Blast from the past

Description: The judge for these pictures is a real fan of antiques. Can you age this photo to the specifications? Set the timestamps on this picture to 1970:01:01 00:00:00.001+00:00 with as much precision as possible for each timestamp. In this example, +00:00 is a timezone adjustment. Any timezone is acceptable as long as the time is equivalent. As an example, this timestamp is acceptable as well: 1969:12:31 19:00:00.001-05:00. For timestamps without a timezone adjustment, put them in GMT time (+00:00). The checker program provides the timestamp needed for each.
Difficulty: Medium

🔎 Solution

The challenge provides us with an image file and asks us to modify all of its timestamps to 1970:01:01 00:00:00.001+00:00 with maximum possible precision for each timestamp.

Inspecting the image's metadata reveals 7 different time-related fields that need to be changed.

> exiftool original.jpg                                       
File Name                       : original.jpg
Modify Date                     : 2023:11:20 15:46:23
Date/Time Original              : 2023:11:20 15:46:23
Create Date                     : 2023:11:20 15:46:23
Time Stamp                      : 2023:11:20 15:46:21.420-05:00
Create Date                     : 2023:11:20 15:46:23.703
Date/Time Original              : 2023:11:20 15:46:23.703
Modify Date                     : 2023:11:20 15:46:23.703

Using exiftool with the -AllDates parameter, we can quickly reset most of these timestamps to the desired value.

> exiftool -AllDates="1970:01:01 00:00:00.001" \
-SubSecCreateDate="1970:01:01 00:00:00.001" \
-SubSecDateTimeOriginal="1970:01:01 00:00:00.001" \
-SubSecModifyDate="1970:01:01 00:00:00.001" original.jpg
    1 image files updated

However, upon reviewing the metadata, the Samsung:TimeStamp field still retains its original value.

Time Stamp                      : 2023:11:20 15:46:21.420-05:00

Submitting the file in this state results in an error indicating that Samsung:TimeStamp has not been updated.

Checking tag 7/7
Timezones do not have to match, as long as it's the equivalent time.
Looking at Samsung: TimeStamp
Looking for '1970:01:01 00:00:00.001+00:00'
Found: 2023:11:20 20:46:21.420+00:00
Oops! That tag isn't right. Please try again.

This particular tag cannot be modified directly via exiftool.

According to documentation, the TimeStamp tag is located 13 bytes after the first 14 bytes of [Image_UTC_Data]. Initially, the file's timestamp value was 1700513181420, stored in Unix epoch format.

By manually changing this value to 0000000000001, the corresponding metadata field updates to reflect the target time.

Finally, after resubmitting the modified image and running the verification program, the solution is accepted and the flag is obtained.

🚩Flag

picoCTF{71m3_7r4v311ng_p1c7ur3_83ecb41c}

🔎 Solution​

🚩Flag​

🔎 Solution

🚩Flag