Challenge #2 - ItsOnFire

Description

The FLARE team is now enthusiastic about Google products and services but we suspect there is more to this Android game than meets the eye.

Solution

In this case i tried to run the APK in my emulator with SDK version 33.

From image above, we can see that the APK is a game like space war. Decompiling the APK we will see some class inside com.secure.itsonfire package

Most of the class related to the game, but there is suspicious class named PostByWeb

PostByWeb function send a request to HTTP server and when we trace the call of PostByWeb function we will see the class that called it which is MessageWorker

As we can see that PostByWeb parameter is String str = getString(R.string.c2) + token; . So next step is looking at R.string.c2 value on strings.xml

Most of the code are obfuscated but the string name on strings.xml are not. Searching for any suspicious string name on strings.xml i found below suspicious string

  • R.string.alg = AES/CBC/PKCS5Padding

  • R.string.key = my_custom_key

  • R.string.iv = abcdefghijklmnop

Based on the string name, it looks like data requirement to implement encryption using AES CBC on java. Find the function that use those string i got below class

  • R.string.alg -> f/b.java

  • R.string.key -> com/secure/itsonfire/MessageWorker.java

  • R.string.iv -> f/b.java

Take a look on f/b.java, it looks like function that decrypt resource available on APK. Below is the flow

  • function f.b.c

    • f.b.e -> open resource

    • f.b.d -> get string value

    • f.b.b -> do AES CBC decryption

    • Write decrypted data to file

In this case, without doing dynamic analysis we can get all values needed to do decryption including the encrypted files.

  • Algorithm = R.string.alg

  • Key = d(context)

    • Processed value from R.string.c2 and R.string.w1

  • IV = R.string.iv

  • Encrypted files

So, the final step is rewriting the decrypt function in Java then decrypt the raw resource.

Flag : Y0Ur3_0N_F1r3_K33P_601N6@flare-on.com

Last updated