E-mail

Platform: spbctf | Category: Mobile | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-07-05 | Status: Solved Techniques: base64_decode, mobileprovision_extraction, x509_subject_cn_inspection

Summary

Task: iOS .ipa app, find the developer's email. Solution: unzip the ipa, extract embedded.mobileprovision, base64-decode the DeveloperCertificates X.509 cert, and read the Apple ID email from the Apple Development signing certificate Subject CN.

E-mail — spbctf

Description

What is the developer's email?

An iOS application is provided as GimmeFlag.ipa (plus a .zip mirror, a classdump.txt, and a preview PNG). The goal is to recover the email address of the developer who built and signed the app.

Analysis

An iOS .ipa is just a ZIP archive. Every ad-hoc/development-signed app bundle ships an embedded.mobileprovision file inside Payload/<App>.app/. This file is a CMS/PKCS#7-wrapped plist provisioning profile. Its DeveloperCertificates key holds the DER-encoded X.509 code-signing certificate. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

For an Apple Development certificate the Subject Common Name (CN) has the form Apple Development: <apple-id-email> (<TeamID>), so the developer's email is literally embedded in the signing certificate.

Key artifacts observed:

• Provisioning profile name: iOS Team Provisioning Profile: xyz.jayfromfuture.GimmeFlag
• Class dump shows Swift view controllers (FirstFlagViewController, SecondFlagViewController, ThirdFlagViewController) — not needed for this sub-task.
• classdump.txt header leaks a MobSF build path /Users/grigory.liullin/GitHub/Mobile-Security-Framework-MobSF/... — an interesting artifact but a decoy; the intended answer is the signing cert email. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

 bash read-only • copy allowed Copy
# 1. Confirm the ipa is a ZIP archive
file GimmeFlag.ipa                     # -> Zip archive data

# 2. List the bundle contents; note the provisioning profile
unzip -l GimmeFlag.ipa | grep -i mobileprovision
#   Payload/GimmeFlag.app/embedded.mobileprovision

# 3. Extract it
unzip -o GimmeFlag.ipa 'Payload/GimmeFlag.app/embedded.mobileprovision'
cd Payload/GimmeFlag.app

# 4. Quick look for an email directly in the profile
strings embedded.mobileprovision | grep -iE '@|mail'

The profile is a CMS blob, so the raw certificate email is easier to read after pulling the DeveloperCertificates base64 <data> block out of the plist and decoding it: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 python read-only • copy allowed Copy
#!/usr/bin/env python3
import re, base64, subprocess

data = open("embedded.mobileprovision", "rb").read()
# The plist is wrapped in PKCS#7; slice out the XML plist portion
start = data.find(b"<?xml")
end   = data.find(b"</plist>") + len(b"</plist>")
plist = data[start:end].decode("latin-1")

# Grab the first DeveloperCertificates <data> block (base64 DER cert)
m = re.search(r"<key>DeveloperCertificates</key>\s*<array>\s*<data>(.*?)</data>",
              plist, re.S)
der = base64.b64decode(re.sub(r"\s+", "", m.group(1)))
open("cert.der", "wb").write(der)
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Read the Subject CN
print(subprocess.run(
    ["openssl", "x509", "-inform", "DER", "-in", "cert.der",
     "-noout", "-subject"],
    capture_output=True, text=True).stdout)

Alternatively, without parsing the plist at all:

 bash read-only • copy allowed Copy
# strings across the whole profile surfaces the cert Subject CN too
strings cert.der | grep -iE 'icloud|@|Anderson'

Output (Subject line of the signing certificate):

subject= .../CN=Apple Development: REDACTED (V4L3SK7MG5)/O=Thomas Anderson/...

The Apple ID email in the Apple Development CN is the answer. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍