BSides San Francisco CTF 2017 – pinlock

Description: It’s the developer’s first mobile application. They are trying their hand at storing secrets securely. Could one of them be the flag?
Note: For this challenge, we need install some things into our Android 5.1 device with Genymotion.
For example, an ARM Translator.
https://github.com/m9rco/Genymotion_ARM_Translation

Download APK: https://lautarovculic.com/my_files/pinstore.apk

Install the apk with adb

				
					adb install -r pinstore.apk

Then, decompile with apktool

				
					apktool d pinstore.apk

Notice that we have a simple pin code check. Just integers.
Let’s analyze the source code with jadx.

I notice in the AndroidManifest.xml file we have two activities

				
					<activity android:name="pinlock.ctf.pinlock.com.pinstore.MainActivity">  
    <intent-filter>  
        <action android:name="android.intent.action.MAIN"/>  
    <category android:name="android.intent.category.LAUNCHER"/>  
    </intent-filter>  
</activity>  
<activity android:name="pinlock.ctf.pinlock.com.pinstore.SecretDisplay"/>

The activity are exported as True by default, then, we can access it with adb

				
					adb shell am start -n pinlock.ctf.pinlock.com.pinstore/.SecretDisplay

It’s look like a database…
Then, we can check that is a database inside of the app if we inspect the log with logcat when we try insert a incorrect pin.

				
					adb logcat -c && adb logcat

--------- beginning of main
E/AudioTrack(  660): did not receive expected priority boost on time
W/SQLiteConnectionPool( 2114): A SQLiteConnection object for database '/data/data/pinlock.ctf.pinlock.com.pinstore/databases/pinlock.db' was leaked!  Please fix your application to end transactions in progress properly and to close the database when it is no longer needed.

So, going inside of our emulator file system. And it’s correct, there are a database.
We can download to our host machine with adb

				
					adb pull /data/data/pinlock.ctf.pinlock.com.pinstore/databases/pinlock.db

Then, with sqlite we can see the content of the database

				
					sqlite3 pinlock.db

SQLite version 3.46.1 2024-08-13 09:16:08
Enter ".help" for usage hints.
sqlite> .tables
android_metadata  pinDB             secretsDBv1       secretsDBv2
sqlite> select * from pinDB;
1|d8531a519b3d4dfebece0259f90b466a23efc57b
sqlite> select * from secretsDBv1;
1|hcsvUnln5jMdw3GeI4o/txB5vaEf1PFAnKQ3kPsRW2o5rR0a1JE54d0BLkzXPtqB
sqlite> select * from secretsDBv2;
1|Bi528nDlNBcX9BcCC+ZqGQo1Oz01+GOWSmvxRj7jg1g=
sqlite>

We will use just the first hash
d8531a519b3d4dfebece0259f90b466a23efc57b
Let’s crack it with hashcat

				
					hashcat -m 100 hash.txt /usr/share/seclists/rockyou.txt

And we got the pin

				
					d8531a519b3d4dfebece0259f90b466a23efc57b:7498

When the SecretActivity is started, we can see the logs

				
					--------- beginning of main
D/Version ( 2114): v1
D/secret  ( 2114): hcsvUnln5jMdw3GeI4o/txB5vaEf1PFAnKQ3kPsRW2o5rR0a1JE54d0BLkzXPtqB
D/Status  ( 2114): [B@128b6e8b

Looking in the folder that apktool drop, in the assets folder we have an README

				
					v1.0:
- Pin database with hashed pins

v1.1:
- Added AES support for secret

v1.2:
- Derive key from pin
[To-do: switch to the new database]

Now is time to read the source code of SecretActivity and CryptoUtilies
After read, we have the string t0ps3kr3tk3y and this is using an algorithm to decrypt it.

We have two secrets
hcsvUnln5jMdw3GeI4o/txB5vaEf1PFAnKQ3kPsRW2o5rR0a1JE54d0BLkzXPtqB
And
Bi528nDlNBcX9BcCC+ZqGQo1Oz01+GOWSmvxRj7jg1g=
We need modify the smali file for switch to the second one.

Because we have in the DatabaseUtilities class

				
					public String fetchSecret() throws IOException {  
        openDB();  
        Cursor cursor = this.db.rawQuery("SELECT entry FROM secretsDBv1", null);  
        String secret = "";  
        if (cursor.moveToFirst()) {  
            secret = cursor.getString(0);  
        }  
        Log.d("secret", secret);  
        cursor.close();  
        return secret;  
    }

That the rawQuery is using secretsDBv1 and we just change the 1 by 2
And in the try if the SecretDisplay class, we have the v1 string. So we need switch to v2

				
					try {  
            DatabaseUtilities dbUtils = new DatabaseUtilities(getApplicationContext());  
            CryptoUtilities cryptoUtils = new CryptoUtilities("v1", pin);  
            tv.setText(cryptoUtils.decrypt(dbUtils.fetchSecret()));  
        }

Let’s find the smali code corresponding to this two classes.

				
					cat DatabaseUtilities.smali | grep secretsDBv1 -n

315:    const-string v1, "SELECT entry FROM secretsDBv1"

In the 315 line of the code, just change secretsDBv1 to secretsDBv2.
Then, save the file.

And

				
					cat SecretDisplay.smali | grep v1 -n

74:    const-string v7, "v1"

In the 74 line, we have the last change that we must do. v1 to v2
Save the file

And now, we just need rebuild the app with apktool

				
					apktool b pinstore

Then, generate a key

				
					keytool -genkey -v -keystore name.keystore -keyalg RSA -keysize 2048 -validity 10000 -alias alias

Sign the apk

				
					jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 -keystore name.keystore pinstore/dist/pinstore.apk alias

Delete the original app installed and reinstall with adb

				
					adb install -r pinstore/dist/pinstore.apk

Insert the correct code that is 7498
And we got the flag

I hope you found it useful (:

BSides San Francisco CTF 2017 – pinlock

Leave a Reply Cancel reply