Hi all, I just released this new application that I think could be interesting. It is basically an application that enables hosting Android CTF challenges in a constrained and controlled environment, thus allowing to setup challenges that wouldn’t be possible with just the standard apk.

For example you may create a challenge where the goal is to get RCE and read the flag.txt file placed on the device. Or again a challenge where you need to create an exploit app to abuse some misconfigured service or broadcast provider. The opportunities are endless.

As of now the following features are available:

• Real-Time Device Screen (via scrcpy)
• Reset Challenge State
• Restart App / Start Activity / Start Service (toggable)
• Send Broadcast Intent (toggable)
• Shutdown / Reboot Device (toggable)
• Download Bugreport (bugreportz) (toggable)
• Frida Scripting (toggable)
  • Run from preloaded library (jailed mode)
  • Run arbitrary scripts (full mode)
• File Browser (toggable)
• Terminal Access (toggable)
• APK Management (and start Exploit App) (toggable)
• Logcat Viewer (toggable)

You can see the source code here: https://github.com/SECFORCE/droidground

There is also a simple example with a dummy application.

It also has a nice web UI!

Let me know what you think and please provide some constructive feedback on how to make it better.