Secure Encryption Solution

Solution

1. Follow the challenge set up guide.
2. Decode the apk withjava -jar apktool d <apk> and/or JD-GUI.
3. Browse to decompiled code and open .smali file. This can be done with your favorite editor.
4. Open /base/smali/ruhrpott/owasp/com/vuln_app_1/Emcryption.smali and add the log function:

[...]
.method private secureEncrypt(Ljava/lang/String;Landroid/content/Context;)Ljava/lang/String;
    .locals 5
    .param p1, "text"    # Ljava/lang/String;
    .param p2, "context"    # Landroid/content/Context;

    .prologue
    .line 72
    sget-object v2, Landroid/os/Build;->ID:Ljava/lang/String;
    const-string v0, "Build.ID"
    invoke-static {v0, v2}, Landroid/util/Log;->e(Ljava/lang/String;Ljava/lang/String;)I
[...]

The logging will display the key for the encryption:

07-18 10:35:28.425 25861-25861/ruhrpott.owasp.com.vuln_app_1 1 E/Build.ID> LMY48W

5. A closer examination of the encryption shows that the algorithm takes the plaintext and returns AxoYZ2hsHi1VVSE5MEdbJG0LQVA+PTZATGw/NldTPw (Base64 encoded ciphertext). The function will XOR the plaintext with the Build-ID (here LMY48W).
6. To decrypt the given cipher text we have to XOR the BUILD-ID with the Base64 decoded ciphertext.

Hint:

• The Build-ID can be found in the Android Settings as well:
  Settings -> About tablet -> Build number