atdt on Israeli Mossad launches cyber challenge

Comment on Israeli Mossad launches cyber challenge

Decompile the apk, and run 'strings' on assets/flutter_assets/kernel_blob.bin.

Poke around and you'll find code for POSTing JSON-encoded credentials to http://35.246.158.51:8070/auth/getUrl. (Grep for the IP to find it.)

So, using the web site name as the seed and the 'client id' as the password, we get:

$ curl -X POST -H "Content-Type: application/json" -d '{"Seed": "3d375032374147a7865753e4bbc92682", "Password": "d7c6bdcfcb184bf587ceee7c7c28e72e"}' http://35.246.158.51:8070/auth/getUrl

The response is an HTTP 200 and: {"AuthURL":"/auth/v2"}

http://35.246.158.51:8070/auth/v2 is I guess the next step.

edit: The /auth/getUrl endpoint responds to any request with the same response, so that may not be the right Seed/Password combination.

arboroia 7y

You're close, but that first endpoint is just to retrieve the auth URL, no need to post anything to it. It then passes the seed and password to the returned URL, so: "http://35.246.158.51:8070/auth/v2" gets '{"Seed": "xxx", "Password": "xxx"}' of some kind

I haven't yet figured out what those are though...

See:

  Future<Token> login(String seed, String password) {
    var headers = new Map<String,String>();
      return _netUtil.get(LOGIN_URL, headers:headers).then((dynamic authUrl) {
      try {
        if (authUrl == null) {
          return Future<Token>.sync(() => new Token("", false, 0));
        }
        var loginUrl = BASE_URL + AuthURL.map(json.decode(authUrl.body)).url;

arboroia 7y

So reading about flutter, there's quick reload information in debug mode[0]

This leads me to believe that the seed and password entered in development / in the cookie jar from a previous attempt are somewhere in the `isolate_snapshot_data` file

[0] https://github.com/flutter/flutter/wiki/Flutter-engine-opera...

stdcall83OP7y

Got to this point by running the APK in sandbox and tracking the TCP packets...

revocheese 7y

following your steps at getting the strings, which in turn helped me get the code of the whole application

first of all, as per the code, the User-Agent must be setup to "iWalk-v2"

then doing a simple get request to http://35.246.158.51:8070 will return {"AuthURL":"/auth/v2"}

replacing the original url with http://35.246.158.51:8070/auth/v2 and then sending a json like '{"Seed": "3d375032374147a7865753e4bbc92682", "Password": "d7c6bdcfcb184bf587ceee7c7c28e72e"}' with "Content-Type: application/json" returns {"IsValid":false,"LockURL":"","Time":136764}

the Time here (as per my understanding in the code) is the request duration, which somehow contradicts postman's request duration field

now one weird thing I've noticed about this app is this, if i install it on a regular device, and connect that to a proxy, then type gibberish into the fields then click Login, the following code gets invoked

  void _submit() async {
    final form = formKey.currentState;
    if (form.validate()) {
      setState(() => _isLoading = true);
      form.save();
      _networkActions.login(_seed, _password)
                      .then((result) => _loginCompleted(result))
                      .catchError((e) { 
                        _loginCompleted(new Token("", false, 0));
                      });
    }

if a loading icon appears then I assume that the code passed the condition and passed this line of code "setState(() => _isLoading = true);" now the weird part is that, I don't see any outgoing connections from the app... (I use charles to capture requests)

andr0id 7y

It's normal that you don't see any traffic using Charles, since Charles can only intercept traffic made by HttpUrlConnection or OkHttp, since flutter is not using any of those two..you can't see anything in Charles.

stdcall83OP7y

You're missing a big hint. Go back to the apk and grep for github

mescal 7y

I think you must also fake the user agent as "iWalk-v2"

Comments