[Incognito CTF 2023] Guess who!! Writeup

A writeup for Guess who!!, a Forensic challenge from Incognito CTF 2023 (held November 24–25, 2023). You get a single file and have to recover its author, its build timestamp, its original name, and a section entropy — a classic PE metadata analysis problem.

The challenge

• flag1 : the name of the person who presumably made the file
• flag2 : the time the file was first debugged (YYYY:MM:DD:HH:MM:SS, UTC +9)
• flag3 : the presumed original file name before it was renamed
• flag4 : the entropy of the .text section (to two decimal places)

flag : INCO{flag1_flag2_flag3_flag4}

flag1 — the author's name

Opening the given file normally didn't work, so I dropped it into DIE (Detect It Easy). Inside, a suspicious entry named FIND_ME.zip showed up.

FIND_ME.zip sitting inside the challenge file.

The challenge file was Hi.pptx, and OOXML documents are really just ZIP containers. So I renamed it to Hi.zip, unpacked it, and pulled out FIND_ME.zip. Inside was a single executable, which I opened in DIE again.

To see whether anything about the author was left behind, I went through the strings and filtered on user.

C:\Users\Phato\source\repos\CRIME_NOTICE\x64\Release\CRIME_NOTICE.pdb

The PDB path had been baked in at compile time. That gives away two things at once:

• The user name is Phato — presumably the author of the file.
• The project/output name is CRIME_NOTICE — very likely the file's original name (a hint for flag3).

flag2 — the first debug timestamp

The first debug time lives in the TimeDateStamp of the PE Debug Directory, so I opened the debug directory with CFF Explorer.

The TimeDateStamp field of the Debug Directory.

That value is a Unix epoch timestamp in seconds, so it has to be converted into a human-readable time. The challenge asked for KST (UTC +9), so I converted accordingly.

The result — November 6, 2023, 13:56:31.

So the first debug time is 2023:11:06:13:56:31.

flag3 — the original file name

The PDB path from flag1 answers this directly. The build output path is ...\repos\CRIME_NOTICE\x64\Release\CRIME_NOTICE.pdb, so the file was named CRIME_NOTICE before it was renamed.

flag4 — .text section entropy

DIE's entropy view reports entropy per section directly.

The .text section has an entropy of 5.83.

Rounded to two decimal places, that's 5.83.

flag

INCO{Phato_2023:11:06:13:56:31_CRIME_NOTICE_5.83}

Takeaways

The point of this challenge is that all four flag pieces came from metadata the file leaked about itself.

• OOXML documents like pptx are ZIP archives, so just changing the extension exposes the internal structure.
• A PDB path left in a Release build leaks both the developer's account name and the original project name.
• The PE Debug Directory TimeDateStamp reveals when the binary was built/debugged.
• Section entropy is normally used to judge whether a binary is packed, but here the value itself is the answer.