PicoCTF2024: Blast from the past

yowise

a.infosecflavour

Posted on April 12, 2024

PicoCTF2024: Blast from the past

I bet you had moments in your life when you just wanted to go back in time.
While this cannot be realistically achieved, let's use the resources we have and shake our hands with nostalgia 🤝.

Before starting our next camino, I'll leave you here a nice old song:
.

First and foremost, let's download the picture.

It seems to be an antique tableau. 🖼️

The description is telling us we need to modify the timestamp.

Second of all, let's make a preliminary analysis of the file.

analysis.

analysiss

Here are some interesting things that caught my eye 👁️

exiftool

exiftool2

exiftool3

exiftool4

exiftool5

...and here's the output from hexedit...

hexedit

All right now...what do we do do do do to change the file so as we throw it back in ⌛⏲️?

I prefer to use the GUI version of Exiftool. 😺

GUI

Let's see what we got here.
exi

Maths time!
maths

And what we did

Mathz

a

Weren't lucky 😝.

After doing thiiiis 👇

ex

then

exx

we arrived here 😸

instance

We will use the command line to modify the requested tag.

Before that, I will have a closer look at this tag in exiftool CLI.
The Sub Sec tag is actually of great use. Let's modify them from 703 to 001.

subsec

sf

digitized

time

We already got 6/7! That's gr8!

result

Remember that we used strings and got an interesting result? 👆

Well, that's the tag we have to modify. And do you remember the hex code? Yes, we'll modify that.

why

Whyy didn't you use that from the beginning??

Because I wanted to show you the Exiftool GUI 😺.

While we could have modified 6/7 in Exiftool CLI or even better using HEX, why not enjoy a little bit this...time?

This is how you also observed the difference of SubSec tags. In GUI it seemed so far we could not obtain such a precision (remember that 703)?

Anyway, let's back to our hex code.

We need to modify the Unix Epoch Time with 0000000000001
hexedit

And bingo! 7/7!

flag


Congrats! We did in no time ⌚
What are your thoughts?🤔

💖 💪 🙅 🚩
yowise
a.infosecflavour

Posted on April 12, 2024

Join Our Newsletter. No Spam, Only the good stuff.

Sign up to receive the latest update from our blog.

Related

PicoCTF2024: Blast from the past
writing PicoCTF2024: Blast from the past

April 12, 2024