Mimic 2026 CTF

The Stopped Clock

Leo disappeared one night without a word.

The police found only one thing on his phone: a single photo, the last one he ever took.

Friends say he left something behind before he went. But there was no one there to hear it.

Remember, what you see is never the whole truth.

So we start by downloading the only provided file, last_seen.png:

Running exiftool on it already gives 2 interesting results: First, the comment, which looks like a base64 encoded string, and secondly the Warning: [minor] Trailer data after PNG IEND chunk message, which may mean that there’s more than just the image in this file.

Running:

exiftool -s3 -Comment last_seen.png | base64 -d

gives a hint that supports the embedded file hypothesis:
Every picture is bigger than it looks. Follow it all the way to the end - something is waiting for you there.

So we now test if we can see anything else embedded in the file, using binwalk:

Surprise! There’s a ZIP file embedded at offset 2052607! We extract it using binwalk -e last_seen.png -C lastseen_extracted, then we go see the content of the extracted directory:

When I tried unzipping the zip file, it prompted me for a password. So I went to see what voicemail.wav was.

The audio didn’t sound like Morse code, so my 2nd guess was to try it in a spectrogram, to try to uncover hidden text in the audio waves. I used cipherdecipher’s.

And Bingo!

This is most probably the key for the zip archive. Looking back at the original image, the current time reads 4:45, so I tried clock_0445 at the zip’s password prompt. And it worked!

unzip leo_diary.zip
Archive:  leo_diary.zip
[leo_diary.zip] diary.txt password: 
  inflating: diary.txt               
  inflating: torn_page.png    

So I read the diary.txt file:
cat diary.txt

=== LEO’S DIARY ===
(These pages are mine. If you found them, please read them slowly.)

12 Oct
I walked past the old clock tower again tonight. The clock still shows the same time it showed last year, and the year before that. Nobody in this city ever fixed it. I think people got used to it. Maybe they like having one thing that doesn’t change.

14 Oct
A man at the bus stop said, “That clock is broken, what a shame.” I told him it isn’t broken. It’s just honest. Everything around it keeps moving, but some things stay exactly where they are, like a sentence you never finished, or a letter you never sent.

17 Oct
Mom asked me where I go so late every night. I said, “Nowhere.” What I couldn’t say is that I stand under that clock and count people. How many walk past. How many stop and look up. Lately, almost nobody stops.

21 Oct
I met an old man by the tower today. He smiled and said, “Whatever you’re looking for, it isn’t in that clock. The ticking is inside you.” I laughed and walked away. But I lay awake all night thinking about it.

24 Oct
Today I took off my wristwatch and put it in a drawer. It felt strange. For a moment I felt lighter, like a noise I’d heard for years had finally gone quiet. Or maybe I was the one who switched it off.

27 Oct
I recorded a voicemail tonight. Some things sound clearer when you say them out loud. But after I said it, there was nobody on the other end. So I am writing it down here as well. Please listen to it too.

29 Oct, night
This is the last page. The rest was torn away, and this is all I have left. I thought about whether to write it down sixty-four times. In the end I did. This is the first half of the truth:

UkJIe3QxbWVfbjN2M3Jfc3QwcHAzZF8=

The second half is on the torn page, in the faintest layer of the paper. Written in red ink, the kind your eyes will miss. Put the two halves together, and maybe you’ll understand where I went.

One more thing. Please don’t look for me. I never really left.
– Leo

Base64 decoding the UkJIe3QxbWVfbjN2M3Jfc3QwcHAzZF8= string gives RBH{t1me_n3v3r_st0pp3d_. Now we only have to get the 2nd half of it, from the image: I opened the image in GIMP, and messed around with sliders, until I came to a realization: it was talking of red ink, while the circle was yellow. So I scrambled to find the Color Balance slider under Colors > Color Balance, and pushed Red to the max, which had the effect of turning the text red: But still no flag. So I thought perhaps the message was hidden in the light level, so I played with the Brightness and Contrast levels under Colors > Brightness-Contrast. At first I noticed no text, but I did see some weird little dots at minimum brightness and nearly max contrast: And that’s when I realized that there was text in them! While moving the sliders I found a setting that let me read the text clearly enough, around -113 Brightness and 116 Contrast:

With some difficulty, I was able to read w3_d1d_fee903f9} So I tried submitting the completed flag (RBH{t1me_n3v3r_st0pp3d_w3_d1d_fee903f9) and it worked!
Challenge solved

Challenge image and challenge text from Mimic CTF 2026 by Rare Byte Hub, used for writeup purposes.