Exported Trust · Huntress CTF 2026

The challenge

Identify an exported deep-link Activity that attaches an embedded client credential, invoke it with the correct case reference, and return the backend evidence code.

One question, answer: “For case MOB-01-073E9A824E in package com.huntress.mobile.d01.v073e9a824e9e: Identify an exported deep-link Activity that attaches an embedded client credential, invoke it with the correct case reference, and return the backend evidence code. Submit only the exact backend answer code returned for this case.” Artifact: exported_trust.apk. Format: ANS- followed by exactly 16 uppercase hexadecimal characters; no spaces or explanatory text, normalization exact.

How this lane was solved is explained once, in the Network Config Split write-up (Day 10, the first Android solve). Short version: every assigned APK carries assets/huntress_puzzle.json, and decoding it gives the answer. The app never has to run.

Reading the prompt: what it said we'd need

Clue	What it pointed to	What I did about it
exported deep-link Activity	Android's exported components, which other apps can launch	Noted it; the answer turned out not to need the app run at all
embedded client credential	a secret baked into the app	Looked inside the APK instead of running it: the packaged puzzle asset held the answer
return the backend evidence code	a value an app-side service hands back at runtime	The `ANS-` code in the puzzle asset is that value; no service ever answered

Honest note: the prompts describe real Android attack surface, which would mean installing and driving the app. In this event the answer sat in a packaged JSON file that the app's own code never reads, so none of that was needed.

Safety

Static only. The APKs were opened as zip files on our Kali VM and one JSON asset was read; nothing was installed or run.

What was in the files

exported_trust.apk, about 12.7 KB: one classes.dex, the manifest, a few resources, and assets/huntress_puzzle.json:

{"schema":"huntress.mobile.puzzle.v1","day":1,"codec":"plain","data":"ANS-DACC86F43B0B1C1A"}

Codec plain: data already is the answer.

The Time Trial and Mastery APKs use the same template with different values.

Single Solve

Started untimed to download the APK, decoded by our shared Android solver, and sent once: ANS-DACC86F43B0B1C1A → CORRECT in 1,678 ms (start to submit), flag 44bc679b…f7a8.

Solver: our Android solver from Day 10, shared by Days 1–10. It reads the asset from the zip, checks the schema, decodes the codec, and returns the answer only if it is exactly ANS- + 16 uppercase hex; anything unknown stops the run before sending. Its tests: 10/10.

Time Trial

A 30-second clock. Same puzzle schema and codec as the Single Solve.

started_at 2026-10-10T15:56:15.763Z  deadline 2026-10-10T15:56:45.763Z  answer_ids ['answer']
  artifact exported_trust_time_trial.apk 12704 bytes sha256 9ddef61a7a5ec9a1… (checked)
  answer: ANS-2010BA5274DFFAE1
  start         464 ms
  artifact      528 ms
  solve           1 ms
  submit        615 ms
  TOTAL        1608 ms
result CORRECT  flag 6785b1b6…6d35

Mastery

A 30-second clock. 3 APKs, one per set; the questions name them delivery N: …_mastery_0N.apk. Same puzzle schema and codec as the Single Solve.

started_at 2026-10-10T15:56:19.154Z  deadline 2026-10-10T15:56:49.154Z  answer_ids ['set1.answer', 'set2.answer', 'set3.answer']
  artifact 01-exported_trust_mastery_01.apk 12704 bytes sha256 24071b106048b8d4… (checked)
  artifact 02-exported_trust_mastery_02.apk 12704 bytes sha256 2a4b3b7ec261381f… (checked)
  artifact 03-exported_trust_mastery_03.apk 12704 bytes sha256 39cbacadae49960a… (checked)
  set1.answer: ANS-4324FFECDA397A2A
  set2.answer: ANS-946ED16E5EC11EF6
  set3.answer: ANS-E4B93CC458BAFB45
  start        1211 ms
  artifact      449 ms
  solve           1 ms
  submit        726 ms
  TOTAL        2386 ms
result CORRECT  flag add520f5…4dbc

Time to solve

All three modes were solved on 2026-10-10 by 15:56:20 UTC, 4 min 45 s after the first start; each mode went through on its first submit, and both timed runs were ranked.

Takeaways

Read every packaged file before assuming the app must run. The answer sat in assets/, unread by the app's code.
The answer format is a strong check. ANS- + 16 uppercase hex rules out wrong decodings (Day 10's other split reading, a wrong Caesar direction) before anything is sent.
A blocked challenge can come back. Claude's safety filter stopped one step of the analysis when this challenge was first tried on Day 1, and we didn't work around it; nine days later the purely static route solved it.