Blog >> Magnet Virtual Summit 2024 CTF (iOS)

Solving Magnet Virtual Summit 2024 CTF (iOS)

20/03/2024 Tuesday

The Magnet Capture The Flag event was held from February 27th to March 7th as part of their Virtual Summit. The CTF questions were divided into three groups, iOS, Android & Ciphers. This challenge will be solved with ArtiFast (Full Version). This is part 1 of 3 the iOS section of the challenge.


Artifacts Covered in this Challenge:


Why are your messages green? (5 points)


Q: On what date did Rocco and Chadwick first meet in person according to their conversations? YYYY-MM-DD format.


According the iOS SMS they met on 2023-12-17. The first highlighted message in red shows his first introduction, the second shows them making plans and the third confirms their meeting.


Where /r u going on safari? (5 points)


Q: What subreddit was visited in a browser?


The answer is Twitch. iOS Safari History shows he visited https://www.reddit.com/r/Twitch/comments/ejqcof/good_equipment_for_starting_out_streaming_within/?rdt=39130 titled Good equipment for starting out streaming within my budget? (~$600) : r/Twitch


IMAGEine living in pain (5 points)


Q: Chad seemed to be searching for pain relief medicine in a store, how much did it cost?


In iOS Safari Recent Web Searches, 2 searches that happened barely 2 minutes apart standout, “How to avoid bruising” and “where to get arnica”. Arnica is a medication used for pain relief. The hint indicates the answer should be an image. Checking iPhone images for the date the search occurs, which is 2023-12-18, leads to the image of Arnica at a store sold at the answer $10.99






Your keyboard is salt-y (5 points)


Q: How many total words were typed on the device?


The answer is 1814. The salt hint probably refers to the salt4n6 blog that talks about data relating to iOS Keyboard. The total number of typed words can be found in /private/var/mobile/Library/Keyboard/user_model_database.sqlite.


Answer the call (5 points)


Q: What is the guild ID of the discord server Chad was in?


136986169563938816


Don't ghost me (5 points)


Q: At what time did Chadwick get annoyed at MYAI? YYYY-MM-DD HH:MM:SS UTC. 24 hour formatted timestamp


The answer is 2023-12-26 23:27:45. A search of the word MYAI shows a message sent via snapchat by a ChatBot called MyAI. Filtering the snapchat chat messages to see those of the same Conversaion ID, we find that Chadwick sent the message “I thought u were cool with the Avs but now you’re getting on my nerves” at the time.




Build me up, buttercup (5 points)


Q: What is the current build version?


The build version is 20F75 can be found under iOS Software Information artifact


Warning Signs (5 points)


Q: How many days did it take Chad to be warned about his Data Usage?


We see the welcome message sent by Boost Mobile at 11/29/2023 17:40:02 and the Data Usage warning was sent on 12/17/2023 00:27:48. It took 18 days for Chad to be warned.


Watching streams to stay current (10 points)


Q: What is the name of Chad's streaming channel?


ChadwickGames. It is parsed as a user on iOS Discord Users. Searching for the name on twitch and youtube, returned results on youtube.




One is The Lonliest Number (10 points)


Q: What question did Chadwick ask to AI?


A text search of the term “ai” returns results that indicate chatGPT was installed on the device. To find the question, going through the Snapshots under the application data reveals the answer “How to make online friends”




Watch me sUAVely win this game


Q: How many kills did Chad have on his CoD Mobile winning game?


7 Kills. The video is posted on his youtube channel


For when I cant Find My gear (10 points)


Q: What outdoor activity store did Chadwick Visit?


Neptune Mountaineering. One of the coordinates in iOS Routined Granular Location returns the location of the store, and we can also see from Apple Biome WiFi that he connected to their network.






Just a couple steps away (10 points)


Q: How many steps did Chad take on 12/3/2023?


Adding the entries of that date in iOS Health Steps yields the answer 968


Another regularly scheduled program (10 points)


Q: What Tattoo shop was visited on 12/27/2023?


Checking location related artifacts for the above date, we find that he spent some time in the same area of Boulder, CO 80305. We can see below an image from his device of a cafe in the area, close by is a tattoo place called “Auspicious Tattoo”.


I hear Stanley cups are all the rage (25 points)


Q: What was the final score of the hockey game Chad went to? (home-away)


Chadwick chatted about the NHL game in his chat with MyAI on Snapchat. The final score was 6-4.


Excuse Moi? What did you say? (25 points)


Q: What is the content of the 2nd message that Chad deleted on Dec 18, 2023


In iOS SMS there are 2 messages sent on the 18th but the text fields are emtpty, checking Apple Biome Application Intents (SMS) we can find their contents. The second one starts with “Excuse moi?”. Given the hint above, the answer is “Excuse me?! That's quite a bold statement considering I'm the one who walked away with a black eye and spent $30 last night on products to avoid one!”.


Boost this server


Q: What is the 16 character carrier code?


310240_GID1-6432. The answer is found under iOS Cellular Wireless Information.


Its been a long time (25 points)


Q: When did chad last login to Facebook? YYYY-MM-DD HH:MM:SS UTC


2023-12-27 21:34:55. Checking the facebook data folder, we find the answer in the most recent time_in_app_xxxxxxx.db file within the metadata table.


Can anyone Kelp? (25 points)


Q: What game was Chad asking to know the strategy to?


The hint Kelp suggests the game has something to do with the vegetable. Checking the games on the device under iOS Apps iTunes Bundle Metadata artifact, we find the game “Terrarium: Garden Idle”


The easy way or the hard way (25 points)


Q: What is the timestamp of the message Chad sent to Rocco but was never received? YYYY-MM-DD HH:MM:SS UTC


The last text message from Chad to Rocco was sent on 2023-12-21 06:29:36 the entry shows confirmation that it was sent but not delivered and the message is nowhere to be found in the messages database of Rocco’s Android device.


Follow the Breadcrumbs (50 points)


Q: How many times did Chad's keyboard become visible within the Amazon app on 12/24/2023?


The answer is 2. Under iOS Biome Text Input Sessions artifact if we filter with the keyword “amazon” we see that a text input session was detected twice that same day.


Read my mind (50 points)


Q: What message was sent to Rocco in a video game?


I know youre reading my messages. It was found in the call of duty application data folder called "ChatCache".


Chat GPT is my PREFERENCE for AI (50 points)


Q: What is the ChatGPT userID associated with chadwickmr95@gmail.com


The answer is user-xurgQ0xumvrujH5ESG17Yhcw. Looking through the ChatGPT data folder, its preferences folder would most probably hold that information. The file com.openai.chat.StatsigService.plist held the information. The user ID can also be found in the applications Cache.db




Season's Greetings (75 points)


Q: What was the name of the first emoji that was sent to Susan?


The first emoji sent to Susan was a Potted Plant.