Solving Treasure Hunt from Iron CTF

In Iron CTF’s Treasure Hunt, you’ll need to find a hidden flag inside an Android app. The goal is to explore the app’s files, solve puzzles, and piece together clues to uncover the flag. Ready to go hunting for the flag? Let’s get started!

In this blog, I’ll walk you through the step-by-step procedure of how to solve this challenge and find the flag hidden deep inside the app’s activities. Whether you’re new to reverse engineering or a seasoned player, this blog aims to make the steps simple and approachable.

Pre-requisites

Before diving into the challenge, let’s make sure you have the required tools and a basic understanding:

Tools:

1. Jadx: A Java decompiler to inspect APK internals and source code.
2. Genymotion: To run the app in a phone like emulator

Understanding:

• Basic familiarity with Android app components like Activities and XML layouts.
• A fundamental understanding of reverse engineering APKs.

Step-by-Step Guide:

Now, let’s dive into the challenge.

Step 1: Get the APK and Setup Environment

Start by downloading the APK provided in the Iron CTF for the Treasure Hunt challenge. Once you have the APK, your first step should be to inspect the internals of the APK.

• Use JADX to open and decompile the APK file. This gives us access to the app’s Java code and XML layouts.

jadx-gui TreasureHunt.apk

Open the AndroidManifest.xml to look into the different app components that are there in the app.

We can notice 4 activities in total, The MainActivity, the FirstActivity, the Second Activity and the Third Activity.

The lauching acitivty is the First Activity, let’s open it to see what is inside it.

Step 3: Exploring the First Activity

The activity does not contain anything. Let’s confirm it by opening the app using genymotion.

There is nothing in the app as well, and the other app components are set to exported = “false”, which means that you cannot open those activities externally. Hence I came to a conclusion that the flag is stored in the app code itself.

Step 3: Explore the APK’s Layouts

In most CTF challenges involving Android apps, the flag is usually hidden within the app’s activities or layouts.

By exploring the res/layout directory, we found the XML files of the 4 activities above mentioned, which include some interesting hints:

First Activity XML

android:text="Is this the right place?\10 I think so. Do you?"

This text, displayed in one of the initial activities, teases us, pushing us to search further.

Second Activity XML

android:text="Welcome to the Maze.\10Here's a part of the flag:"

I found a “strings” stored text in this XML file, on inspecting it in res/layout/strings.xml, i found the string 0f_4ndro1d_r3vThe next step is to locate the rest of the flag.

Third Activity XML

android:text="The flag is right in front of your eyes..."

Main Activity XML

We find the text, **3ver_h3ard_**

Now, combining this with the earlier part we found, we get:

3ver_h3ard_ + 0f_4ndro1d_r3v

The full flag is:

**ironCTF{3ver_h3ard_0f_4ndro1d_r3v}**

And there you have it! The flag is hidden across the app’s activities, and by combining the text strings, we successfully complete the Treasure Hunt challenge.

Closing Thoughts:

CTF challenges like Treasure Hunt in Iron CTF are not only a test of your technical skills but also your patience and detective-like instincts. Each activity provided a small clue, and by piecing them together, we were able to uncover the flag.

These challenges can often feel like a maze, but with the right tools, techniques, and mindset, you’ll find your way through. Happy hunting!

If you’re just starting out with reverse engineering, Android APKs are a great way to build your skills, and each challenge brings something new to the table. Keep practicing, stay curious, and you’ll keep finding those hidden treasures.