Based - Mobile Hacking Community CTF Writeup

Challenge Info

Field	Details
CTF	Mobile Hacking Community CTF
Challenge	Based
Category	Android / Reverse Engineering

Solution

We can start by installing and opening the APK in our emulator

Very simple launcher activity, which ask to input a code and shows a toast based on our input Now, we can proceed to inspect it in Jadx,

We see that our input is validated using a method check() of the class Based, To understand the checking we must inspect the Based class.

So, our input is compared against the returned value of another method getPayload() We can use Frida to get the return value of getPayload()

Java.perform(() => {
    var Interceptor = Java.use("com.appknox.based.Based");
    var InterceptorObj = Interceptor.$new();
    console.log(InterceptorObj.getPayload());
})

We can load this script to get the flag,

Flag

FLAG:MHC{50_Y0U_T00_4R3_4_B453D_P3R50N}