dev/null || vol3 -f <FILE> banners.Banners 2>/dev/null

# 进程树
vol3 -f <FILE> windows.pstree 2>/dev/null || vol3 -f <FILE> linux.pslist 2>/dev/null

# 关键文件/字符串搜索
vol3 -f <FILE> windows.filescan 2>/dev/null | grep -iE "flag|secret|key|pass|desktop|document" | head -20

# 命令行历史
vol3 -f <FILE> windows.cmdline 2>/dev/null | head -30

# 网络连接
vol3 -f <FILE> windows.netscan 2>/dev/null | head -20

💾 磁盘镜像 (.dd / .img / .e01 / .ova / .vmdk / .dmg)

Module: disk-and-memory · disk-advanced · disk-recovery

# 分区表
fdisk -l <FILE> 2>/dev/null || mmls <FILE> 2>/dev/null

# 文件列表
fls -r <FILE> 2>/dev/null | head -60

# 已删除文件
fls -r -d <FILE> 2>/dev/null | head -30

# 快速 flag 搜索
strings <FILE> | grep -iE "flag\{|ctf\{" | head -10

# 挂载检查
mkdir -p /tmp/mnt && mount -o loop,ro <FILE> /tmp/mnt 2>/dev/null && ls -la /tmp/mnt/ && umount /tmp/mnt 2>/dev/null

🪟 Windows 取证 (.evtx / SAM / SYSTEM / NTUSER.DAT)

Module: windows

# 注册表 hive 分析
python3 -c "
from Registry import Registry
reg = Registry.Registry('<FILE>')
def walk(key, depth=0):
    print('  '*depth + key.name())
    for v in key.values():
        print('  '*(depth+1) + f'{v.name()}: {v.value()}')
    for sk in key.subkeys():
        if depth < 2: walk(sk, depth+1)
walk(reg.root())
" 2>/dev/null | head -60

# evtx 解析
python3 -c "
import Evtx.Evtx as evtx
with evtx.Evtx('<FILE>') as log:
    for i, record in enumerate(log.records()):
        if i >= 30: break
        print(record.xml())
" 2>/dev/null | head -80

# 快速字符串
strings <FILE> | grep -iE "flag|password|admin|secret" | head -20

📦 压缩包 (.zip / .rar / .7z / .tar / .gz)

Module: archive

# 文件信息 + 内容列表
file <FILE>
7z l <FILE> 2>/dev/null || unzip -l <FILE> 2>/dev/null

# ZIP 详细信息（CRC、大小、加密方式）
python3 -c "
import zipfile
try:
    z = zipfile.ZipFile('<FILE>')
    for i in z.infolist():
        enc = 'ENCRYPTED' if i.flag_bits & 0x1 else 'plain'
        print(f'{i.filename}  CRC:{i.CRC:08x}  Size:{i.file_size}  Compressed:{i.compress_size}  {enc}')
except Exception as e: print(e)
" 2>/dev/null

# ZIP 伪加密检测
python3 -c "
data = open('<FILE>','rb').read()
import struct
pos = 0
while True:
    pos = data.find(b'PK\x01\x02', pos)
    if pos < 0: break
    flag = struct.unpack('<H', data[pos+8:pos+10])[0]
    if flag & 1: print(f'Central dir @{pos}: flag={flag:#x} — may be fake encryption')
    pos += 4
" 2>/dev/null

# 尝试空密码解压
7z x <FILE> -o/tmp/extracted -p"" -y 2>/dev/null && echo "Extracted with empty password" && ls /tmp/extracted/

🔤 编码/文本谜题

Module: encoding

# 自动多层 base64 解码
python3 -c "
import base64, sys
data = open('<FILE>','rb').read().strip()
for i in range(10):
    try:
        decoded = base64.b64decode(data)
        print(f'Layer {i+1} (base64): {decoded[:120]}')
        data = decoded
    except: break
print(f'Final: {data[:200]}')
" 2>/dev/null

# 常见编码检测
python3 -c "
import re, sys
data = open('<FILE>','r',errors='ignore').read().strip()
if re.match(r'^[01\s]+$', data): print('Binary detected')
elif re.match(r'^[0-9a-fA-F\s]+$', data): print('Hex detected:', bytes.fromhex(data.replace(' ',''))[:100])
elif re.match(r'^[A-Za-z0-9+/=\s]+$', data): print('Possibly Base64')
elif re.match(r'^[.-/ ]+$', data): print('Morse code detected')
elif '\\\\u' in data or '&#' in data: print('Unicode/HTML entities detected')
else: print('Unknown encoding, first 200 chars:', data[:200])
" 2>/dev/null

🐍 Python 沙箱逃逸 (pyjail)

Module: pyjails

题目特征: 交互式 Python shell，禁用了 import/exec/eval/os 等

# 快速测试 payloads（依次尝试）
__import__('os').system('cat /flag*')
breakpoint()                                   # pdb shell → import os
().__class__.__bases__[0].__subclasses__()      # 列出所有子类
getattr(__builtins__, '__import__')('os').system('cat /flag*')
eval(bytes([105,109,112,111,114,116,32,111,115]).decode())  # "import os"
[x for x in ().__class__.__bases__[0].__subclasses__() if 'warning' in str(x).lower()][0]()._module.__builtins__['__import__']('os').system('cat /flag*')

🐚 Bash 沙箱逃逸 (bashjail)

Module: bashjails

题目特征: 受限 shell，禁用了常见命令

# 快速逃逸尝试
$0                          # 通常是 /bin/sh 或 /bin/bash
${PATH:0:1}                 # 产生 /
cat${IFS}/flag*             # IFS 绕过空格限制
/???/??t /???g*             # glob 绕过: /bin/cat /flag*
$(printf '\x63\x61\x74') /flag*   # printf 绕过: cat
echo $HISTFILE              # 可能可以读取文件
exec 3< /flag && cat <&3   # fd 重定向读文件

📻 硬件/信号 (.sal / .sub / .bin)

Module: signals-and-hardware

# Saleae 逻辑分析仪
python3 -c "
import csv, sys
with open('<FILE>') as f:
    reader = csv.reader(f)
    for i, row in enumerate(reader):
        if i >= 30: break
        print(row)
" 2>/dev/null

# Flipper Zero SubGHz
strings <FILE> | head -40
file <FILE>
xxd <FILE> | head -30

🖨 3D 打印 (.g / .bgcode / .gcode)

Module: 3d-printing

# G-code 分析
head -50 <FILE>
grep -E "^G[01] " <FILE> | head -30           # 移动指令
python3 -c "
lines = open('<FILE>').readlines()
coords = []
for l in lines:
    if l.startswith('G1') or l.startswith('G0'):
        parts = {p[0]:float(p[1:]) for p in l.split() if p[0] in 'XYZ'}
        if 'X' in parts and 'Y' in parts: coords.append((parts['X'],parts['Y']))
print(f'Total move commands: {len(coords)}')
if coords: print(f'X range: {min(c[0] for c in coords):.1f}-{max(c[0] for c in coords):.1f}')
if coords: print(f'Y range: {min(c[1] for c in coords):.1f}-{max(c[1] for c in coords):.1f}')
" 2>/dev/null

Module Dispatch Table

Module	覆盖范围
disk-and-memory	Volatility 3, disk mounting/carving, VM/OVA/VMDK, VMware snapshots, coredumps, KAPE, ransomware, Android/Docker/cloud, BSON, TrueCrypt/VeraCrypt
disk-advanced	Deleted partitions, ZFS, GPT GUID encoding, VMDK sparse, memory carving, ransomware key recovery, APFS snapshots, RAID 5 XOR
disk-recovery	LUKS master key, PRNG brute-force, VBA recovery, XFS reconstruction, tar duplicate, matryoshka FS, anti-carving, BTRFS/FAT16/ext2
windows	Registry, SAM, event logs, recycle bin, NTFS ADS, USN journal, PowerShell history, Defender MPLog, WMI, Amcache
linux-forensics	Log analysis, Docker forensics, browser credentials, Git recovery, KeePass, browser artifacts, VBA macro, Ethereum
network	tcpdump, TLS/SSL decryption, Wireshark, SMB3, 5G/NR, USB HID steno, BCD, HTTP exfil, WiFi decrypt, PCAP repair
network-advanced	Packet timing, USB HID mouse, NTLMv2 crack, TCP flag covert channel, DNS stego, multi-layer PCAP XOR, Brotli bomb, SMB RID, Timeroasting
steganography	Binary border stego, PDF multi-layer, SVG keyframes, PNG reorder, file overlays, GIF Morse, GZSteg, Kitty graphics, ANSI escape, autostereograms
stego-image	JPEG DQT LSB, BMP bitplane QR, image puzzle reassembly, F5 DCT, PNG palette stego, QR reconstruction, pixel permutation, JPEG slack, RGB parity
stego-advanced

Available Tools

工具	命令	用途
file	`file target`	文件类型识别
binwalk	`binwalk -e file`	嵌套文件提取
foremost	`foremost -i file -o out/`	文件雕刻/恢复
steghide	`steghide extract -sf img.jpg`	JPG/WAV 隐写提取
zsteg	`zsteg -a img.png`	PNG/BMP LSB 分析
pngcheck	`pngcheck -v img.png`	PNG 结构/CRC 检查
exiftool	`exiftool file`	元数据查看
strings	`strings -n 6 file`	字符串提取
xxd	`xxd file \| head -50`	十六进制查看
tshark	`tshark -r file.pcap -Y "http"`	流量包分析
sox	`sox in.wav -n spectrogram -o spec.png`	音频频谱图
ffmpeg	`ffmpeg -i input output`	音视频转换
john	`john --wordlist=dict hash.txt`	密码破解
fcrackzip	`fcrackzip -u -D -p dict f.zip`	ZIP 密码破解
bkcrack	`bkcrack -C enc.zip -c f -P p.zip -p f`	ZIP 明文攻击
volatility3	`vol3 -f mem.dmp windows.info`	内存取证
sleuthkit	`fls -r image.dd`	磁盘取证
testdisk	`testdisk image.img`	分区恢复
pcapfix	`pcapfix -d corrupted.pcap`	PCAP 修复
qpdf	`qpdf --decrypt in.pdf out.pdf`	PDF 解密
imagemagick	`convert img.png -separate ch/`	图像通道分离

Python 库: PIL/Pillow, pyzbar, scipy.fft, numpy, scapy, volatility3, pycryptodome, wave, struct

扩展参考

沙箱逃逸模块来自 ljagiello/ctf-skills（MIT）：pyjails · bashjails

forensics-misc

معلومات المصدر

خيارات التثبيت

مراجعة ملفات المصدر

المزيد من هذا المستودع

المزيد من هذا المستودع

CTF Forensics & Misc Solver

Core Objective

Phase 1: 通用初始侦察（对任何文件立即执行）

Phase 2: 类型识别 + 立即执行命令

🖼 图片隐写 (.png / .jpg / .bmp / .gif / .webp)

🔊 音频隐写 (.wav / .mp3 / .flac / .ogg / .m4a)

📡 流量包 (.pcap / .pcapng / .cap)

🧠 内存镜像 (.raw / .vmem / .dmp / .lime / .vmss)

💾 磁盘镜像 (.dd / .img / .e01 / .ova / .vmdk / .dmg)

🪟 Windows 取证 (.evtx / SAM / SYSTEM / NTUSER.DAT)

📦 压缩包 (.zip / .rar / .7z / .tar / .gz)

🔤 编码/文本谜题

🐍 Python 沙箱逃逸 (pyjail)

🐚 Bash 沙箱逃逸 (bashjail)

📻 硬件/信号 (.sal / .sub / .bin)

🖨 3D 打印 (.g / .bgcode / .gcode)

Module Dispatch Table

Available Tools

扩展参考

CTF Forensics & Misc Solver

Core Objective

Phase 1: 通用初始侦察（对任何文件立即执行）

Phase 2: 类型识别 + 立即执行命令

🖼 图片隐写 (.png / .jpg / .bmp / .gif / .webp)

🔊 音频隐写 (.wav / .mp3 / .flac / .ogg / .m4a)

📡 流量包 (.pcap / .pcapng / .cap)

🧠 内存镜像 (.raw / .vmem / .dmp / .lime / .vmss)

💾 磁盘镜像 (.dd / .img / .e01 / .ova / .vmdk / .dmg)

🪟 Windows 取证 (.evtx / SAM / SYSTEM / NTUSER.DAT)

📦 压缩包 (.zip / .rar / .7z / .tar / .gz)

🔤 编码/文本谜题

🐍 Python 沙箱逃逸 (pyjail)

🐚 Bash 沙箱逃逸 (bashjail)

📻 硬件/信号 (.sal / .sub / .bin)

🖨 3D 打印 (.g / .bgcode / .gcode)

Module Dispatch Table

Available Tools

扩展参考