Informatio

 The CTF is over but i really enjoyed solving the challenge (https://sctf.codeground.org/ctf/prob).The challenge is to decrypt flag.enc. This is another APK + JNI (Java Native Interface) kind of challenge similar to the one in Google CTF 2017 (http://shasaurabh.blogspot.com/2017/07/google-ctf-2017-android-re-challenge.html). Challenge can be divided into three parts. 1.Android application (application) loading Native Library 2.Native Library decrypts DEX file in memory. 3.Using Reflection to call methods of decrypted DEX file in step 2. 1. Android application loading Native Library OnClick() method of MainActivity class calls constructor of Crypt class. Calling constructor of Crypt class results in loading of Native library ( libegg.so ) which is ELF for ARM. Constructor of Crypt class calls crackEgg method implemented in native library. 2.Native Library decrypts DEX file in memory. The native library reads the encrypted DEX file stor...

The challenge compute flag using time received from NIST Internet Time Servers and then send computed flag to " labytime.com " server for verification. Before forming flag by using time received from  NIST Internet Time Servers the 2nd digit of seconds in received time is set to 0. We have 10 secs to send the computed flag to " labytime.com " server to get correct flag. Re-implemented the logic in python to calculate flag and sending it to " labytime.com " server and reading response to get flag.Below is the python implementation. from rotate import __ROR__ import hashlib import socket import requests c = [0x0C,0x74,0x0C,0x74,0x8D,0x39,0x39,0xED,0x35,0x5D,0x41,0x91,0x39,0x0D,0x15,0x45,0x8D,0x41,0x1D,0x81,0x1D,0x39,0x35,0x31,0x15,0xD9,0x35,0xDD,0x45,0x0C,0x74,0x0C,0x74,0x0C] ror_n = len(c) & 7 decode_str = '' for i in range(0,len(c)):     v = __ROR__((c[i]),2) & 0xFF     #print hex(v)     v = (v ^ len(c))& 0xF...

The challenge was consist of three parts. 1.Android application loading native library (ARM or x86) depending on platform. 2.Native library drops a dex file and dynamically loads it. 3.Native library modify bytes (in memory) of loaded dex file in step2. 1.Android application loading native library Decompiling food.apk file using JADX (Dex to Java decompiler) and looking at AndroidManifiest.xml we see activity is implemented in FoodActivity class. Looking at FoodActivity class it only loads the native library cook .The argument to System.loadLibrary is a library name chosen arbitrarily by the programmer. The system follows a standard, but platform-specific, approach to convert the library name to a native library name. For example, a Solaris system converts the name cook to libcook.so , while a Win32 system converts the same cook name to cook.dll . 2.Attaching to libcook.so . We will be using IDA Pro.Refer to http://www.hexblog.com/?p=809 for how to attach to nati...