Android CTF Juicy Bar::Time Travel

Hey all,

Let's continue with our walkthrough of Juicy Bar. If you're new here, try checking out other blogs and take the challenge before reading this.

Also, In this level we only need to find one flag.

Challenge

In this writeup we will be solving a very simple level, Time travel. Let's see the hints.

Let's try opening the menu.

Let's click on this.

Hmm Interesting let's check the decompiled source code in jadx.

public final void mo330m(Context context, int i, MainActivityBackendViewModeln mainActivityBackendViewModel) {
        String string;
        int i2;
        Date time = Calendar.getInstance().getTime();
        Calendar calendar = Calendar.getInstance();
        calendar.set(2010, 6, 4, 23, 59, 59);
        Date time2 = calendar.getTime();
        Calendar calendar2 = Calendar.getInstance();
        calendar2.set(2010, 6, 4, 0, 0, 0);
        if (time.before(calendar2.getTime())) {
            i2 = R.string.tt_too_early;
        } else if (!time.after(time2)) {
            Object[] objArr = new Object[1];
            Calendar calendar3 = Calendar.getInstance();
            calendar3.set(11, 7);
            calendar3.set(12, 1);
            calendar3.set(13, 0);
            calendar3.set(14, 0);
            calendar3.setTimeZone(TimeZone.getTimeZone("America/New_York"));
            ArrayList arrayList = new ArrayList(8);
            for (int i3 = 0; i3 < 8; i3++) {
                C0873d.m4595p(16);
                arrayList.add(C1490l.m3594i0(Integer.toString("B.Wilder".charAt(i3) % 256, 16), 2));
            }
            C0873d.m4595p(16);
            objArr[0] = Level.DefaultImpls.m362a(this, C0206o.m5915s0(16, C0873d.m4599N(C3133o.m2173U(arrayList, "", null, null, null, 62)) ^ calendar3.getTimeInMillis()));
            string = context.getString(R.string.tt_just_right, objArr);
            Level.DefaultImpls.m360c("Time travel", string, mainActivityBackendViewModel);
        } else {
            i2 = R.string.tt_too_late;
        }
        string = context.getString(i2);
        Level.DefaultImpls.m360c("Time travel", string, mainActivityBackendViewModel);
    }

Looking at the code, it's pretty understandable. It retrieves the current time and compares it with a specific date. If it's before July 4, 2010, it will display a message "You are too early...".

 if (time.before(calendar2.getTime())) {
            i2 = R.string.tt_too_early;
        }

<string name="tt_too_early">You are too early, the safe is empty. Whatever will be stored here has not been built yet. The 4th of July 2010 would be a good day to come back.</string>

If its the date is July 4,2010 we will get the message which contains the flag.

<string name="tt_just_right">You open the safe and find a strange, dangerous looking twelve sided device with warning signs on it. There is also a note in the safe that says\nJUICY{%1$s}</string>

Else we will get the below message.

<string name="tt_too_late">The safe is empty and you see signs of struggle nearby. It seems like the safe was emptied on the 4th of July 2010.</string>

So to get the flag we just need to set the date to July 4, 2010. Let's try do that. You can just change the time on the device.

Nice we got the flag. See you in the next one.