$ ctf42

Chronofault

Forensics No technique tags yet.
Difficulty Not rated yet

Author: fg0x0

by fg0x0 Forensics Somebody walked a projected service token out of the commons-core namespace and pulled the parity OTP secret. Four megabytes left for an off-register host, and the pairing rotation ran an hour late.

Our on-call analyst already closed this. He sorted every log by its timestamp, found the session that touched /api/v1/ledger/issue a tenth of a second before the core accepted a role header, and named a contractor.

The contractor's counterpart filed a chronyc dump in her defence. The DMZ segment has not reached an NTP server since the firewall change. Two of these five hosts have been free-wheeling on their RTC for twelve days, and one of them stamps the log our analyst sorted by.

A timeline is an accusation. Rebuild this one properly, then open the escrow with unlock.py.

Writeups

Official

No official writeup linked.

Community

No community writeups yet. Solved it? Share how.

Log in to add a community writeup.