mobilemedium

Protected

hackthebox

Task: recover a hidden flag.png from a ZipCrypto-encrypted Android /data partition dump containing Gallery Vault app artifacts. Solution: crack ZipCrypto via known-plaintext attack (bkcrack) using predictable shared_prefs XML, then reverse Gallery Vault encryption (DES key chain + XOR stream cipher with >>tyfs>> markers) to decrypt the hidden image.

$ ls tags/ techniques/

sqlite des xor known_plaintext_attack android bkcrack zipcrypto mobile_forensics gallery_vault data_partition file_hiding

zipcrypto_known_plaintext_attackgallery_vault_decryptiondes_key_derivation_chainxor_stream_cipherandroid_data_partition_analysishidden_app_artifact_recovery

Analysis

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat.

$ python3 exploit.py --target 192.168.1.1 --port 8080
[*] Connecting to target...
[+] Shell obtained!

Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.

🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Create a free account with GitHub, then upgrade to Pro.

$ssh [email protected]