Hexordia Weekly CTF Challenge 2024 - Week 4 Writeup

 

Android - TEaM U prep (15 points)

What item that Rocco was shopping for came back in stock? 

From the capitalized letters in the challenge " TEaM U prep", it suggested that we probably should look into the direction of Temu, a Chinese online marketplace app. The Temu app was also installed on the Android device:


The item that Rocco was shopping was likely browsed by Rocco in app or even added into shopping cart at some point. Following this direction, the Temu app SQLite databases from /data/data/com.einnovation.temu/databases directory have been checked one by one.

One of the SQLite databases "ChatDB_BCM6G5ASA5K73AN2N7S3TQYUS2MOBTVG2RFRUULJ_msgbox_2.db" contained some in-app messages that were pushed to Rocco. There was a summary text of "Almost sold out" from summary column where id = "10000010''. The relevant info column appeared to have contained a JSON object:



If this JSON object was sorted and beautified in NotePad++, it would appear this JSON object contained a warning of a "mason jars" item in Rocco's shopping cart was almost sold out.


Somewhere down in the same SQLite database, there was a summary text where id = "10000020" that stated "Your mason jars is back with stunning additions." Combining the messages of the mason jars item "almost sold out" and "back with stunning additions", we could establish that "mason jars" was the answer to this challenge question.



Android - Watch for ADditional straw (20 marks)

What kind of shell is stage 3 of the water filter? 

The inspection of "ChatDB_BCM6G5ASA5K73AN2N7S3TQYUS2MOBTVG2RFRUULJ_msgbox_2.db" had led to some additional discoveries. 

One of them would be for some entries, e.g. where id = '10000009' or '10000012', contained a JSON object that started with "key":"promotions-price-dropped-for-item-in-cart", also with JSON object "goods_list" and key "goods_name".


If this JSON object was sorted and beautified in NotePad++, it would appear this JSON object contained some items from Rocco's Temu shopping cart. One of them would be the mason jars from the last question and the other would happen to be a "Outdoor Water Filter":

On one hand, the "thumb_url" key carried an URL that should be the image thumbnail of the outdoor water filter:


On the other hand, the "goods_id" (601099521101599) could be used to trace the original item of this particular outdoor water filter on Temu:

Upon further inspection within the Temu item page, there was one product promotional image that describes the water filtering process for this product and there was a STAGE 3 that involved "Coconut Shell Activated Carbon Filter Layer". So we could establish the answer of the challenge as "Coconut".






Comments

Post a Comment

Popular posts from this blog

Dumpster Diving in Google Photos Android App: "local_trash.db"

Image
  This article will explore the Trash within the Google Photos Android App. If you delete any media file from Google Photos on your mobile device, the deleted media file would then be relocated to the Trash within Google Photos. All items inside Trash will be permanently deleted after 60 days in Trash. In fact, the information of the Google Photos Trash items will be stored inside the " local_trash.db " under " /data/com.google.android.apps.photos/databases/ ": The " local " table of  " local_trash.db " contains most of the useful information, including " local_path " ( the original path of the deleted media file ), " trash_file_name " ( a UUID value that becomes the new name of the deleted media file ), " deleted_time " ( a Unix timestamp in milliseconds that recorded the delete time ), " is_video " ( where "0" = "no", "1" = "yes" ), etc. As soon as a media file was ...
Read more

Hexordia Weekly CTF Challenge 2024 - Week 1 Writeup

Image
 Recently, Hexordia has started a new weekly CTF challenge and I have signed up to join the challenge. The following is my writeup for the week 1 challenges: iOS - Crewmates are Sus (15 marks) What is Chad's user ID for the multiplayer social game? The terms "Crewmates" and "Sus" used in the question name suggests to the popular multiplayer social game "Among Us" From iLEAPP "Application State report" page, Among Us ( com.innersloth.amongus ) was installed and the sandbox path for Among Us can be found at  /private/var/mobile/Containers/Data/Application/AE23352D-C47B-43D9-87A7-6141653955A2 Using FTK Imager, the sandbox file path could be navigated to and I have decided to inspect iOS app Preferences related files first as we are looking for a gaming user ID: Using plistEditor Pro, the plist files could be opened and one of them ( com.innersloth.amongus.plist ) has a userid key with value 001381.5ced44f175f640fb9264ce19cc43683f.2043 which wa...
Read more

Hexordia Weekly CTF Challenge 2024 - Week 2 Writeup

Image
Following the 1st week of the Hexordia Weekly CTF Challenge 2024, we are now into week 2 of this CTF. The challenges of this week consisted of Android-related challenges only: Android -  Total Freedom (10 marks) What URL was opened after pasting language from ONeal's gist? After reading the question, we would be most likely looking for web browsing history on the Android image since we were after a certain opened URL. At the same time, the term "gist" used here had immediately reminded me of GitHub Gists. In case you have not heard of GitHub gists before, ' Gists are one feature of GitHub, which defines them as "a simple way to share snippets and pastes with others." ', according to the research article " What is the Gist?: understanding the use of public Gists on GitHub " available on ACM digital library. After running a quick search of the term " gist " in Magnet AXIOM Examine, only Google Chrome had web visit hits against GitHub Gi...
Read more