After loading the VM, we are greeted with a login page.
![img](https://gblobscdn.gitbook.com/assets%2F-MC_WJo7n-9hFwfJ__aw%2F-MCwP_6u6XO9BM-G3Cq9%2F-MCyIP_a6TUx_gaXvgas%2Fimage.png?alt=media&token=dc34f715-f0bf-4e2b-9ec9-d13e8c513743)
The goal is to login to the account "Sandb0x".
The challenge description states that the password consists of 4 lowercase characters, where the first character is 'p'. As the VM is called pwnyOS, I immediately guessed the password to be "pwny" which surprisingly worked.
![img](https://gblobscdn.gitbook.com/assets%2F-MC_WJo7n-9hFwfJ__aw%2F-MCwP_6u6XO9BM-G3Cq9%2F-MCyIayGc9A3Luc6N26b%2Fimage.png?alt=media&token=12920cbb-ea37-4e21-89c2-3a0621afaaca)
This was probably not the intended solution as the flag hints that it is supposed to be a Timing Side Channel attack. But oh well, whatever works I guess.
![img](https://gblobscdn.gitbook.com/assets%2F-MC_WJo7n-9hFwfJ__aw%2F-MCwP_6u6XO9BM-G3Cq9%2F-MCyL3ATiBFO918kORT5%2Fimage.png?alt=media&token=f8f713fa-857e-4f68-b87e-eaf12e9b12e4)
**Flag: uiuctf{t1ming_s1d3_chann3l_g4ng}**