# VUCyberthon23 CTF Writeups

**Phone model and version:**

`Flag (model): VU{samsung}`

`Flag (vendor): VU{SM-G530FZ}`

Writeup: Found the phone details in "system/build.prop"


**Whatsapp user and russian contact:**

`Flag: VU{Marcus}`

`Flag: VU{[phone]}`

Writeup: Found all contact information in "Contacts". For the russian contact, I searched up the country code, that was +74, and found the phone number.


**ICCID:**

`Flag: VU{89370038009021791031}`

Writeup: Exported images found on the phone, and one of then had the simcard ICCID on the back


**Bluetooth Mac:**

`Flag: VU{E0:99:71:8E:05:D0}`

Writeup: Found the MAC adress in efs/bluetooth/bt_addr


**Android email and user name:**

`Flag: VU{[e-mail]}`

`Flag: VU{John}`

Writeup: The email was in the db at data/com.android.email, and the name was found by reading the messages (ref "Hello John, ")


**Tanks video:**

`Flag{tanks.mp4}`

Writeup: The correct video was in media/downloaded


**Meeting point GPS:**

`Flag: VU{54.537718, 25.680509}`

Writeup: Got GPS coordinates from finding the image below


**Telegram user:**

`Flag: VU{5719323092}`

Writeup: The account number was stored in system/sync/accounts.xml


**Firewall**

`Flag: VU{cyberthon23}`

Writeup: Looked through the firewall.txt file. Had to format it by removing the NULL bytes, spaces etc. The found a rule with a weird Destination:

vk&p{7B3B9D23-2EC9-4C09-8270-06C33618656C}@v2.24|Action=Allow|Active=TRUE|Dir=In|Protocol=6|LPort=1579|Name=Unit|Desc=Y3liZXJ0aG9uMjM=|mhbin@v2.24|Action=Allow|Active=TRUE|Dir=Out|Profile=Domain|Profile=Private|Profile=Public|Name=@{Microsoft.AAD.BrokerPlugin_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy?ms-resource://Microsoft.AAD.BrokerPlugin/resources/PackageDisplayName}|Desc=@{Microsoft.AAD.BrokerPlugin_1000.10240.16384.0_neutral_neu

The destinaton name was a base64 string `Desc=Y3liZXJ0aG9uMjM=`, when decoded it gave us the flag `cyberthon23`

**Mem dump**

I didn't have time to go through the whole memory dump, but i found this on the machine:


Both the `password.txt` and `VU2023CYBER` files looked interesting. So the flag might have been there, maybe:))

**Plain sight:**

`Flag: VU{993440293a8be}`

Writeup: Found this image on the deans facebook account


This looked like the symbol fonts cipher


Decoded it manually and then decoded from base64 using cyberchef: