Post

Cat

Posted Updated
By Muhammad Taha Khan
6 min read
Cat

Inspecting the .ab file

1
2
3
4
5
6
7
8
9
10

┌──(kali㉿vm-kali)-[~/htb/challenges/mobile/cat]
└─$ ls -la
total 4136
drwxrwxr-x 2 kali kali    4096 Jul 31 23:33 .
drwxrwxr-x 3 kali kali    4096 Jul 31 23:34 ..
-rwxrw-rw- 1 kali kali 4223058 Mar  6  2020 cat.ab
                                                                                                                                                                                                             
┌──(kali㉿vm-kali)-[~/htb/challenges/mobile/cat]
└─$ file cat.ab                                                                                                      
cat.ab: Android Backup, version 5, Compressed, Not-Encrypted

The downloaded file is an Android Backup. We should be able to extract it since it’s not encrypted.

Extracting the Android Backup

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16

dd if=cat.ab bs=1 skip=24 | openssl zlib -d > cat.tar

4223034+0 records in
4223034+0 records out
4223034 bytes (4.2 MB, 4.0 MiB) copied, 5.75332 s, 734 kB/s

tar -xf cat.tar

ls -la
total 8884
drwxrwxr-x  4 kali kali    4096 Jul 31 23:38 .
drwxrwxr-x  3 kali kali    4096 Jul 31 23:34 ..
drwxrwxr-x 50 kali kali    4096 Jul 31 23:38 apps
-rwxrw-rw-  1 kali kali 4223058 Mar  6  2020 cat.ab
-rw-rw-r--  1 kali kali 4853760 Jul 31 23:38 cat.tar
drwxrwxr-x  3 kali kali    4096 Jul 31 23:38 shared

Let’s start by inspecting what each of the extracted dir has.

Inspecting the shared folder

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71

ls -laR shared     
shared:
total 12
drwxrwxr-x  3 kali kali 4096 Jul 31 23:38 .
drwxrwxr-x  4 kali kali 4096 Jul 31 23:38 ..
drwxrwxr-x 11 kali kali 4096 Jul 31 23:38 0

shared/0:
total 44
drwxrwxr-x 11 kali kali 4096 Jul 31 23:38 .
drwxrwxr-x  3 kali kali 4096 Jul 31 23:38 ..
drwxrwx---  2 kali kali 4096 Feb  6  2020 Alarms
drwxrwx---  2 kali kali 4096 Feb 21  2020 DCIM
drwxrwx---  2 kali kali 4096 Feb  6  2020 Download
drwxrwx---  2 kali kali 4096 Feb  6  2020 Movies
drwxrwx---  2 kali kali 4096 Feb  6  2020 Music
drwxrwx---  2 kali kali 4096 Feb  6  2020 Notifications
drwxrwx---  2 kali kali 4096 Mar  6  2020 Pictures
drwxrwx---  2 kali kali 4096 Feb  6  2020 Podcasts
drwxrwx---  2 kali kali 4096 Feb  6  2020 Ringtones

shared/0/Alarms:
total 8
drwxrwx---  2 kali kali 4096 Feb  6  2020 .
drwxrwxr-x 11 kali kali 4096 Jul 31 23:38 ..

shared/0/DCIM:
total 8
drwxrwx---  2 kali kali 4096 Feb 21  2020 .
drwxrwxr-x 11 kali kali 4096 Jul 31 23:38 ..

shared/0/Download:
total 8
drwxrwx---  2 kali kali 4096 Feb  6  2020 .
drwxrwxr-x 11 kali kali 4096 Jul 31 23:38 ..

shared/0/Movies:
total 8
drwxrwx---  2 kali kali 4096 Feb  6  2020 .
drwxrwxr-x 11 kali kali 4096 Jul 31 23:38 ..

shared/0/Music:
total 8
drwxrwx---  2 kali kali 4096 Feb  6  2020 .
drwxrwxr-x 11 kali kali 4096 Jul 31 23:38 ..

shared/0/Notifications:
total 8
drwxrwx---  2 kali kali 4096 Feb  6  2020 .
drwxrwxr-x 11 kali kali 4096 Jul 31 23:38 ..

shared/0/Pictures:
total 4128
drwxrwx---  2 kali kali    4096 Mar  6  2020 .
drwxrwxr-x 11 kali kali    4096 Jul 31 23:38 ..
-rw-rw----  1 kali kali  471362 Mar  6  2020 IMAG0001.jpg
-rw-rw----  1 kali kali  487069 Mar  6  2020 IMAG0002.jpg
-rw-rw----  1 kali kali  407861 Mar  6  2020 IMAG0003.jpg
-rw-rw----  1 kali kali 2046587 Mar  6  2020 IMAG0004.jpg
-rw-rw----  1 kali kali  283402 Mar  6  2020 IMAG0005.jpg
-rw-rw----  1 kali kali  511006 Mar  6  2020 IMAG0006.jpg

shared/0/Podcasts:
total 8
drwxrwx---  2 kali kali 4096 Feb  6  2020 .
drwxrwxr-x 11 kali kali 4096 Jul 31 23:38 ..

shared/0/Ringtones:
total 8
drwxrwx---  2 kali kali 4096 Feb  6  2020 .
drwxrwxr-x 11 kali kali 4096 Jul 31 23:38 ..

Only the Pictures folder has data.

Inspecting the apps folder

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53

ls -laR apps  
apps:
total 200
drwxrwxr-x 50 kali kali 4096 Jul 31 23:38 .
drwxrwxr-x  4 kali kali 4096 Jul 31 23:38 ..
drwxrwxr-x  2 kali kali 4096 Jul 31 23:38 com.android.basicsmsreceiver
drwxrwxr-x  2 kali kali 4096 Jul 31 23:38 com.android.bips
drwxrwxr-x  2 kali kali 4096 Jul 31 23:38 com.android.bluetoothmidiservice
drwxrwxr-x  2 kali kali 4096 Jul 31 23:38 com.android.bookmarkprovider
drwxrwxr-x  3 kali kali 4096 Jul 31 23:38 com.android.camera2
drwxrwxr-x  2 kali kali 4096 Jul 31 23:38 com.android.captiveportallogin
drwxrwxr-x  2 kali kali 4096 Jul 31 23:38 com.android.carrierdefaultapp
drwxrwxr-x  3 kali kali 4096 Jul 31 23:38 com.android.contacts
drwxrwxr-x  2 kali kali 4096 Jul 31 23:38 com.android.cts.ctsshim
drwxrwxr-x  2 kali kali 4096 Jul 31 23:38 com.android.cts.priv.ctsshim
drwxrwxr-x  3 kali kali 4096 Jul 31 23:38 com.android.dialer
drwxrwxr-x  2 kali kali 4096 Jul 31 23:38 com.android.dreams.basic
drwxrwxr-x  2 kali kali 4096 Jul 31 23:38 com.android.egg
drwxrwxr-x  2 kali kali 4096 Jul 31 23:38 com.android.emergency
drwxrwxr-x  2 kali kali 4096 Jul 31 23:38 com.android.externalstorage
drwxrwxr-x  3 kali kali 4096 Jul 31 23:38 com.android.gallery3d
drwxrwxr-x  2 kali kali 4096 Jul 31 23:38 com.android.htmlviewer
drwxrwxr-x  3 kali kali 4096 Jul 31 23:38 com.android.inputmethod.latin
drwxrwxr-x  2 kali kali 4096 Jul 31 23:38 com.android.internal.display.cutout.emulation.corner
drwxrwxr-x  2 kali kali 4096 Jul 31 23:38 com.android.internal.display.cutout.emulation.double
drwxrwxr-x  2 kali kali 4096 Jul 31 23:38 com.android.internal.display.cutout.emulation.tall
drwxrwxr-x  3 kali kali 4096 Jul 31 23:38 com.android.launcher3
drwxrwxr-x  2 kali kali 4096 Jul 31 23:38 com.android.managedprovisioning
drwxrwxr-x  3 kali kali 4096 Jul 31 23:38 com.android.mtp
drwxrwxr-x  2 kali kali 4096 Jul 31 23:38 com.android.pacprocessor
drwxrwxr-x  2 kali kali 4096 Jul 31 23:38 com.android.providers.downloads.ui
drwxrwxr-x  2 kali kali 4096 Jul 31 23:38 com.android.providers.partnerbookmarks
drwxrwxr-x  2 kali kali 4096 Jul 31 23:38 com.android.providers.telephony
drwxrwxr-x  2 kali kali 4096 Jul 31 23:38 com.android.proxyhandler
drwxrwxr-x  3 kali kali 4096 Jul 31 23:38 com.android.settings.intelligence
drwxrwxr-x  2 kali kali 4096 Jul 31 23:38 com.android.simappdialog
drwxrwxr-x  2 kali kali 4096 Jul 31 23:38 com.android.systemui.theme.dark
drwxrwxr-x  2 kali kali 4096 Jul 31 23:38 com.android.traceur
drwxrwxr-x  3 kali kali 4096 Jul 31 23:38 com.android.wallpaperbackup
drwxrwxr-x  2 kali kali 4096 Jul 31 23:38 com.android.wallpapercropper
drwxrwxr-x  2 kali kali 4096 Jul 31 23:38 com.android.wallpaper.livepicker
drwxrwxr-x  2 kali kali 4096 Jul 31 23:38 com.android.wallpaperpicker
drwxrwxr-x  2 kali kali 4096 Jul 31 23:38 com.example.android.notepad
drwxrwxr-x  2 kali kali 4096 Jul 31 23:38 com.example.android.rssreader
drwxrwxr-x  3 kali kali 4096 Jul 31 23:38 com.farmerbb.taskbar.androidx86
drwxrwxr-x  2 kali kali 4096 Jul 31 23:38 com.google.android.backuptransport
drwxrwxr-x  2 kali kali 4096 Jul 31 23:38 com.google.android.ext.services
drwxrwxr-x  2 kali kali 4096 Jul 31 23:38 com.google.android.feedback
drwxrwxr-x  2 kali kali 4096 Jul 31 23:38 com.google.android.gms.setup
drwxrwxr-x  2 kali kali 4096 Jul 31 23:38 com.google.android.gsf.login
drwxrwxr-x  3 kali kali 4096 Jul 31 23:38 com.google.android.onetimeinitializer
drwxrwxr-x  4 kali kali 4096 Jul 31 23:38 org.android_x86.analytics
drwxrwxr-x  3 kali kali 4096 Jul 31 23:38 org.lineageos.eleven

There are a lot of manifest and xml files. Let’s start by analyzing the images in shared folder we will move here afterwards.

Most images are of cats, but one in particular is interesting:

alt text

If we zoom on the bottom of the notepad we see a flag.

Challenges
HTB Easy Mobile
This post is licensed under CC BY 4.0 by the author.