HACK'OSINT 2025 Write-up (Le cote obscur / Communication)

This is a write-up for HACK'OSINT 2025, which was held from May 23 to 25, 2025.

(English version: https://github.com/kn1cht/kn1cht-zenn-contents/blob/main/articles/en/hack-osint-2025-android-en.md)

In this CTF, players investigate members of a fictional cybercriminal group called APT-509. During the investigation, it is revealed that a fishing smartphone app created by an individual named Mike is their hidden means of communication, and two tasks were given to investigate the app.

According to the official write-up, the intended solution was to actually run the app.

However, I was hesitant to immediately install an app created by a cybercriminal organization (which, of course, is a fictional organization for the CTF), and I didn't have an Android device suitable for testing on hand. Therefore, in this write-up, I will attempt to solve these two problems using static analysis methods without executing the app.

Le cote obscur (50 points / 36 solves)

🇫🇷 – Quelle drôle d'application ! Une fois lancée, celle-ci semble être une façade dissimulant les activités cybercriminelles du groupe APT-509. L’un de nos experts a analysé l'application et a constaté, en examinant son code source, qu'une adresse e-mail y était potentiellement dissimulée. Malheureusement, il n'a pas réussi à la localiser.

En naviguant sur l'application, pouvez-vous aider notre expert à retrouver cette adresse ?

🇬🇧 – What a strange application! Once launched, it appears to be a front hiding the cybercriminal activities of the APT-509 group. One of our experts analyzed the app and discovered, while inspecting its source code, that an email address might be hidden within it. Unfortunately, he was unable to locate it.

While navigating through the application, could you help our expert find this address ?

Flag format : [e-mail]

This task involves searching for an email address hidden within the application.

The XAPK file for the app can be downloaded from an APK distribution site.

https://apkpure.net/fishingapp/com.hackosint.myapplication

Since XAPK and APK files are essentially ZIP archives, they can be easily extracted by changing the extension to .zip.

Five APK files are included, but com.hackosint.myapplication.apk appears to be the main one. I could unzip this further, but it's easier to decompile it at the same time, so I'll use apktool.

https://github.com/iBotPeaches/Apktool

$ apktool d com.hackosint.myapplication.apk
$ ls com.hackosint.myapplication
AndroidManifest.xml  apktool.yml  assets  original  res  smali
  smali_classes2  unknown

There are 25,696 extracted files, so searching manually seems difficult. Since I'm looking for an email address, I'll use grep to search for patterns like ***@***.***.
(I asked an LLM for a regular expression that matches common email address formats.)

$ grep -rE '[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}' com.hackosint.myapplication
com.hackosint.myapplication/smali_classes2/com/hackosint/myapplication/
MainActivityKt$CreditsScreen$1.smali:    const-string v0, "[e-mail]"
com.hackosint.myapplication/smali_classes2/com/hackosint/myapplication/
MainActivityKt$CreditsScreen$1.smali:    const-string v0, "[e-mail]"

This seems to be the only email address contained in the application.

flag: [e-mail]

Communication (50 points / 37 solves)

🇫🇷 – Il semble également qu'APT-509 utilise un autre canal de communication, en plus de cette application, pour échanger entre ses membres. Pourriez-vous nous préciser la date de création de cet autre canal ?

🇬🇧 – It also appears that APT-509 is using another communication channel, in addition to this application, to exchange information among its members. Could you please provide us with the creation date of this other channel?

Flag format : JJ/MM/AAAA

This task involves identifying the communication method APT-509 is using besides FishingApp and providing its creation date. From previous investigations, we know that the codename of the FishingApp author is Mike.

$ grep -r 'Mike' com.hackosint.myapplication
com.hackosint.myapplication/smali_classes2/com/hackosint/myapplication/
MainActivityKt.smali:    const-string v10, "Mikee"

A promising smali file was found. Smali files are human-readable representations of the bytecode used in Android applications. Looking at the area around the hit, it appears that chat logs are written as they are.

MainActivityKt.smali

    .line 848
    new-instance v4, Lcom/hackosint/myapplication/ChatMessage;

    const-string v8, "2"

    const-string v9, "user3"

    const-string v10, "Mikee"

    const-string v11, "Merci de l\'information!"

    const-string v12, "10:34"

    move-object v7, v4

    invoke-direct/range {v7 .. v19}, Lcom/hackosint/myapplication/ChatMessage;-><init>(Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;ZZLjava/lang/String;Ljava/lang/String;Ljava/lang/String;ILkotlin/jvm/internal/DefaultConstructorMarker;)V

    aput-object v4, v3, v6

The chat is not very long, so you can read it as is, or you can give it to ChatGPT to convert it into a more readable format.

ID	user	nickname	message	time
1	user1	G0lf-GTI	Salut tout le monde, #A nous a fourni un nouveau moyen de communication temporaire : APT509TMP	10:30
2	user3	Mikee	Merci de l'information!	10:34
3	user1	Br4v0	je venais à peine de trouver comment arriver ici et je dois déjà changer..	10:35
4	user3	n0vember	J'essaye de rejoindre au plus vite merci!	10:37
5	user3	n0vember	T'as pu rejoindre grâce à une super guide :)	10:42

The communication channel seems to be named APT-509TMP. I imagined this might be a Telegram group name, and indeed I was able to access t.me/APT509TMP.

The first message on Telegram was posted on April 26th at 2:51.

However, while our team was in Japan (UTC+9), since this is a French CTF, it is more appropriate to consider the local time as April 25th.

flag: 25/04/2025