1. Download Flash drive file
2. mount the Flash drive by VMWare(used vmdk extention)
3. Get a Video file "Ghost_In_The_Shell_-_\ Identity_in_Space.mkv"
# try to watching the video, we can see something wrong the video file after about 8 min, it was interasting!
4. Cehcking Video file type above command, and extract "track 2" audio file(wav type)
mediainfo Ghost_In_The_Shell_-_\ Identity_in_Space.mkv
mkvextract Ghost_In_The_Shell_-_\ Identity_in_Space.mkv tracks 2:0x01_audio.wav
# looking for evidence in 0x01_audio.wav file used Adacity
# we got morse code pattern at wave graph by zoom in. (in case, many other CTFs problems, usally hide the flag in spectrum graph)
# morse code refer: https://en.wikipedia.org/wiki/Morse_code
5. convert wav file to hex
xxd -p audio-copy.wav | tr -d "\n" > 0x02_wav.hex
6. convert hex file to morse code file
cat 0x02_wav.hex | sed -e "s/0000e9e14fcf4fcfe9e10000171eb130b130171e0000e9e14fcf4fcfe9e10000171eb130b130171e0000e9e14fcf4fcfe9e10000171eb130b130171e/-/g" | sed -e "s/0000e9e14fcf4fcfe9e10000171eb130b130171e/./g" | sed -e "s/000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000/ /g" | sed -e "s/0000000000000000000000000000000000000000//g" > 0x03_hex.morse
7. correction somethings wrong, in 0x03_hex.morse file used sublime text3
# I see the character in decoded file(0x04_morese.base64) file, not special character... I guess, base64
# charactercounttool refer: https://charactercounttool.com/
8. convert morse file to base64
cat 0x03_hex.morse | morse d > 0x04_morse.base64
# or use refer: https://morsecode.scphillips.com/translator.html
9. png to qrcode (steganograph)
10. base64 code to zip file
11. zip file to unzip (need to crack by r0ckyou database)
12. cat txt file, get flag !!