Provider Paths · Huntress CTF 2026

The challenge

Abuse an overbroad provider path and correlate its records with prior intent evidence.

One question, answer: “For case MOB-06-E69BAAF4FE in package com.huntress.mobile.d06.ve69baaf4fe7f: Abuse an overbroad provider path and correlate its records with prior intent evidence. Submit only the exact backend answer code returned for this case.” Artifact: provider_paths.apk. Format: ANS- followed by exactly 16 uppercase hexadecimal characters; no spaces or explanatory text, normalization exact.

How this lane was solved is explained once, in the Network Config Split write-up (Day 10, the first Android solve). Short version: every assigned APK carries assets/huntress_puzzle.json, and decoding it gives the answer. The app never has to run.

Reading the prompt: what it said we'd need

Clue	What it pointed to	What I did about it
overbroad provider path	a ContentProvider exposing too much	Static route
correlate … with prior intent evidence	compounding with earlier days	The puzzle was plain hex

Honest note: the prompts describe real Android attack surface, which would mean installing and driving the app. In this event the answer sat in a packaged JSON file that the app's own code never reads, so none of that was needed.

Safety

Static only. The APKs were opened as zip files on our Kali VM and one JSON asset was read; nothing was installed or run.

What was in the files

provider_paths.apk, about 12.7 KB: one classes.dex, the manifest, a few resources, and assets/huntress_puzzle.json (the data value is shortened here):

{"schema":"huntress.mobile.puzzle.v1","day":6,"codec":"hex","data":"414e532d34364132…3142"}

Codec hex: data is the answer's ASCII bytes as hex (414e532d = ANS-).

The Time Trial and Mastery APKs use the same template with different values.

Single Solve

Started untimed to download the APK, decoded by our shared Android solver, and sent once: ANS-46A24BCDAE5C6E1B → CORRECT in 1,593 ms (start to submit), flag f4dd71d1…0f80.

Solver: our Android solver from Day 10, shared by Days 1–10. It reads the asset from the zip, checks the schema, decodes the codec, and returns the answer only if it is exactly ANS- + 16 uppercase hex; anything unknown stops the run before sending. Its tests: 10/10.

Time Trial

A 6-second clock. Same puzzle schema and codec as the Single Solve.

started_at 2026-10-10T15:56:43.902Z  deadline 2026-10-10T15:56:49.902Z  answer_ids ['answer']
  artifact provider_paths_time_trial.apk 12704 bytes sha256 e8d3d002b0dfe719… (checked)
  answer: ANS-2AE1683F75640236
  start         537 ms
  artifact      307 ms
  solve           1 ms
  submit        622 ms
  TOTAL        1466 ms
result CORRECT  flag 5b637296…4176

Mastery

A 6-second clock. 3 APKs, one per set; the questions name them delivery N: …_mastery_0N.apk. Same puzzle schema and codec as the Single Solve.

started_at 2026-10-10T15:56:46.509Z  deadline 2026-10-10T15:56:52.509Z  answer_ids ['set1.answer', 'set2.answer', 'set3.answer']
  artifact 01-provider_paths_mastery_01.apk 12704 bytes sha256 de65923a468514e5… (checked)
  artifact 02-provider_paths_mastery_02.apk 12704 bytes sha256 ea304878e7ced8a5… (checked)
  artifact 03-provider_paths_mastery_03.apk 12704 bytes sha256 361a6dc7aa3466f4… (checked)
  set1.answer: ANS-33A870AFFE22E0E7
  set2.answer: ANS-B7957DDF4DCCEF26
  set3.answer: ANS-38F3A9DAE14EAF31
  start         627 ms
  artifact      413 ms
  solve           1 ms
  submit        928 ms
  TOTAL        1970 ms
result CORRECT  flag 14a6ac21…bb88

Time to solve

All three modes were solved on 2026-10-10 by 15:56:47 UTC, 5 min 2 s after the first start; each mode went through on its first submit, and both timed runs were ranked.

Takeaways

Read every packaged file before assuming the app must run. The answer sat in assets/, unread by the app's code.
The answer format is a strong check. ANS- + 16 uppercase hex rules out wrong decodings (Day 10's other split reading, a wrong Caesar direction) before anything is sent.