NAHAMCON CTF 2022 - UDOM CYBER CLUB

THE COMPETITION ORGANIZED BY JOHN HAMMOND WITH MANY SPONSORS

CHALLENGES

JOHNKS

Name	Points	Authored By
johnks	500	birch#9901

---

Description

This is Forensic challenge

solution

i downloaded a png file and i can see a john Hammond pic and some stock values but the discription saying "Rising rising in height" so what if i increase the height of picture?

using tweak png to edit image height

then boom!!!
we get flag

DONE!!!

---

A WILD WIDE

Name	Points	Authored By
A wild Ride	500	Kkevsterrr#7469

---

Description

This is Forensic challenge

solution

i downloaded a zip file and it procteted but inside there bunch of file with extension gpx

after some googling i found that gpx is "is simply a text file with geographic information such as waypoints, tracks, and routes saved in it." so its like MAP point uhhh well

but the zip is Protected so i have to crack first

pasword:crackme

so its time to get the flag from those file where inside contain xml code

so its dead end , i need to open those file so i must find the right tool for this. i just googled how to open but many tools was able to open one by one but not in group until i found https://gpx.studio/

then after loading files. we get flag

---

STEAM LOCOMOTIVE

Name	Points	Authored By
Steam Locomotive	500	JohnHammond#6971

---

Description

This is Miscellaneous challenge

solution
after clicking start challenge i was given a ssh credentials then when i login i see train running on terminal then connection is closed

so i know to solve this type of challenge i need ssh tool that automate a login and execute commands before a server command do, then i used sshpass to do that

I run

DONE!! EAZY PIIIEZY

---

CEREAL

Name	Points	Authored By
Cereal	500	BusesCanFly#2237

---

Description

This is Hardware/RF challenge

solution

i downloaded a file and it called mystery.sal . so here its about looking for extension name . i just found that there tool called logic analyzer can open that

well on topi can see weird characters

i had to zoom out so i can see clear
boom flag is there

EAZY PIIEZY

---

so android challenge its about doing code review you just need to know where sensitive data are stored or what function pull important data and so on. so i just wanted to give a try here are challenges i solved and learning something new

OTP VAULT

Name	Points	Authored By
otp vault	500	congon4tor#2334

---

Description

This is Mobile challenge

solution

i downloaded a file and its apk which means its android file

installed a app and its

so i am supposed to enter a correct code which i dont know yet

i fired a jdx tool and start to look for source
i started with androidmanifest.xml

activity running is MainActivity so lets check it

package com.otpvault;

import com.facebook.react.ReactActivity;
import com.facebook.react.ReactActivityDelegate;
import com.facebook.react.ReactRootView;

/* loaded from: classes.dex */
public class MainActivity extends ReactActivity {
    @Override // com.facebook.react.ReactActivity
    protected String getMainComponentName() {
        return "OTPVault";
    }

    @Override // com.facebook.react.ReactActivity
    protected ReactActivityDelegate createReactActivityDelegate() {
        return new MainActivityDelegate(this, getMainComponentName());
    }

    /* loaded from: classes.dex */
    public static class MainActivityDelegate extends ReactActivityDelegate {
        public MainActivityDelegate(ReactActivity reactActivity, String str) {
            super(reactActivity, str);
        }

        @Override // com.facebook.react.ReactActivityDelegate
        protected ReactRootView createRootView() {
            ReactRootView reactRootView = new ReactRootView(getContext());
            reactRootView.setIsFabric(false);
            return reactRootView;
        }
    }
}

looks like it built IN react my guess was there must some javascript vile outhere

so looking for index.android.bundle we can see some javascript code so i had to copy and put to beautifier so i can see clearly

now after spent time looking for something good , finnaly i found interested function under line 31975 (daaamn so many lines to look, but sometimes you can search for some keyword like "flag" and that what i did after struggling)

**analyzing the code, **

seems the flag come from web server which use basic bearer authorization so my gues is i dont need to bypass the OTP app to get flag so i copied the url put to web

first shot

ohh no!! i just remember there /flag path lemme try itt

second shot

ohh are we go again , i just remember there bearer token outhere

third shot (using burp)

BOOOM we get flag!!!

EAZY PIIZY

---

CLICK ME

Name	Points	Authored By
Click Me	500	M_alpha#3534

---

Description

This is Mobile challenge

solution

i downloaded a file and its apk which means its android file

installed a app and its

so i am supposed to click until flag pop and i dont know how many times, could be 19029292939393 times or whetever but must be a larger number which will took me forever.

so lets view source code using jadx tool

starting with androidmanifest

we can see activity we are dealing with it its MainActivity, so lets check it out

we spoted this code

​​​​public final void cookieViewClick(View view) {
​​​​    int i = this.CLICKS + 1;
​​​​    this.CLICKS = i;
​​​​    if (i >= 13371337) {
​​​​        this.CLICKS = 13371337;
​​​​    }
​​​​    ((TextView) findViewById(C0574R.C0577id.cookieCount)).setText(String.valueOf(this.CLICKS));
​​​​}

​​​​public final void getFlagButtonClick(View view) {
​​​​    Intrinsics.checkNotNullParameter(view, "view");
​​​​    if (this.CLICKS == 99999999) {
​​​​        Toast.makeText(getApplicationContext(), getFlag(), 0).show();
​​​​        return;
​​​​    }
​​​​    Toast.makeText(getApplicationContext(), "You do not have enough cookies to get the flag", 0).show();
​​​​}

well seems like even we automate the action, one the click become greater or equal to 13371337 it will be assigned with that number everytime, so we wont be at 99999999 (am not sure but that what is my understand about the code)

continue …

i can see if the click become 99999999 i get the flag from method called getFlag() .

ohh getFlag() is interested!!
so then adventure beginn , the fact is i want to try a tool called frida and this is a time to give a try

i setup Frida ,

android emulator or rooted phone (i used genymotion)

i started frida server

its running !!!

my app its there so here is a big picture, we need to write a javascript code that will hook getFlag() method and give to us:

after hours i finaly come with this short payload that do the magic

//author: malwarepeter 29/04/2022

Java.perform(function(){
  var click = Java.use("com.example.clickme.MainActivity");

  var run = click.$new();
  var returnvalue = run.getFlag();
  console.log("");
  console.log("Flag: " + returnvalue);
});

BOOM!!! so excited , i get flag

so much fun on this! but end up learning something new, hope i will play around more with frida

---

---

REFERENCES

https://blog.ikuamike.io/posts/2020/razictf-chasingalock-writeup/

https://alyagomaa.github.io/blog/Using-Frida-to-call-unused-android-methods/