← Back to Writeups
HTBN/AOSINT
Bookmark

Admin Abuse

XESXOR8/23/20265 min read
#osint#htb#n/a

Admin Abuse

Platform: Broncoctf2026 | Category: OSINT | Type: Challenge | Difficulty: Easy | OS: NA | Author: D3v0o0Nu11 | Date: 2026-07-11 | Status: Solved Techniques: discord_snowflake_decoding, discord_timestamp_markup, invite_api_channel_resolution, message_edit_history_inspection

Summary

Task: two cryptic Discord clues (a snowflake ID and a <t:...:R> timestamp) form a pointer to a specific message. Solution: decode the snowflake to the BroncoCTF #announcements channel via the Discord invite API, resolve the timestamp to a message, and read the flag hidden in that message's edit history (admin edit-privilege abuse).

Recon

Port scan

nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn
PortServiceVersionNotes
<PORT><SVC><VER><notes>

Enumeration highlights

  • Event: broncoctf2026 | ID: 20260711_broncoctf2026_admin_abuse
  • Tags: timestamp, discord, snowflake, discord_invite_api, message_edit, ctftime
  • Indicators: 18-19 digit Discord snowflake ID, <t:UNIX:R> relative-timestamp markup, clue references an administrator's trail, (edited) marker on a Discord message
  • Source: 20260711_broncoctf2026_admin_abuse.md

Foothold

Vulnerability / Misconfiguration

  1. Discord_snowflake_decoding
  2. Discord_timestamp_markup
  3. Invite_api_channel_resolution
  4. Message_edit_history_inspection
<command>

Exploitation

  • See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

  1. N/A for challenge-type writeup; see exploitation above.
  2. Flag obtained via challenge solve.
<command>

Flags

FlagLocationValue
flagREDACTED

Key Takeaways / Lessons

  • discord_snowflake_decoding
  • discord_timestamp_markup
  • invite_api_channel_resolution
  • message_edit_history_inspection
  • Tags: timestamp, discord, snowflake, discord_invite_api, message_edit, ctftime

Original Writeup

<details><summary>Click to expand original content</summary>

Description

Some administrator has been going around doing some weird things lately. All they left me were these two cryptic clues. Allegedly, if you follow their trail, they'll lead you to a flag. What gives?

1160888390661714032

<t:1739660340:R>

Two Discord artifacts together point at a single Discord message. Following the trail (channel + timestamp) leads to an announcement that an admin edited to smuggle in the flag.

Analysis

The two clues are both Discord-native formats:

  1. 1160888390661714032 — a Discord snowflake ID (18-19 digit integer). A snowflake encodes its creation time in the high bits:
   timestamp_ms = (snowflake >> 22) + 1420070400000   # Discord epoch

This decodes to 2023-10-09 10:36:00 UTC — consistent with when the BroncoCTF Discord guild was created, but a snowflake alone doesn't tell you what kind of entity it is (user / channel / guild / message).

  1. <t:1739660340:R> — Discord's relative-timestamp markup. The embedded unix timestamp 1739660340 = 2025-02-15 22:59:00 UTC, which falls inside the BroncoCTF 2025 competition weekend.

So one clue is an entity ID and the other is a point in time — together they describe which message to find (a channel) and when (a timestamp).

Resolving the snowflake to a channel

  • BroncoCTF is run by SCUBroncoSec (Santa Clara University Cyber Security Club — broncosec.com, github.com/SCUBroncoSec).
  • The official BroncoCTF Discord invite (from the CTFtime event page) is https://discord.gg/WT7HXqx8jP.
  • The unauthenticated Discord invite API resolves the invite to its target channel:
  GET https://discord.com/api/v10/invites/WT7HXqx8jP?with_counts=true

The response shows:

  • guild "BroncoCTF" id = 1160887571698700358
  • channel id = 1160888390661714032, type 0 (text), name announcements

So clue 1 is the #announcements channel ID, and clue 2 is a timestamp of a message inside it.

Solution

  1. Decode the snowflake and the timestamp:
   #!/usr/bin/env python3
   DISCORD_EPOCH = 1420070400000
   import datetime

   snowflake = 1160888390661714032
   ts_ms = (snowflake >> 22) + DISCORD_EPOCH
   print("snowflake created:",
         datetime.datetime.utcfromtimestamp(ts_ms / 1000), "UTC")
   # -> 2023-10-09 10:36:00 UTC

   unix = 1739660340   # from <t:1739660340:R>
   print("timestamp clue:",
         datetime.datetime.utcfromtimestamp(unix), "UTC")
   # -> 2025-02-15 22:59:00 UTC
  1. Resolve the snowflake to the #announcements channel through the invite API:
   curl -s 'https://discord.com/api/v10/invites/WT7HXqx8jP?with_counts=true' | python3 -m json.tool
   # channel.id == 1160888390661714032  (type 0, "announcements")
   # guild.id   == 1160887571698700358  ("BroncoCTF")
  1. Join discord.gg/WT7HXqx8jP, open #announcements, and scroll to the message posted at 2025-02-15 22:59:00 UTC.

Timezone caveat: Discord displays message times in the viewer's local timezone. In UTC+3 (MSK), 22:59 UTC = 01:59 the next day, so the target message appears under the 16 Feb 2025 day separator, not the 15th. Convert carefully or the message looks "missing".

  1. The message at that time is from admin yoshie (role RHAB) and reads simply Restarting — but it carries an (edited) marker.

  2. The "Admin Abuse": an admin abused edit privileges to edit an old announcement and hide the flag inside it. The edited message body contains the flag:

   bronco{REDACTED}

The flag reads "who gave this man edit privileges" — a self-referential joke about the very abuse used to plant it.

Dead-ends (so future solvers don't waste time)

  • Discord API auth wall: channel-message and pins endpoints and the guild widget require authentication (401/403). The final read requires actually joining the Discord — you can't pull the message contents unauthenticated.
  • Google Drive red herring: an earlier #announcements post linked a public Drive folder "[External] BroncoCTF Files For The Mean Time..." (id 1q9G1-vpY-B91zc8aTcR-ajvVCR63HkyU) holding all 61 BroncoCTF 2025 challenge files. That's just mirrored challenge material — the flag is not there.
  • Third-party snowflake lookup sites (discordlookup.mesavirep.xyz, lookup.guru) were dead/parked; use the official Discord invite API instead.
</details>

Auto-tracked: saved to WriteUps; run /xesor-revise to fold lessons into XESXor_Methodology.md.

signed by XESXOR