Hi guys ! sorry if have to gone for a while, i have to postponed the 100dayspentesing challenge to finished my bachelor thesis report and it took a lot of time to finish it. So because i have spare time before the final thesis test, i decide to do some stretching again with CTF challenge.
This time i take the the owasp crackme challenge level 01 (you can download it in the following link: https://github.com/OWASP/owasp-mstg/tree/master/Crackmes/Android/Level_01)
LET THE GAME BEGIN !
First of all, you need to setup a machine to install the owasp level 01 apk you can use your own devide or vm (just choose the most comfortable one) and after you decide which one to use, install it with adb utility:
~# adb install UnCrackable-Level1.apk
The above figure is the interface when you opened the installed apk. From first glance you can tell that we only need to find a secret string (so no fancy function that we need to explore).
At this point i just straightly reverse engineer the apk to get the source code using enjarify (convert .apk to .jar) and procyon decompiler (convert .jar to source code).
enjarify command:
procyon command:
I suggest you to use the tool that i mentioned earlier, i try to use dex2jar to convert .jar to the source code but its become confusing.
Go to the mainactivity.java file for analyzing the main function of the application. It is pretty cool that the application is equipped with root and debugging feature, the figure below is the code that responsible for those checking.
The mainactivity.java class has 3 function class one of that catch my attention is the verify function and from the below figure we could summarize that this function is responsible for matching the secret string.
let me explain more detail about what the code do. Really simple! it takes the input from the user and it calls the "a" function from "a" class to check whether its the right string. Lets analyze this "a" function.
The above figure is the code for the a function. It takes the user input and before it compare with the secret string, It decrypting the s2 variable (which is the secret string) with AES algorithm by calling the sg.vantagepoint.a.a.a function class. The function took two parameters, the encrypted string (s2) and the key (the decode variable). The result of the function will be decrypted text that will compare with user input.
Because you can tell we already get the key and the encrypted text, all we need to do is simply have to implement the decryption method of the application to any programming language. Well in this case i just straightly create an android application that decrypt the secret text.
The above two figure is the code that i create to decrypt the secret text you can get the apk from the following link: https://github.com/acaciaworld80/100dayofpentesting/blob/master/level1_solve(day%209).apk. you can tell that i just copy the code from challenge 01 .apk to my application. Because why not ? technically we already get the answer right ?! lol
The above figure show the secret string of the application and when we insert it into the challenge 01 application like show in below figure, we get the right answer.
OK THAT'S ALL for this today post have a nice hacking weekend y'all.
Comments
Post a Comment