Admin Abuse

Platform: CUSTOM | Category: OSINT | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: discord_snowflake_decoding, discord_timestamp_markup, invite_api_channel_resolution, message_edit_history_inspection

Summary

Walkthrough of the CUSTOM OSINT Admin Abuse. Task: two cryptic Discord clues (a snowflake ID and a <t:...:R> timestamp) form a pointer to a specific message. Solution: decode the snowflake to the BroncoCTF #announcements channel via the Discord

Description

Some administrator has been going around doing some weird things lately. All they left me were these two cryptic clues. Allegedly, if you follow their trail, they'll lead you to a flag. What gives?

1160888390661714032

<t:1739660340:R>

Two Discord artifacts together point at a single Discord message. Following the trail (channel + timestamp) leads to an announcement that an admin edited to smuggle in the flag.

Analysis

The two clues are both Discord-native formats:

1. 1160888390661714032 — a Discord snowflake ID (18-19 digit integer). A snowflake encodes its creation time in the high bits:

   timestamp_ms = (snowflake >> 22) + 1420070400000   # Discord epoch
   

   This decodes to 2023-10-09 10:36:00 UTC — consistent with when the BroncoCTF Discord guild was created, but a snowflake alone doesn't tell you what kind of entity it is (user / channel / guild / message).

2. <t:1739660340:R> — Discord's relative-timestamp markup. The embedded unix timestamp 1739660340 = 2025-02-15 22:59:00 UTC, which falls inside the BroncoCTF 2025 competition weekend.

So one clue is an entity ID and the other is a point in time — together they describe which message to find (a channel) and when (a timestamp).

Resolving the snowflake to a channel

• BroncoCTF is run by SCUBroncoSec (Santa Clara University Cyber Security Club — broncosec.com, github.com/SCUBroncoSec).

• The official BroncoCTF Discord invite (from the CTFtime event page) is https://discord.gg/WT7HXqx8jP.

• The unauthenticated Discord invite API resolves the invite to its target channel:

  GET https://discord.com/api/v10/invites/WT7HXqx8jP?with_counts=true
  

  The response shows:

  • guild "BroncoCTF" id = 1160887571698700358
  • channel id = 1160888390661714032, type 0 (text), name announcements

  So clue 1 is the #announcements channel ID, and clue 2 is a timestamp of a message inside it.

Solution

1. Decode the snowflake and the timestamp:

    python read-only • copy allowed Copy
   #!/usr/bin/env python3
   DISCORD_EPOCH = 1420070400000
   import datetime
   
   snowflake = 1160888390661714032
   ts_ms = (snowflake >> 22) + DISCORD_EPOCH
   print("snowflake created:",
         datetime.datetime.utcfromtimestamp(ts_ms / 1000), "UTC")
   # -> 2023-10-09 10:36:00 UTC
   
   unix = 1739660340   # from <t:1739660340:R>
   print("timestamp clue:",
         datetime.datetime.utcfromtimestamp(unix), "UTC")
   # -> 2025-02-15 22:59:00 UTC

2. Resolve the snowflake to the #announcements channel through the invite API:

    bash read-only • copy allowed Copy
   curl -s 'https://discord.com/api/v10/invites/WT7HXqx8jP?with_counts=true' | python3 -m json.tool
   # channel.id == 1160888390661714032  (type 0, "announcements")
   # guild.id   == 1160887571698700358  ("BroncoCTF")

3. Join discord.gg/WT7HXqx8jP, open #announcements, and scroll to the message posted at 2025-02-15 22:59:00 UTC.

   Timezone caveat: Discord displays message times in the viewer's local timezone. In UTC+3 (MSK), 22:59 UTC = 01:59 the next day, so the target message appears under the 16 Feb 2025 day separator, not the 15th. Convert carefully or the message looks "missing".

4. The message at that time is from admin yoshie (role RHAB) and reads simply Restarting — but it carries an (edited) marker.

5. The "Admin Abuse": an admin abused edit privileges to edit an old announcement and hide the flag inside it. The edited message body contains the flag:

   bronco{REDACTED}
   

   The flag reads "who gave this man edit privileges" — a self-referential joke about the very abuse used to plant it.

Dead-ends (so future solvers don't waste time)

• Discord API auth wall: channel-message and pins endpoints and the guild widget require authentication (401/403). The final read requires actually joining the Discord — you can't pull the message contents unauthenticated.
• Google Drive red herring: an earlier #announcements post linked a public Drive folder "[External] BroncoCTF Files For The Mean Time..." (id 1q9G1-vpY-B91zc8aTcR-ajvVCR63HkyU) holding all 61 BroncoCTF 2025 challenge files. That's just mirrored challenge material — the flag is not there.
• Third-party snowflake lookup sites (discordlookup.mesavirep.xyz, lookup.guru) were dead/parked; use the official Discord invite API instead.

Key Takeaways / Lessons

• Mastering discord_snowflake_decoding, discord_timestamp_markup, invite_api_channel_resolution, message_edit_history_inspection was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-07-11 • CUSTOM • Admin Abuse • Difficulty: Easy