PicoCTF2024: Blast from the past

PicoCTF2024: Blast from the past

I bet you had moments in your life when you just wanted to go back in time.
While this cannot be realistically achieved, let’s use the resources we have and shake our hands with nostalgia 🤝.

Before starting our next camino, I’ll leave you here a nice old song:

.

First and foremost, let’s download the picture.

It seems to be an antique tableau. 🖼️

The description is telling us we need to modify the timestamp.

Second of all, let’s make a preliminary analysis of the file.

.

Here are some interesting things that caught my eye 👁️

…and here’s the output from hexedit…

All right now…what do we do do do do to change the file so as we throw it back in ⌛⏲️?

I prefer to use the GUI version of Exiftool. 😺

Let’s see what we got here.

Maths time!

And what we did

Weren’t lucky 😝.

After doing thiiiis 👇

then

we arrived here 😸

We will use the command line to modify the requested tag.

Before that, I will have a closer look at this tag in exiftool CLI.
The Sub Sec tag is actually of great use. Let’s modify them from 703 to 001.

We already got 6/7! That’s gr8!

Remember that we used strings and got an interesting result? 👆

Well, that’s the tag we have to modify. And do you remember the hex code? Yes, we’ll modify that.

Whyy didn’t you use that from the beginning??

Because I wanted to show you the Exiftool GUI 😺.

While we could have modified 6/7 in Exiftool CLI or even better using HEX, why not enjoy a little bit this…time?

This is how you also observed the difference of SubSec tags. In GUI it seemed so far we could not obtain such a precision (remember that 703)?

Anyway, let’s back to our hex code.

We need to modify the Unix Epoch Time with 0000000000001

And bingo! 7/7!

Congrats! We did in no time ⌚
What are your thoughts?🤔

Leave a Reply

Your email address will not be published. Required fields are marked *