Knight - P3RF3CTR00T CTF Writeup

Challenge Info

Field	Details
CTF	P3RF3CTR00T CTF
Challenge	Knight
Category	Android / Reverse Engineering

Description

Uncover the secrets of the Dark knight to get the flag

Solution

We can start by installing the APK and opening it in our emulator

The activity says that input the flag to proceed and if we input anything random it says Incorrect Flag.Try Harder We can inspect the APK in Jadx,

The Main Activity does not have anything related to the checking logic, But we know the it displays Incorrect Flag.Try Harder for wrong input So, we can do a global search for Incorrect Flag.Try Harder to identify the class implementing the logic

The actual logic is being implemented in the class ei and see that a base64 encoded AES encrypted cipher text is being decrypted to which our input is compared. So, we just need to decrypt the ciphertext and the IV and KEY are hardcoded in other class jv Rather than the traditional approach of getting the IV and KEY and then decrypting it ourselves, I wanted to try out a Frida script i found, which hooks all the cryptographic function in a APK and logs its output
Source: https://codeshare.Frida.re/@L0WK3Y-IAAN/crypto-detection/ We just need to load this script and click the button once,

We should confirm the flag,

Flag

FLAG:k0t_r3v3rs3_kn1ght_n1nj4_07a51b8