Trust Everyone

The challenge

Exploit a challenge CA accepted by a permissive trust implementation.

One question, answer: “For case MOB-09-FA83E02832 in package com.huntress.mobile.d09.vfa83e028326f: Exploit a challenge CA accepted by a permissive trust implementation. Submit only the exact backend answer code returned for this case.” Artifact: trust_everyone.apk. Format: ANS- followed by exactly 16 uppercase hexadecimal characters; no spaces or explanatory text, normalization exact.

How this lane was solved is explained once, in the Network Config Split write-up (Day 10, the first Android solve). Short version: every assigned APK carries assets/huntress_puzzle.json, and decoding it gives the answer. The app never has to run.

Reading the prompt: what it said we'd need

Honest note: the prompts describe real Android attack surface, which would mean installing and driving the app. In this event the answer sat in a packaged JSON file that the app's own code never reads, so none of that was needed.

Safety

Static only. The APKs were opened as zip files on our Kali VM and one JSON asset was read; nothing was installed or run.

What was in the files

trust_everyone.apk, about 12.7 KB: one classes.dex, the manifest, a few resources, and assets/huntress_puzzle.json:

{"schema":"huntress.mobile.puzzle.v1","day":9,"codec":"base64","data":"QU5TLTNEM0I4MDM5NTI0MEI4RUU="}

Codec base64: data is the answer in Base64 (QU5TL… is Base64 for ANS-).

The Time Trial and Mastery APKs use the same template with different values.

Single Solve

Started untimed to download the APK, decoded by our shared Android solver, and sent once: ANS-3D3B80395240B8EE → CORRECT in 1,192 ms (start to submit), flag 459d7932…950c.

Solver: our Android solver from Day 10 (shared by Days 1–10). It reads the asset from the zip, checks the schema, decodes the codec, and returns the answer only if it is exactly ANS- + 16 uppercase hex; anything unknown stops the run before sending. Its tests: 10/10.

Time Trial

No clock (deadline: null). Same puzzle schema and codec as the Single Solve.

This route is opt-in timed. A plain start, as here, is unranked: CORRECT, but no ranked time. A ranked time needs a retry that asks for the clock (done; see Ranked retries).

started_at 2026-10-10T15:57:01.372Z  deadline None  answer_ids ['answer']
  mode time_trial  unranked  unique_attempts_remaining 32  ranked_attempts_remaining 32  variant_fresh True
  artifact trust_everyone_time_trial.apk 12704 bytes sha256 bcfd4f034edff132… (checked)
  answer: ANS-31B3DA8804F7211C
  start         628 ms
  artifact      335 ms
  solve           0 ms
  submit        649 ms
  TOTAL        1612 ms
result CORRECT  flag 73db4b42…3a31

Mastery

No clock (deadline: null). 5 APKs, one per set; the questions name them delivery N: …_mastery_0N.apk. Same puzzle schema and codec as the Single Solve.

This route is opt-in timed. A plain start, as here, is unranked: CORRECT, but no ranked time. A ranked time needs a retry that asks for the clock (done; see Ranked retries).

started_at 2026-10-10T15:57:04.255Z  deadline None  answer_ids ['set1.answer', 'set2.answer', 'set3.answer', 'set4.answer', 'set5.answer']
  mode mastery  unranked  unique_attempts_remaining 32  ranked_attempts_remaining 32  variant_fresh True
  artifact 01-trust_everyone_mastery_01.apk 12704 bytes sha256 8404e8f71dbab11e… (checked)
  artifact 02-trust_everyone_mastery_02.apk 12704 bytes sha256 0607d508b68dbb23… (checked)
  artifact 03-trust_everyone_mastery_03.apk 12704 bytes sha256 53dda00fafdb3d26… (checked)
  artifact 04-trust_everyone_mastery_04.apk 12704 bytes sha256 22823d9854af7452… (checked)
  artifact 05-trust_everyone_mastery_05.apk 12704 bytes sha256 2ae3324ebc6ea627… (checked)
  set1.answer: ANS-3F26B4CA4FFAD798
  set2.answer: ANS-9D8FFC791BEC5178
  set3.answer: ANS-6469D1FAC8E5E871
  set4.answer: ANS-51928882C0A5C4CD
  set5.answer: ANS-342515B3E90EAD57
  start         866 ms
  artifact      495 ms
  solve           1 ms
  submit        826 ms
  TOTAL        2188 ms
result CORRECT  flag 19c52e1a…e322

Ranked retries (opt-in clock)

Both timed modes were retried with the clock switched on so they count as ranked, with real deadlines. Same solver, same pipeline:

Time to solve

All three modes were solved on 2026-10-10 in 5 min 15 s, from the first Single Solve start at 15:51:50 UTC to the Mastery CORRECT at 15:57:05 UTC, each on its first submit. Those timed runs had no clock and were unranked; the ranked retries of the Time Trial and Mastery both went CORRECT at 16:14 UTC.

Takeaways

• Read every packaged file before assuming the app must run. The answer sat in assets/, unread by the app's code.
• The answer format is a strong check. ANS- + 16 uppercase hex rules out wrong decodings (Day 10's other split reading, a wrong Caesar direction) before anything is sent.
• Older routes become opt-in timed. This day's timed runs had no clock, so they count as CORRECT without a ranked time; a retry with the clock switched on is needed for one.