Cryptohorrific -- HackTheBox

Description

"Secure coding is the keystone of the application security!"

The challenge provides a zip file (password: hackthebox) containing an iOS .app bundle. The goal is to reverse-engineer the app to find and decrypt a hidden flag.

Analysis

Reconnaissance

After unzipping the archive, we find an iOS app bundle hackthebox.app/ with key files:

File	Description
hackthebox	Mach-O 64-bit executable x86_64 (iPhone Simulator build)
challenge.plist	Binary plist containing encrypted data
Info.plist	App metadata (bundle ID: ben.hackthebox)
htb-company.png	Company logo image

Encrypted Data in challenge.plist

Parsing the binary plist reveals:

{
    "flag": "Tq+CWzQS0wYzs2rJ+GNrPLP6qekDbwze6fIeRRwBK2WXHOhba7WR2OGNUFKoAvyW7njTCMlQzlwIRdJvaP2iYQ==",
    "id": "123",
    "title": "HackTheBoxIsCool"
}

The flag field is a base64-encoded AES ciphertext.

String Analysis of the Binary

Running strings on the Mach-O binary reveals critical information:

• Method signature: SecretManager:key:iv:data: -- indicates AES encryption with key and IV
• Two hardcoded 16-byte strings:
  • !A%D*G-KaPdSgVkY (the AES key)
  • QfTjWnZq4t7w!z%C (the IV -- but ultimately ignored)
• References to initWithBase64EncodedString:options: confirming base64 decoding of the flag
• References to pathForResource:ofType: with strings challenge and plist confirming it reads challenge.plist

Disassembly: CCCrypt Parameters

Disassembling the SecretManager method and viewDidLoad reveals the CCCrypt call:

CCCrypt(
    op       = 1,    // kCCDecrypt
    alg      = 0,    // kCCAlgorithmAES128
    options  = 3,    // kCCOptionPKCS7Padding (1) | kCCOptionECBMode (2)
    key      = "!A%D*G-KaPdSgVkY",
    keyLen   = 16,   // AES-128
    iv       = "QfTjWnZq4t7w!z%C",  // IGNORED in ECB mode
    ...
)

Critical insight: The options field is 0x3 = kCCOptionPKCS7Padding | kCCOptionECBMode. Despite the method accepting an IV parameter, ECB mode does not use an IV -- it is completely ignored. This is one of the "horrific" crypto practices the challenge highlights.

Solution

...