---
# System prepended metadata

title: DeconstruCT.F 2021 | Forensic | Mike
tags: [writeup, ctf]

---

---
layout: post
title:  "DeconstruCT.F 2021 | Forensic | Mike"
date:   2021-10-03 13:37:00 +0700
tags: [ctf, writeup]
---

<figure>
    <img src="https://cdn.discordapp.com/attachments/874145963407720513/894206917239513118/Group.png">
</figure>

#### Forensic | Mike (433 points | 11 solves)

Challenge Description:
```
Julia has come to you to ask for help. After spending too much time on his computer, Mike has gone insane, but no one knows why. Can you figure it out? Julia would really appreciate it. Here's how his desktop looked like. Weird how his system time doesn't change..

Wrap the flag that you find with dsc{<flag>}!
```

We're given a file (`desktop_wallpaper.png`):
<figure>
<img src="https://cdn.discordapp.com/attachments/847311120539844628/894613119828107324/desktop_wallpaper.png">
</figure>

**Solution:**
At first there was nothing strange about this image, but after we investigated that there was a spotify code hidden in it.
<figure>
<img src="https://cdn.discordapp.com/attachments/847311120539844628/894613491724460133/unknown.png">
</figure><br>

Just scanned it in the spotify apps, here we use handphone to scan it and we'll got this: https://open.spotify.com/track/1xpn6acMY1KgOwhL0Sz9su?si=xw_XA2tgQ3aBaUU4xLedCw&dl_branch=1
<figure>
<img src="https://cdn.discordapp.com/attachments/847311120539844628/894613932910706738/unknown.png">
</figure>
<br>

Next clue from the picture, he holds the shortcut from spotify and youtube. we have finished the spotify, and now we going to youtube.
<figure>
<img src="https://cdn.discordapp.com/attachments/847311120539844628/894614101823733890/unknown.png">
</figure>

We using addons youtube comment finder to try greping from the comments, it turns out that the Level Of Concern song itself has 20 certain codes in it.

<figure>
<img src="https://cdn.discordapp.com/attachments/847311120539844628/894614417562546256/unknown.png">
</figure>
<br>

The result is the flag, then wrap it in flag format.
FLAG : **dsc{LOC-888-481-90TO}**