Withered Flower 1 (Q1)

Platform: caplag | Category: Forensics | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-02-22 | Status: Solved Techniques: android_device_profiling, build_fingerprint_parsing, zip_password_guessing

Summary

Withered Flower 1 (Q1) — caplag

Description

В ходе контрразведывательных мероприятий вскрыта деятельность иностранной агентурной сети "Project Flower". Группировка, предположительно курируемая спецслужбами США, использовала кастомное программное обеспечение для скрытой координации полевых агентов, модераторов и внештатных информаторов. Объект был задержан при попытке сброса данных. При нем обнаружено устройство связи Samsung Galaxy, подготовленное для экстренного уничтожения. Нашим специалистам удалось снять полный логический образ и перехватить системную телеметрию до того, как устройство было дистанционно заблокировано.

Q1: Профилирование оборудования для внесения в базу улик необходимо идентифицировать изъятое спецсредство. Укажите производителя, модель и ID сборки прошивки.

Формат флага: caplag{BRAND/MODEL/BUILD_ID} (ALL UPPER CASE) ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Analysis

The task is classic Android device profiling from a logical image. We are given an encrypted ZIP archive with ADB report logs and dumpsys dumps. We need to extract three parameters: manufacturer (brand), model, and firmware Build ID.

Key information sources in Android forensics:

• device_info.txt — contains system properties (ro.product.*), including manufacturer and model
• dumpsys reports (package.txt, dropbox.txt) — contain build fingerprint, from which Build ID is extracted
• backup.ab — Android backup, useful for subsequent questions in the series ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Solution

Step 1: Download and extract the archive

 bash read-only • copy allowed Copy
# evidence.zip is encrypted with ZipCrypto
# Password is the CTF event name: caplag
7z x evidence.zip -pcaplag

Contents:

evidence/
├── backup.ab                    # Android backup (105MB)
└── Logs/
    ├── ADBReport/
    │   ├── device_info.txt      # ← Main device information
    │   ├── device_state.txt
    │   ├── contacts.txt
    │   ├── logcat_snapshot.txt
    │   ├── packages_all.txt
    │   └── ...
    └── DumpSysReport/
        ├── package.txt          # ← Build fingerprint
        ├── dropbox.txt          # ← Build fingerprint confirmation
        ├── wifi.txt
        ├── batterystats.txt
        └── ...

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Step 2: Extract manufacturer and model from device_info.txt

 bash read-only • copy allowed Copy
grep -E 'ro\.(product\.(manufacturer|model)|serialno|build)' Logs/ADBReport/device_info.txt

Result:

[ro.build.version.release]: [16]
[ro.product.manufacturer]: [samsung]
[ro.product.model]: [SM-A346E]
[ro.serialno]: [RFCW50CT7YD]

• Manufacturer: samsung → SAMSUNG
• Model: SM-A346E (Samsung Galaxy A34 5G)
• Android version: 16

Step 3: Find Build ID in build fingerprint

Build ID is not always explicitly listed in device_info.txt. It can be extracted from the Android build fingerprint found in dumpsys logs. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

 bash read-only • copy allowed Copy
rg -i "build.info|build.fingerprint|Build:" Logs/DumpSysReport/

In Logs/DumpSysReport/package.txt (line ~98800):

Build Info: 101458237-samsung/a34xdxx/a34x:16REDACTED/A346EXXUAEYI7:user/release-keys

Confirmation in Logs/DumpSysReport/dropbox.txt:

Build: samsung/a34xdxx/a34x:16REDACTED/A34...

Step 4: Parse the build fingerprint format

Android build fingerprint format:

brand/product/device:version/BUILD_ID/incremental:type/tags

Breakdown:

samsung / a34xdxx / a34x : 16 / REDACTED / A346EXXUAEYI7 : user / release-keys
  │         │        │     │          │                      │            │        │
brand    product   device  ver     BUILD_ID            incremental     type     tags

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Build ID = REDACTED

Step 5: Assemble the flag

All components in UPPER CASE:

• Brand: SAMSUNG
• Model: SM-A346E
• Build ID: REDACTED

Reference: Android Build Fingerprint

brand/product/device:version/BUILD_ID/incremental:type/tags

Additional Findings

• Application com.projectflower.agency was found in crash logs in dropbox.txt — this is the custom software of the "Project Flower" agent network mentioned in the task description
• File backup.ab (Android backup, 105MB) contains application data and is likely used in subsequent questions in the series (Q2, Q3, ...)
• Device serial number: RFCW50CT7YD ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍