No Matter What You See - Mobile Hacking Community CTF Writeup

Challenge Info

Field	Details
CTF	Mobile Hacking Community CTF
Challenge	No Matter What You See
Category	Android / Reverse Engineering

Descriptiom

This app mistakenly exposes a sensitive Activity. Can you leverage this exported component to uncover the hidden flag?

Solution

Since the description metions about exported component, we can begin with inspecting the Manifest file in Jadx

We see an HiddenActivity with the attribute android:exported="true" i.e this activity is exposed and can we direclty accessed via intent targeted towards this activity In our ADB shell, am start -n com.just.mobile.sec.challenge2/.HiddenActivity

Flag

FLAG:MHC={6xejitv015ldpw7f4hgndb7u}