Admin Abuse — BroncoCTF 2026

Description

Some administrator has been going around doing some weird things lately. All they left me were these two cryptic clues. Allegedly, if you follow their trail, they'll lead you to a flag. What gives?

1160888390661714032

<t:1739660340:R>

Two Discord artifacts together point at a single Discord message. Following the trail (channel + timestamp) leads to an announcement that an admin edited to smuggle in the flag.

Analysis

The two clues are both Discord-native formats:

1. 1160888390661714032 — a Discord snowflake ID (18-19 digit integer). A snowflake encodes its creation time in the high bits:

   timestamp_ms = (snowflake >> 22) + 1420070400000   # Discord epoch
   

   This decodes to 2023-10-09 10:36:00 UTC — consistent with when the BroncoCTF Discord guild was created, but a snowflake alone doesn't tell you what kind of entity it is (user / channel / guild / message).

2. <t:1739660340:R> — Discord's relative-timestamp markup. The embedded unix timestamp 1739660340 = 2025-02-15 22:59:00 UTC, which falls inside the BroncoCTF 2025 competition weekend.

So one clue is an entity ID and the other is a point in time — together they describe which message to find (a channel) and when (a timestamp).

Resolving the snowflake to a channel

• BroncoCTF is run by SCUBroncoSec (Santa Clara University Cyber Security Club — broncosec.com, github.com/SCUBroncoSec).

• The official BroncoCTF Discord invite (from the CTFtime event page) is https://discord.gg/WT7HXqx8jP.

• The unauthenticated Discord invite API resolves the invite to its target channel:

  GET https://discord.com/api/v10/invites/WT7HXqx8jP?with_counts=true
  

  The response shows:

  • guild "BroncoCTF" id = 1160887571698700358
  • channel id = 1160888390661714032, type 0 (text), name announcements

  So clue 1 is the #announcements channel ID, and clue 2 is a timestamp of a message inside it.

Solution

...