這個題目把幾乎所有的THJCC題目結合到了一起,我覺得比較像網路解密 因為沒看過這種一環扣一環的CTF,只有在網路解密看過
喔對了如果你也想解檔案在這
Part 1
在這個部分,檔案要用頻譜圖開
因為我沒記錯的話提示是”how to see the sound?”和”0:14~0:17”
我這裡用Audacity看
右鍵音軌-頻譜圖
會看到一個網址
092598.xyz
直接連上是rickroll
那可能代表要用whois看
C:\Users\User\Downloads\SysinternalsSuite>whois 092598.xyz
Whois v1.21 - Domain information lookupCopyright (C) 2005-2019 Mark RussinovichSysinternals - www.sysinternals.com
Connecting to XYZ.whois-servers.net...
WHOIS Server: whois.gandi.netRegistrar URL: http://www.gandi.net/Updated Date: 2026-03-01T15:08:21.0ZCreation Date: 2026-03-01T15:08:20.0ZRegistry Expiry Date: 2027-03-01T23:59:59.0ZRegistrar: Gandi SASRegistrar IANA ID: 81Domain Status: serverTransferProhibited https://icann.org/epp#serverTransferProhibitedDomain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibitedName Server: ANITA.NS.CLOUDFLARE.COMName Server: MICHAEL.NS.CLOUDFLARE.COMDNSSEC: unsignedRegistrar Abuse Contact Email: abuse@support.gandi.netRegistrar Abuse Contact Phone: +33.170377661URL of the ICANN Whois Inaccuracy Complaint Form: https://www.icann.org/wicf/>>> Last update of WHOIS database: 2026-03-09T09:10:52.0Z <<<
For more information on Whois status codes, please visit https://icann.org/epp
>>> IMPORTANT INFORMATION ABOUT THE DEPLOYMENT OF RDAP: please visithttps://www.centralnicregistry.com/support/information/rdap <<<
The registration data available in this service is limited. Additionaldata may be available at https://lookup.icann.org
The Whois and RDAP services are provided by CentralNic, and containinformation pertaining to Internet domain names registered by ourour customers. By using this service you are agreeing (1) not to use anyinformation presented here for any purpose other than determiningownership of domain names, (2) not to store or reproduce this data inany way, (3) not to use any high-volume, automated, electronic processesto obtain data from this service. Abuse of this service is monitored andactions in contravention of these terms will result in being permanentlyblacklisted. All data is (c) CentralNic Ltd (https://www.centralnicregistry.com)
Access to the Whois and RDAP services is rate limited. For moreinformation, visit https://centralnicregistry.com/policies/whois-guidance.
Connecting to whois.gandi.net...
WHOIS Server: whois.gandi.netRegistrar URL: http://www.gandi.netUpdated Date: 2026-03-01T15:26:16ZCreation Date: 2026-03-01T14:08:20ZRegistrar Registration Expiration Date: 2027-03-01T23:59:59ZRegistrar: GANDI SASRegistrar IANA ID: 81Registrar Abuse Contact Email: abuse@support.gandi.netRegistrar Abuse Contact Phone: +33.170377661Reseller:Domain Status: clientTransferProhibited http://www.icann.org/epp#clientTransferProhibitedDomain Status: serverTransferProhibited http://www.icann.org/epp#serverTransferProhibitedDomain Status:Domain Status:Domain Status:Registry Registrant ID:Registrant Name: gugu gagaRegistrant Organization: A Fake CompanyRegistrant Street: No.404 Fake St.Registrant City: No have this cityRegistrant State/Province:Registrant Postal Code: 123Registrant Country: TWRegistrant Phone: +886.900000000Registrant Phone Ext:Registrant Fax:Registrant Fax Ext:Registrant Email: gugugaga980925@gmail.comRegistry Admin ID:Admin Name: gugu gagaAdmin Organization: A Fake CompanyAdmin Street: No.404 Fake St.Admin City: No have this cityAdmin State/Province:Admin Postal Code: 123Admin Country: TWAdmin Phone: +886.900000000Admin Phone Ext:Admin Fax:Admin Fax Ext:Admin Email: gugugaga980925@gmail.comRegistry Tech ID:Tech Name: gugu gagaTech Organization: A Fake CompanyTech Street: No.404 Fake St.Tech City: No have this cityTech State/Province:Tech Postal Code: 123Tech Country: TWTech Phone: +886.900000000Tech Phone Ext:Tech Fax:Tech Fax Ext:Tech Email: gugugaga980925@gmail.comName Server: ANITA.NS.CLOUDFLARE.COMName Server: MICHAEL.NS.CLOUDFLARE.COMName Server:Name Server:Name Server:Name Server:Name Server:Name Server:Name Server:Name Server:DNSSEC: UnsignedURL of the ICANN WHOIS Data Problem Reporting System: http://wdprs.internic.net/>>> Last update of WHOIS database: 2026-03-09T09:10:52Z <<<
For more information on Whois status codes, please visithttps://www.icann.org/epp
Reseller Email:Reseller URL:
Personal data access and use are governed by French law, any use for the purpose of unsolicited mass commercial advertising as well as any mass or automated inquiries (for any intent other than the registration or modification of a domain name) are strictly forbidden. Copy of whole or part of our database without Gandi's endorsement is strictly forbidden.A dispute over the ownership of a domain name may be subject to the alternate procedure established by the Registry in question or brought before the courts.For additional information, please contact us via the following form: https://www.gandi.net/support/contacter/mail/
Domain Name: 092598.xyzRegistry Domain ID: D627460974-CNICRegistrar WHOIS Server: whois.gandi.netRegistrar URL: http://www.gandi.netUpdated Date: 2026-03-01T15:26:16ZCreation Date: 2026-03-01T14:08:20ZRegistrar Registration Expiration Date: 2027-03-01T23:59:59ZRegistrar: GANDI SASRegistrar IANA ID: 81Registrar Abuse Contact Email: abuse@support.gandi.netRegistrar Abuse Contact Phone: +33.170377661Reseller:Domain Status: clientTransferProhibited http://www.icann.org/epp#clientTransferProhibitedDomain Status: serverTransferProhibited http://www.icann.org/epp#serverTransferProhibitedDomain Status:Domain Status:Domain Status:Registry Registrant ID:Registrant Name: gugu gagaRegistrant Organization: A Fake CompanyRegistrant Street: No.404 Fake St.Registrant City: No have this cityRegistrant State/Province:Registrant Postal Code: 123Registrant Country: TWRegistrant Phone: +886.900000000Registrant Phone Ext:Registrant Fax:Registrant Fax Ext:Registrant Email: gugugaga980925@gmail.comRegistry Admin ID:Admin Name: gugu gagaAdmin Organization: A Fake CompanyAdmin Street: No.404 Fake St.Admin City: No have this cityAdmin State/Province:Admin Postal Code: 123Admin Country: TWAdmin Phone: +886.900000000Admin Phone Ext:Admin Fax:Admin Fax Ext:Admin Email: gugugaga980925@gmail.comRegistry Tech ID:Tech Name: gugu gagaTech Organization: A Fake CompanyTech Street: No.404 Fake St.Tech City: No have this cityTech State/Province:Tech Postal Code: 123Tech Country: TWTech Phone: +886.900000000Tech Phone Ext:Tech Fax:Tech Fax Ext:Tech Email: gugugaga980925@gmail.comName Server: ANITA.NS.CLOUDFLARE.COMName Server: MICHAEL.NS.CLOUDFLARE.COMName Server:Name Server:Name Server:Name Server:Name Server:Name Server:Name Server:Name Server:DNSSEC: UnsignedURL of the ICANN WHOIS Data Problem Reporting System: http://wdprs.internic.net/>>> Last update of WHOIS database: 2026-03-09T09:10:52Z <<<
For more information on Whois status codes, please visithttps://www.icann.org/epp
Reseller Email:Reseller URL:
Personal data access and use are governed by French law, any use for the purpose of unsolicited mass commercial advertising as well as any mass or automated inquiries (for any intent other than the registration or modification of a domain name) are strictly forbidden. Copy of whole or part of our database without Gandi's endorsement is strictly forbidden.A dispute over the ownership of a domain name may be subject to the alternate procedure established by the Registry in question or brought before the courts.For additional information, please contact us via the following form: https://www.gandi.net/support/contacter/mail/其中有個東西是gugugaga980925@gmail.com
但不可能是gmail
所以把後面去掉這樣去找
果然發現怪東西
點進去會看到打亂的QRCode和一張圖片
下載下來嘗試拼回去
試過很多次掃不到
後來去問了PG說他掃的到(????)
也是成功拿到連結了
https://file.pg72.tw/share/xK0UUwmt
打開來有密碼

回到IG最下面的貼文說密碼是照片裡學校的簡稱
丟給AI看看
嗯…我去他IG找找線索好了
嗯?
AHSNCCU?
不會是密碼吧?!
還真的是lol
下載檔案下來
內容是
0110/110/1010/1/0010/{/011/11111/011/_/001/_/000/11111/0100/0001/00011/100/_/011111/1/_我選擇丟給Ai解
好拿到第一部份的flag了
PGCTF{W0W_U_S0LV3D_1T_Part 2
把後面的SSTV解碼出來
會出現這些東西
++++++++++[>+>+++>+++++++>++++++++++<<<<-]>>>------------------..>-----------------.--.<..>----------.+++++++++++.<..>+.----------.<..>--.++.<..>++++++++++.--.<..>++..<..>--------.+++++++++++.<..>---------------.++.<..>++++++++++.------------.<..>++++.+++++++++++.<..>---.++++++++++++++++++++++.<..>----------------------.+++++++++++++++++++++.<..+++++++++++++++++++++++.+++++++++++.<++++++++++++++++++++++..>---.+++.<..>---------------.+++.<..>+++++++++..<..>.<+++++++++++++.我直接丟給AI跑
感覺這是base64:44SQ44GR44SI44GI44SQ44SS44KV44GI44SG44KV44Si44Sh44KV44SV44GJ44SS44SA
是,然後翻一下我當初弄得
https://hackmd.io/@nihs-zackzheng/Hkc06f3Ybg
接下來最後這個結果我覺得還有加密
再看一下是不是凱薩(只有凱薩才有移位)
好第二階段也出來了
r3p0rt_0n_dc_w1th為什麼不是c3a0ce?因為前後文是連貫的
Part 3
這個部份我用hex查看器看了這個wav
尾段有點怪東西,讓我改看看副檔名然後解開
man! what can i say
然後不出意外就出意外了
這下不用破解xslx的密碼了(本來是有密碼的),只要剛剛unzip檔案名稱來解出下載連接的密碼
密碼就是password
下載下來點開
這就是wav壓縮包的壓縮包密碼了
然後打開是一個ai的鏈結https://gemini.google.com/gem/1mpG1EMZRX6dfyoUgumQZlcImO_mHZsWQ?usp=sharing
嘗試把我們要的東西騙出來
好騙出一個怪東西YTLINK{x5W8qMbaiEQ}了
那看看會連到什麼東西

接下來就是看影片
光看看不出所以然來,看看有沒有什麼其他的東西
先下載下來
裡面好像有藏文字

把所有找到 會是
_scr33n_and_wp}合併&提交
把所有東西合併起來
會是PGCTF{WOW_U_SOLV3D_1T_r3p0rt_0n_dc_w1th_scr33n_and_wp}
丟到ctf.pg72.tw
送出!
耶~
後記與感謝
反正昨天才解出來
這就是我
然後感謝出題PG讓我解那麼精彩的題目
感謝草莓糖在上上週一起陪我解出Part2
感謝Gemini幫我decode和找圖片位置
最後感謝所有人看到這,最後留個base64
Q1RGIDFzIG15IDFpdmUh這裡就正式結束了