## Walkthrough

In this challenge we're given an APK file and a little description about what it's function is. Lets use Android Studio and ADB to emulate this program so we can get a sense of what we're working with.

*Note: Follow the instructions [here](https://developer.android.com/studio/install) to install Android Studio*

### Running The App
Open Android Studio, create a device and start it. Make sure it uses a recentish version of Android. Once open, drag the APK onto the phone to install it then open it.


Here we can what the app does. We can try some common codes (1234, 4321, etc) to see if they work.


### Decompiling In JADX
After trying for a bit it became clear that we won't be able to guess the code, time to try something different, lets take a look at the internals of this app.
Lets use [Jadx](https://github.com/skylot/jadx), an amazing Dex to Java decompiler. Follow the instructions on the github page to install this decompiler then open `OPTVault.apk` using it.

The structure of APKs might be daunting at first but *generally* the important source code is located (in Jadx) in `Source Code\com`. Looking through here gives us the decompiled source code, **but** we can see an issue. This isn't all of the code. We can tell by searching for strings that exist in the GUI part of the app such as "Invalid OTP" and noticing we get zero results.


### Dumping Source With APKTool
This is interesting, I'm not actually sure of why this happens but I believe that either OTPVault is loading a library the JADX isn't decompiling or there is some obfuscation done to hide some source code from JADX. Anyways, let's try to use another tool named [Apktool](https://ibotpeaches.github.io/Apktool/) to dump all the source code. Place apktool.jar in the same directory as OPTVault.apk and run this command: `.\apktool_2.6.1.jar d .\OTPVault.apk`. The source code will be dumped inside `\OTPVault\`.

Opening `\OTPVault\` in VSCode and searching for `Invalid OTP` gives us 1 result in `index.android.bundle`.
### Interesting Code
When we open this file we can see that it's been minified, lets undo that using [unminify](https://unminify.com/). Searching for our earlier string leads us to this block of code:
```js
function O() {
var n;
(0, e.default)(this, O);
for (var o = arguments.length, u = new Array(o), l = 0; l < o; l++) u[l] = arguments[l];
return (
((n = b.call.apply(b, [this].concat(u))).state = { output: "Insert your OTP to unlock your vault", text: "" }),
(n.s = "JJ2XG5CIMFRWW2LOM4"),
(n.url = "http://congon4tor.com:7777"),
(n.token = "652W8NxdsHFTorqLXgo="),
(n.getFlag = function () {
var e, o;
return t.default.async(
function (u) {
for (;;)
switch ((u.prev = u.next)) {
case 0:
return (u.prev = 0), (e = { headers: { Authorization: "Bearer KMGQ0YTYgIMTk5Mjc2NzZY4OMjJlNzAC0WU2DgiYzE41ZDwN" } }), (u.next = 4), t.default.awrap(p.default.get(n.url + "/flag", e));
case 4:
(o = u.sent), n.setState({ output: o.data.flag }), (u.next = 12);
break;
case 8:
(u.prev = 8), (u.t0 = u.catch(0)), console.log(u.t0), n.setState({ output: "An error occurred getting the flag" });
case 12:
case "end":
return u.stop();
}
},
null,
null,
[[0, 8]],
Promise
);
}),
(n.onChangeText = function (t) {
n.setState({ text: t });
}),
(n.onPress = function () {
var t = (0, s.default)(n.s);
console.log(t), t === n.state.text ? n.getFlag() : n.setState({ output: "Invalid OTP" });
}),
n
);
}
```

Looking at this code, we can see it makes a GET request to `http://congon4tor.com:7777/flag` using the Bearer token of `KMGQ0YTYgIMTk5Mjc2NzZY4OMjJlNzAC0WU2DgiYzE41ZDwN`.
*Note: I suspect n.s is the OTP, I'm not sure what n.token is as it's only used once*

Lets send a request to that URL using that token and see what happens
```bash
curl -X GET http://congon4tor.com:7777/flag -H "Authorization: Bearer KMGQ0YTYgIMTk5Mjc2NzZY4OMjJlNzAC0WU2DgiYzE41ZDwN"
```
### Flag

Success! Thanks again to congon4tor for creating this great challenge! If you have any feedback on my site don't hesitate to [contact me](/contact).

Thanks for reading!

Original writeup (https://nburns.tech/docs/CTFs/NahamCon_2022/Mobile/OTP_Vault).