Don't Overreact

2 minutes to read

We are given an APK file (app-release.apk).

APK extraction

From the name of the challenge, we might think of React Native for mobile development. For the moment, let’s extract the APK file contents with apktool:

$ apktool d app-release.apk
I: Using Apktool 2.6.1 on app-release.apk
I: Loading resource table...
I: Decoding AndroidManifest.xml with resources...
I: Loading resource table from file: ~/.local/share/apktool/framework/1.apk
I: Regular manifest package...
I: Decoding file-resources...
I: Decoding values */* XMLs...
I: Baksmaling classes.dex...
I: Copying assets and libs...
I: Copying unknown files...
I: Copying original files...

$ cd app-release

$ ls
AndroidManifest.xml  apktool.yml  assets  lib  original  res  smali  unknown

As expected, inside assets we find a file called index.android.bundle, which is minified JavaScript code for the app:

$ ls assets
index.android.bundle

JavaScript analysis

Unfortunately, there is no sourceMap file (index.android.bundle.map), so we need to analyze the minified JavaScript code…

After skimming through the code in the browser (this is useful because we can format the code and read it in a better way), we see some strings at the end that contain hackthebox:

$ tail assets/index.android.bundle
__d(function(g,r,i,a,m,e,d){'use strict';m.exports=function(t){fetch(r(d[0])().url+'open-url',{method:'POST',body:JSON.stringify({url:t})})}},395,[396]);
__d(function(g,r,i,a,m,e,d){'use strict';var l,t,n=r(d[0])(r(d[1])),u='http://localhost:8081/';m.exports=function(){var o;if(void 0===l){var s=n.default.getConstants().scriptURL,c=s.match(/^https?:\/\/.*?\//);l=c?c[0]:null,t=c?s:null}return{url:null!=(o=l)?o:u,fullBundleUrl:t,bundleLoadedFromServer:null!==l}}},396,[3,171]);
__d(function(g,r,i,a,m,e,d){Object.defineProperty(e,"__esModule",{value:!0}),e.default=void 0;var t=r(d[0]),l=r(d[1])(r(d[2])),u=t.StyleSheet.create({highlight:{fontWeight:'700'}}),n=t.Platform.select({ios:function(){return l.default.createElement(t.Text,null,"Press ",l.default.createElement(t.Text,{style:u.highlight},"Cmd + D")," in the simulator or",' ',l.default.createElement(t.Text,{style:u.highlight},"Shake")," your device to open the React Native debug menu.")},default:function(){return l.default.createElement(t.Text,null,"Press ",l.default.createElement(t.Text,{style:u.highlight},"Cmd or Ctrl + M")," or",' ',l.default.createElement(t.Text,{style:u.highlight},"Shake")," your device to open the React Native debug menu.")}});e.default=n},397,[1,3,47]);  
__d(function(g,r,i,a,m,e,d){Object.defineProperty(e,"__esModule",{value:!0}),e.default=void 0;var t=r(d[0]),l=r(d[1])(r(d[2])),o=t.StyleSheet.create({highlight:{fontWeight:'700'}}),u=t.Platform.select({ios:function(){return l.default.createElement(t.Text,null,"Press ",l.default.createElement(t.Text,{style:o.highlight},"Cmd + R")," in the simulator to reload your app's code.")},default:function(){return l.default.createElement(t.Text,null,"Double tap ",l.default.createElement(t.Text,{style:o.highlight},"R")," on your keyboard to reload your app's code.")}});e.default=u},398,[1,3,47]);
__d(function(g,r,i,a,m,e,d){m.exports=r(d[0]).registerAsset({__packager_asset:!0,httpServerLocation:"/assets",width:177,height:33,scales:[1],hash:"364ec975243cfa24b8c9b8cc5247747c",name:"logo-htb",type:"png"})},399,[393]);
__d(function(g,r,i,a,m,e,d){Object.defineProperty(e,"__esModule",{value:!0}),e.myConfig=void 0;var t={importantData:"baNaNa".toLowerCase(),apiUrl:'https://www.hackthebox.eu/',debug:'SFRCezIzbTQxbl9jNDFtXzRuZF9kMG43XzB2MzIyMzRjN30='};e.myConfig=t},400,[]);
__d(function(e,o,m,s,t,a,c){t.exports={name:"AwesomeProject",displayName:"AwesomeProject"}},401,[]);
__r(73);
__r(0);
//# sourceMappingURL=index.android.bundle.map

We can take a closer look:

$ tail assets/index.android.bundle | grep hackthebox
__d(function(g,r,i,a,m,e,d){Object.defineProperty(e,"__esModule",{value:!0}),e.myConfig=void 0;var t={importantData:"baNaNa".toLowerCase(),apiUrl:'https://www.hackthebox.eu/',debug:'SFRCezIzbTQxbl9jNDFtXzRuZF9kMG43XzB2MzIyMzRjN30='};e.myConfig=t},400,[]);  

$ tail assets/index.android.bundle | grep -o 'hackthebox.*$'
hackthebox.eu/',debug:'SFRCezIzbTQxbl9jNDFtXzRuZF9kMG43XzB2MzIyMzRjN30='};e.myConfig=t},400,[]);

There is a strange string there. It seems to be encoded in Base64.

Flag

Indeed, it is the flag:

$ echo SFRCezIzbTQxbl9jNDFtXzRuZF9kMG43XzB2MzIyMzRjN30= | base64 -d  
HTB{23m41n_c41m_4nd_d0n7_0v32234c7}