Machines infected lots of Android smartphones and try to collect information on human behaviour... Have a look to their application and try to steal information on them.
So we have an android application file. Let's decompile its code!
First, we need to translate Dalvik bytecode to equivalent Java bytecode. I used enjarify for this:
This is the Web2 problem
The challenge simply states "Find the key!" and it gives us the challenge URL.
The first thing I usually do with a web challenge is to run dirbuster, spider the target and check the it with Nmap.
Checking with Nmap didn't result in anything interesting. However dirbuster did. I found two interesting folders.
The first one is "SecretAdminPanel" and the second one was "logs"
I visited "SecretAdminPanel" and I saw this.
We have an ip address and a port. Connected using netcat we got V8 JavaScript shell. print(Object.keys(this)) gives us all global objects available: print, quit, checker, check.
The sense of this task is to login with user which idx=1. But we don't know, who has this idx
The algoritm for cookie is CRCR32 and this is strange. Because this hash purpose is not for crypto, it's for checksums. But for first try code of server look's good enough. REALY THANK TO ORGS, BECAUSE CODE IS GREAT AND SIMPLE, SO IT'S REALY EASY TO UNDERSTAND THE LOGIC OF SERVER
First we see the text on the page: "You must specify a nick". After quick look into source code of the page we understand that our URL must contain GET-parameter 'nick' with random value.
Then server sends us some leet-modified string like
51xty tw0 plu5 0n3
and expecting from us solution of this expression in the same format.
Experimentally found that there is only 4 leet-modified characters: '1' == 'i', '3' == 'e', '5' == 's', '0' == 'o'.
