Root Quest - Mobile Hacking Community CTF Writeup

Challenge Info

Field	Details
CTF	Mobile Hacking Community CTF
Challenge	Root Quest
Category	Android / Reverse Engineering

Description

An application implements checks to detect rooted devices and emulators, preventing normal usage. Can you bypass these protections?

Solution

We can start by installing and opening the APK,

As expected, we cant enter the app as we are running it on a rooted emulator Now, we can inspect it in Jadx to understand how we should craft the bypass

It just calls two static methods isRunningOnEmulator() and isDeviceRooted from the classes EmulationUtil and RootUtil respectively. We can use Frida to force the return values of both the methods to 0(false)

Java.perform(() => {
    var Interceptor = Java.use("com.just.mobile.sec.challenge3.EmulationUtil");
    var Interceptor1 = Java.use("com.just.mobile.sec.challenge3.RootUtil");
    Interceptor.isRunningOnEmulator.implementation = function(){
        return 0;
    }
    Interceptor1.isDeviceRooted.implementation = function(){
        return 0
    }

})

We just need to load this script,

Flag

FLAG:MHC{j1qwqc01kbi1a08wamce3}