- Challenge Overview
Challenge Name: Temporal Anomaly
Category: Digital Forensics / Log Analysis
Platform: Hacklido.com
Difficulty: Standard
Objective: Analyze a compromised system’s log file (timelog.txt) to identify timestamp anomalies, extract hidden hexadecimal data, and reconstruct the flag.
- Investigation Approach
Log files maintain event timestamps in a strict, predictable format. During investigation of timelog.txt, routine system events were recorded alongside timestamps that contained invalid minute values.
Our methodology follows three key phases:
File Inspection: Reviewing raw log entries to isolate invalid timestamp patterns.
Hexadecimal Extraction: Extracting corrupted minute digits that exceed standard time boundaries (00–59) or contain hex characters (a–f).
Data Reconstitution & Decoding: Combining the extracted hex values in chronological order and converting the result into printable ASCII.
- Step-by-Step Analysis
Step 1: Initial Log Inspection
Using native Linux terminal utilities, we inspected the log contents:
cat timelog.txt
Observation:
While valid system events show normal minutes (e.g., 10:01, 10:48, 10:43), several entries contain impossible minute values such as 10:61, 10:63, 10:6b, 10:7b, and 10:41. Furthermore, the final entry bypasses the standard timestamp format entirely (6d-40_6c79$7d).
Step 2: Isolating Anomalous Hexadecimal Values
Mapping the corrupted entries sequentially reveals ASCII characters encoded as hexadecimal bytes:
suspicious activity -> 10:54 (54 = T)
process start -> 10:61 (61 = e)
network connect -> 10:63 (63 = m)
file access -> 10:6b (6b = p)
reboot -> 10:65 (65 = 0)
anomaly detected -> 10:6d (6d = r)
cron job -> 10:7b (7b = @)
cleanup -> 10:72 (72 = l)
logs rotated -> 10:40 (40 = _)
restore -> 10:41 (41 = A)
maintenance -> 10:6e (6e = n)
Evaluating the final line gives the remaining bytes: 0, m, @, l, y, }.
Step 3: Flag Extraction & Verification
Combining the challenge prefix HackCTF{ with the extracted hex stream produces the following full hexadecimal sequence:
4861636b4354467b54656d703072406c5f416e306d406c797d
Executing a Python one-liner decodes the string directly in the terminal:
python3 -c ‘print(bytes.fromhex(“4861636b4354467b54656d703072406c5f416e306d406c797d”).decode())’
- Final Flag
HackCTF{Temp0r@l_An0m@ly}
