Time Capsule Writeup

Challenge Time Capsule

Category Forensics and Misc

Final flag: R3CTF{Accuracy_Brilliance_Creativity_Dedication_Equanimity_Fortitude}

Overview

Time Capsule is a forensics and misc challenge that combines several different ideas. The archive contains images audio clues network data encrypted archives and a voxel renderer. At first the files look unrelated. The correct approach is to treat them as a chain where each solved layer gives information needed by the next layer.

The challenge description talks about digital archaeology and about data hidden in many formats. That is a hint that no single tool is enough. The solver has to inspect file names file sizes visual patterns and decoded outputs. Each clue narrows the search until the final binary object can be rebuilt.

The final result is meaningful. It is not a random UUID and not a random hash. The final message comes from six QR codes that appear after the binary data is converted into a 3D voxel cube.

The final flag is R3CTF{Accuracy_Brilliance_Creativity_Dedication_Equanimity_Fortitude}.

Step 1 Initial archive review

The first action was to extract the archive and list the files. The archive contained many encrypted ZIP files with movie names. This could make the challenge look like a brute force problem but the names and the extra files were more useful than guessing passwords.

The important files were Secret.png SECRET.zip 2001 — A Space Odyssey.zip The Matrix.zip Star Wars.zip and voxel.html. The names show two main themes. One theme is SECRET because there is both Secret.png and SECRET.zip. The other theme is science fiction movies because several ZIP files are named after famous films.

SECRET.zip was treated as the first target because it was the only archive with a direct matching image. The movie archives were kept for later because the challenge text and the extracted note suggested that the first part was connected to the other movie archives.

The goal at this stage was not to open every file randomly. The goal was to identify which files formed a path. That path became Secret.png to SECRET.zip to part_1.bin and then movie archives to part_2.bin part_3.bin and part_4.bin.

Step 2 Notice that Secret.png is not normal steganography

Secret.png looks strange. Its dimensions are tall and narrow. The content is made from blocks of bright colors. The image does not look like a natural photo and does not look like a normal QR code or barcode.

Basic image steganography ideas such as reading least significant bits or checking color channels do not explain the structure well. The important detail is the controlled palette. The colors match the style of Piet programs.

Piet is an esoteric programming language where the source code is an image. The interpreter moves through colored regions and executes operations depending on hue and lightness changes. This means the image must be executed and not just viewed.

This is why Secret.png was the right clue for SECRET.zip. The password was not hidden as plain text inside metadata. The password was produced by running the picture as code.

Step 3 Use the Piet idea to recover the first password

After recognizing the Piet structure the image was executed with a Piet interpreter. The expected tool is npiet. Running the image produced numeric output that stayed in the printable ASCII range.

Printable ASCII output is a strong sign that the result should be converted into text. After conversion the output message explained the intended clue and revealed the key.

The decoded message was Thx 2 Piet Mondrian which is the person who can help me to stop your guys just throw the problem to agent and solve it without thinking…… the key you found is P137_M0dri4n

The important value from that message is P137_M0dri4n. This value is the password for SECRET.zip.

The reference to Piet Mondrian is also meaningful. The programming language Piet is named after the painter and uses color blocks as instructions. That confirms that the identification of Secret.png as a Piet program was correct.

Step 4 Extract part_1.bin from SECRET.zip

SECRET.zip was extracted with the password P137_M0dri4n. This produced part_1.bin. The file size was exactly 1024 bytes which matched the expected size of one binary fragment.

The extraction also produced a small clue that said what you find is hidding in other movies. The grammar is not important. The meaning is important. It tells the solver that the remaining parts are hidden in the movie archives.

This prevented blind searching. Instead of trying every ZIP file the clue points toward the movie named archives that had already stood out during inspection.

At the end of this step the first quarter of the final binary payload was recovered.

Step 5 Recover part_2.bin part_3.bin and part_4.bin

The next important archives were 2001 — A Space Odyssey.zip The Matrix.zip and Star Wars.zip. These archives contained the remaining three binary fragments.

The password for these three archives was F0r7y_7w0. This key came from the earlier clue chain that involved audio and packet information. The wording connects to forty two which is a classic reference to the ultimate answer clue.

Using this password extracted part_2.bin from 2001 — A Space Odyssey.zip. It extracted part_3.bin from The Matrix.zip. It extracted part_4.bin from Star Wars.zip.

Each output file was 1024 bytes. This repeated size was important because it showed that all four parts belong to the same structure. It also showed that none of the files were corrupted or incomplete.

Step 6 Understand the meaning of the 4096 byte payload

The four files were joined in the order part_1.bin part_2.bin part_3.bin and part_4.bin. The order matters because the challenge states that the fragments are sequential.

Get kynxsoft’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

The joined file was 4096 bytes. Since each byte has 8 bits this becomes 32768 bits. The number 32768 is not accidental. It equals 32 x 32 x 32.

This is the key mathematical observation of the challenge. A file with 32768 bits can represent a full binary cube with side length 32. Each bit can become one voxel position. A bit value of 1 can mean filled. A bit value of 0 can mean empty or background.

This explains why voxel.html was included in the archive. The final data is not meant to be read as plain text. It is meant to be transformed into a voxel model.

At this stage the problem changes from archive extraction into spatial reconstruction.

Step 7 Connect the payload to a fifth order 3D Hilbert curve

The challenge included hints about flattening and a Hilbert curve. A Hilbert curve is a space filling curve that maps a one dimensional sequence into a multidimensional shape. It is useful because points that are close in the sequence often stay close in space.

For a 3D Hilbert curve of order 5 each axis has length 2 to the power of 5. That gives a side length of 32. The total number of positions is therefore 32 x 32 x 32 which is 32768.

This matches the exact number of bits in the joined payload. That match is too precise to be coincidence. It means the payload is a bit stream that must be placed into a 32 x 32 x 32 cube by following a fifth order 3D Hilbert traversal.

For each bit index the decoder converts the Hilbert index into x y z coordinates. If the bit is set then a voxel is placed at that coordinate. If the bit is not set then the coordinate remains empty or background.

Using a normal row by row order would not make the QR faces appear correctly. The Hilbert order is required to undo the flattening.

Step 8 Prepare the JSON structure for voxel.html

After the bits were mapped into a cube the data needed to be exported in the format expected by voxel.html. The renderer did not expect a raw binary file. It expected JSON.

The structure used by the renderer is simple. Each voxel entry contains x y z and color. The first three values define position. The last value defines how the voxel is drawn.

The decoded cube was therefore converted into a JSON list. Each filled coordinate became a JSON entry. The resulting file could be imported into voxel.html to display the reconstructed object.

This step is also a validation step. If the bit order or curve order is wrong the JSON still imports but the visual output looks like noise. With the correct Hilbert mapping the cube shows readable QR patterns.

Step 9 Render the 3D voxel cube

The generated JSON was imported into the voxel renderer. The result was a 3D cube made from the decoded bits. The cube was not random. Its faces contained QR like patterns.

The 3D view proves that the recovered binary data had the correct structure. The renderer makes the hidden geometry visible. This is the point where the final layer of the challenge becomes clear.

The QR patterns were placed on several faces of the cube. This explains why a 3D representation was needed. Looking at only the raw bytes or only a single 2D slice would not fully reveal the final answer.

The challenge note said that the final order should be A through F. The next step was to read the six faces in that order.

Step 10 Decode the six QR faces

The six QR faces were extracted from the voxel cube. Each face contained one word. The words were not random. They were positive abstract nouns and each one started with a different letter from the ordered labels.

The decoded values were A Accuracy. B Brilliance. C Creativity. D Dedication. E Equanimity. F Fortitude.

The order is important. Reading the words in the wrong order would still produce understandable words but it would not match the intended flag sequence. The challenge statement specifically tells the solver to use A through F.

This stage turns the geometry result into a final text result.

Step 11 Assemble the final flag

The QR words were joined with underscores. The result was wrapped in the challenge flag format.

The final flag is R3CTF{Accuracy_Brilliance_Creativity_Dedication_Equanimity_Fortitude}.

This final flag is meaningful because it is made from the six QR words. It also confirms that all previous stages were solved in the correct order.

Conclusion

The challenge is a layered reconstruction puzzle. The first layer is visual program analysis. Secret.png is a Piet program and gives the first ZIP password. The second layer is archive extraction. The four encrypted archives produce four equal binary fragments.

The third layer is size analysis. Four fragments of 1024 bytes become one file of 4096 bytes. That equals 32768 bits. The number matches a 32 x 32 x 32 cube.

The fourth layer is curve decoding. The bits are not stored in normal order. They are flattened through a fifth order 3D Hilbert curve. Reversing that curve reconstructs the hidden cube.

The fifth layer is rendering. voxel.html reveals the needed JSON structure and renders the decoded coordinates as a 3D voxel model. The final layer is QR reading. The six faces give the six words that form the final flag.

The complete solution path is Secret.png then Piet output then SECRET.zip then part_1.bin then the movie archives then the joined 4096 byte payload then 3D Hilbert decoding then voxel JSON then QR scanning then the final flag.

Author profile