Зелёный робот (Green Robot)

Platform: hackerlab | Category: Reversing | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2025-12-25 | Status: Solved Techniques: AES-256-CBC decryption, APK decompilation with jadx, Hardcoded key/IV extraction, Java source code analysis

Summary

Task: Android APK with flag verification. Solution: Decompile with jadx, extract hardcoded AES key/IV, decrypt the stored ciphertext to get the flag.

Зелёный робот (Green Robot) — HackerLab

Description

Душа машины сильнее стали. Конкретно у этой где-то есть флаг...

Analysis

Step 1: Recognizing the Task Type

The name "Зелёный робот" (Green Robot) is a direct reference to Android, whose mascot is a green robot. The archive green_robot.zip contains super_task.apk — an Android application.

Step 2: APK Decompilation

Using jadx to decompile the APK into Java source code:

 bash read-only • copy allowed Copy
jadx -d output super_task.apk

Step 3: MainActivity Analysis

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

In the package com.hackerlab.super_task_android we find MainActivity.java with the flag verification logic:

 java read-only • copy allowed Copy
public class MainActivity extends AppCompatActivity {
    private static final String secretKey = "23ffabcde582ffacb49323fcbaddefac";
    private static final String iv = "89438fabcd849298";
    private static final String correctEncryptedString = "d5RIYRoC/3bQyfM8TSOlo463lgAMeSkAi/s8CEn1pMw=";
    
    // Encryption method
    private String encrypt(String input) {
        try {
            SecretKeySpec keySpec = new SecretKeySpec(secretKey.getBytes("UTF-8"), "AES");
            IvParameterSpec ivSpec = new IvParameterSpec(iv.getBytes("UTF-8"));
            Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
            cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec);
            byte[] encrypted = cipher.doFinal(input.getBytes("UTF-8"));
            return Base64.encodeToString(encrypted, Base64.DEFAULT);
        } catch (Exception e) {
            return null;
        }
    }
    
    // Flag verification
    private boolean checkFlag(String userInput) {
        String encryptedInput = encrypt(userInput);
        return correctEncryptedString.equals(encryptedInput.trim());
    }
}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 4: Extracting Cryptographic Parameters

From the source code we extract:

• Algorithm: AES/CBC/PKCS5Padding
• Key: 23ffabcde582ffacb49323fcbaddefac (32 characters = 256 bits)
• IV: 89438fabcd849298 (16 characters = 128 bits)
• Encrypted flag: d5RIYRoC/3bQyfM8TSOlo463lgAMeSkAi/s8CEn1pMw= (Base64)

Solution

Decrypting correctEncryptedString using the extracted key and IV:

 python read-only • copy allowed Copy
#!/usr/bin/env python3
from Crypto.Cipher import AES
import base64

# Extracted from MainActivity.java
correctEncryptedString = "d5RIYRoC/3bQyfM8TSOlo463lgAMeSkAi/s8CEn1pMw="
secretKey = "23ffabcde582ffacb49323fcbaddefac"
iv = "89438fabcd849298"
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Decode Base64
encrypted_bytes = base64.b64decode(correctEncryptedString)

# Create AES cipher in CBC mode
cipher = AES.new(secretKey.encode('utf-8'), AES.MODE_CBC, iv.encode('utf-8'))

# Decrypt
decrypted_bytes = cipher.decrypt(encrypted_bytes)

# Remove PKCS5/PKCS7 padding
padding_len = decrypted_bytes[-1]
decrypted_text = decrypted_bytes[:-padding_len].decode('utf-8')

print(f"Flag: {decrypted_text}")

Output:

Flag: CODEBY{REDACTED}

Alternative Approaches

1. Dynamic analysis: Run the APK in an emulator with a debugger and intercept the decrypted value
2. Frida hooking: Hook the encrypt() or checkFlag() call to extract the flag
3. smali modification: Modify the code to output the decrypted value ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Lessons

• Android applications are easily decompiled into readable Java code
• Never store secret keys in client-side code
• Comparing encrypted values does not protect against reverse engineering
• jadx is the primary tool for APK file analysis ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍