CTF stegano practice stegano 9

1. First step , First use TrID The tool identifies the types of two files ：
   
   among ,ELF File is Linux Main executables under . A more accurate analysis can use linux Under the file command , See is coredump file ：
   
   As for what is coredump, You can see here

2. Change suffix to open pcap file , adopt Ctrl+F find server hello In the bag session_id：
   
   Client （ Browser side ） Through a named ssl_session_st Structure storage of SSL Related key parameters , among ssl_session_st Some data structures of are shown as follows ：
   

3. Use C32Asm open file2 And search for 16 Base number ：
   
   Check out session-id, Forward should be 0x00000020, The length is 32, It should be master-key 了 ：
   

4. 

5. Get flag: