8st SharifCTF Android WriteUps: Vol II

Skeleton

This the second and final writeup of Android challenges which was given in 8st Sharif CTF. I’ve wrote about the team and place in the previous post. The writeup begins …

Skeleton 1

Skeleton 1

Installing Skeleton

Just like any other question, I’ve installed the app to look what it is like. The virtual device was a API19 Android emulator. As you see, the skeleton laughs at me!

Skeleton 2

Skeleton 2

And there is no other activity, button, request location, etc. appeared in the app. I should mention that this question was in MISC section.

Looking The Code

I followed the instructions in my previous posts to investigate inside the source code of the app. Again JD GUI, Dex2Jar and APK Tool helped me.

Skeleton 3

Skeleton 3

The app has only MainActivity and inside, it loads a Scalable Vector Graphics image into the web view. SVG images are built on vectors, therefore they can be zoomed in and zoomed out without loosing the quality.

The best editor I know for editing SVG images, is Ink Scape.

The SVG

The only attack vector (if I can say) available was the SVG image. I started to investigate the SVG. Using APK Tool, I extracted the logo.svg file.

SVG Structure

SVG images are mark up files just as HTML or XML in which vectors are defined. So, I opened the logo.svg with a text editor.

Skeleton 4

Skeleton 4

As I taught, InkScape was used to make (or edit) the Skeleton.

The Writeup

I investigated more on the markup and found an interesting point. There are two graphics inside the image: one with the id layer1 and the other is text4146.

Skeleton 5

Skeleton 5

But we only see one graphics: the skeleton with some paths. The other graphics text4146 is suspicious. Therefore, I opened logo.svg with InkScape.

Skeleton 6

Skeleton 6

By moving the laughing skeleton, I’ve found text4146.

Skeleton 7

Skeleton 7

Voila, by zooming the text4146, flag is visible.

Skeleton 8

Skeleton 8

The flag is:

SharifCTF{be278492ae9b998eaebe3ca54c8000de}

Skeleton

Skeleton

Have fun!

Your email address will not be published. Required fields are marked *

*

WP to LinkedIn Auto Publish Powered By : XYZScripts.com