We are given an image of a QR code and are tasked to find out when the file was printed. We are told that the flag is in the format pactf{yyyyMMddHHmm}.
We first look in the metadata to find out when the image was created
C:\Users\clark\Downloads\exiftool-11.32>"exiftool(-k).exe" "printout.png"
ExifTool Version Number : 11.32
File Name : printout.png
Directory : C:/Users/clark/Documents/GitHub/luhack_ctf_resources/pa/rolling printer/images
File Size : 410 kB
File Modification Date/Time : 2019:04:06 13:01:22+01:00
File Access Date/Time : 2019:04:06 13:16:57+01:00
File Creation Date/Time : 2019:04:06 13:01:22+01:00
File Permissions : rw-rw-rw-
File Type : PNG
File Type Extension : png
MIME Type : image/png
Image Width : 4961
Image Height : 7016
Bit Depth : 8
Color Type : RGB
Compression : Deflate/Inflate
Filter : Adaptive
Interlace : Noninterlaced
Exif Byte Order : Little-endian (Intel, II)
Bits Per Sample : 8 8 8
X Resolution : 236.22
Y Resolution : 236.22
Resolution Unit : cm
Software : GIMP 2.10.8
Photometric Interpretation : YCbCr
Samples Per Pixel : 3
Thumbnail Offset : 272
Thumbnail Length : 1622
Pixels Per Unit X : 23622
Pixels Per Unit Y : 23622
Pixel Units : meters
Modify Date : 2019:03:18 09:12:34
Image Size : 4961x7016
Megapixels : 34.8
Thumbnail Image : (Binary data 1622 bytes, use -b option to extract)
None of the dates or times are the correct flag (we are later told that it is not about the creation data or anything found in the metadata).
However, if we open the image in paint on Windows, and then fill the background with black, some marks appear that we could not see before.
If we take a closer look, the pattern seems to be repeating.
Printers leave marks on pages they print off for identification. Could it be this? If we google printer watermark and go on wikipedia we can see that the example pattern looks similar to ours, and has a guide to decode it. The code contains a date and time that is was printed, this must be it!
We can use this to decode the pattern to identify the time and date that it was printed.
- Year: 2012
- Month: 04
- Day: 14
- Hour: 18
- Minute: 44
Therefore, the flag is pactf{201204141844}.