APKrypt

Platform: HackTheBox | Category: Mobile | Difficulty: N/A | Author: D3v0o0Nu11 | Date: 2026-02-10

Description

Can you get the ticket without the VIP code?

Solution Approach

Core idea: Identify the weakness from source review or fingerprinting first. Iterate with incremental payloads instead of guessing.

Steps

1. As usual, the problem setter recommend us to use the API >= 29 to install the apk.
2. Because we need to do zipalign and assign our keystore if we want to install it in API 33.
3. Since i only have the API 33, let us do zipalign and sign the key to our new apk.

NOTES:

To see the command used for zipalign - make our own keystore - sign the key to apk, open this writeup --> ../../Mobile/APKey/README.md

1. Great let us install the apk using adb and open it on our emu.

It asks us to input a VIP code and it seems we need to find the correct code.

1. Let us decompile the apk with jadx-gui.

INTEREST POINT (Main Activity).

1. Already tried to crack the hardcoded md5 with crackstation (online tools) but it didn't works, hence it seems we need to tamper the if-statement.
2. Let us decode the apk with apktool.

COMMAND:

apktool d patched.apk

JUMP TO THE VSCODE AND OPEN THE SMALI CODE.

What we want to patch (green box) - change it to nez.

SAVE then, run this command to build the apk again.

apktool b -o patchedv1.2.apk patched

Zipalign the apk again then sign it with apksigner.

zipalign -p 4 patchedv1.2.apk deploy_patched.apk

apksigner sign --ks a.keystore deploy_patched.apk

Install the apk again, the input random strings. It will decrypt the flag, because our input's hash will not equal to the hardcoded hash.

1. Got the flag!

Flag

REDACTED

Lessons Learned

1. Identify the weakness from source review or fingerprinting first.
2. Iterate with incremental payloads instead of guessing.
3. Reuse the same pattern in future engagements.