BuckeyeCTF 2023 - replace-me

Description

Category: Misc

Author: rene

I knew I shouldn’t have gotten a cheap phone :/

Attachments:

• dist

Resolution

1. Android bootimg

First, we determine the file type with file:

$ file dist 
dist: Android bootimg, kernel, ramdisk, page size: 2048, cmdline (console=ttyHSL0,115200,n8 androidboot.hardware=mako lpj=67677 user_debug=31)

It seems to be the boot partition of an Android phone.

2. Extract the Kernel and the Ramdisk

I followed this guide¹ to extract all the content.

We verify that dist is a correct boot image (contains kernel+ramdisk):

$ abootimg -i dist 

Android Boot Image Info:

* file name = dist 

* image size = 6506496 bytes (6.21 MB)
  page size  = 2048 bytes

* Boot Name = ""

* kernel size       = 6009416 bytes (5.73 MB)
  ramdisk size      = 491824 bytes (0.47 MB)

* load addresses:
  kernel:       0x80208000
  ramdisk:      0x81800000
  tags:         0x80200100

* cmdline = console=ttyHSL0,115200,n8 androidboot.hardware=mako lpj=67677 user_debug=31

* id = 0xf633aef3 0x28435904 0xd274b946 0x75d5562f 0x2aea479c 0x00000000 0x00000000 0x00000000 

Now we have verified it, we can extract the kernel and the ramdisk:

$ abootimg -x dist 
writing boot image config in bootimg.cfg
extracting kernel in zImage
extracting ramdisk in initrd.img

We extract the content of initrd.img:

$ mkdir initrd
$ cd initrd
$ cat ../initrd.img | gunzip | cpio -vid

3. Searching for the flag

Now we have extracted everything possible, it’s time to find the flag.

I tried to find the flag with grep but I found nothing:

$ grep -rna bctf
{NOTHING}

Then, I browsed files to seek non-text file and found the flag in a image (initrd/res/images/charger/battery_fail.png):

bctf{gr33n_r0b0t_ph0N3}.

Additional resources

Architecture Partitions - Android

1. azureru/extract android kernel.md - GitHub Gist ↩