android UnCrackable题目

tea9

发布于 2022-09-08 12:17:28

6200

发布于 2022-09-08 12:17:28

文章被收录于专栏：tea9的博客

android UnCrackable练习

OWASP的crackme练习里面有一些app安全的保护，破解者需要掌握一些逆向的知识才能获取正确的值。下面是android的两个题目，能帮助掌握基本的jadx逆向java代码、frida和ida逆向so的使用。

样本地址： Github：https://github.com/OWASP/owasp-mstg/tree/master/Crackmes 百度网盘地址：链接: https://pan.baidu.com/s/1YCiUU2Xy2xBSUQNxric8mQ 密码: 81kn

我用到的环境和工具

pixel xl arm64-v8a
python 3.8.0
frida 12.8.0
java 11.0.8
jadx 1.1.0
IDA 7.0
Ghidra 9.1.2

Android Level 1

UnCrackable1下载

考察的知识点： java逆向、root检测绕过工具： jadx、frida

安装应用

owasp-mstg/Crackmes/Android/Level_01(master*) » adb install UnCrackable-Level1.apk 
Performing Streamed Install
Success

打开应用会提示root

要绕root 用jadx打开apk 搜索root文本

发现c.a\c.b\c.c方法是判断root然后进入到方法里查看（选中方法右键跳到声明）

···
 public void onCreate(Bundle bundle) {
        if (c.a() || c.b() || c.c()) {
            a("Root detected!");
        }
        if (b.a(getApplicationContext())) {
            a("App is debuggable!");
        }
        super.onCreate(bundle);
        setContentView(R.layout.activity_main);
    }
···

跳到方法发现这个类是检测root的类，使用frida进行hook掉检测类

package sg.vantagepoint.a;

import android.os.Build;
import java.io.File;

public class c {
    public static boolean a() {
        for (String file : System.getenv("PATH").split(":")) {
            if (new File(file, "su").exists()) {
                return true;
            }
        }
        return false;
    }

    public static boolean b() {
        String str = Build.TAGS;
        return str != null && str.contains("test-keys");
    }

    public static boolean c() {
        for (String file : new String[]{"/system/app/Superuser.apk", "/system/xbin/daemonsu", "/system/etc/init.d/99SuperSUDaemon", "/system/bin/.ext/.su", "/system/etc/.has_su_daemon", "/system/etc/.installed_su_daemon", "/dev/com.koushikdutta.superuser.daemon/"}) {
            if (new File(file).exists()) {
                return true;
            }
        }
        return false;
    }
}

首先通过逆向分析发现sg.vantagepoint.a.c的类是检测root的类 c类下的a、b、c方法是检测的方法hook方法让他返回值为false frida代码：

Java.perform(function () {
        send("hook start");
        var c=Java.use("sg.vantagepoint.a.c");
        //返回值改成false
        c.a.overload().implementation = function(){
            return false;
        }
        c.b.overload().implementation = function(){
            return false;
        }
        c.c.overload().implementation = function(){
            return false;
        } 
        send("hook end");
    });

执行frida代码frida -U -f owasp.mstg.uncrackable1 --no-pause -l uncrackable1.js 启动后已经hook成功了，没有弹框了，然后是随便输入个值在点击VERIFY，提示That’s not it.Try again.

然后我们在jadx反编译后的代码里搜索下Try again

发现跳转verify方法，用于验证的是a.a(obj)跳转到a方法

1可以继续用frida hook该函数进行返回值输出

public static boolean a(String str) {
        byte[] bArr;
        byte[] bArr2 = new byte[0];
        try {
            bArr = sg.vantagepoint.a.a.a(b("8d127684cbc37c17616d806cf50473cc"), Base64.decode("5UJiFctbmgbDoLXmpL12mkno8HT4Lv8dlat8FxR2GOc=", 0));
        } catch (Exception e) {
            Log.d("CodeCheck", "AES error:" + e.getMessage());
            bArr = bArr2;
        }
        return str.equals(new String(bArr));
    }

frida代码：

var a =Java.use("sg.vantagepoint.a.a");
a.a.overload('[B', '[B').implementation=function(arg1,arg2){
            //执行函数
            var ret = this.a(arg1,arg2);
            //输出返回值
            console.log(jhexdump(ret));
            return ret;
        }

uncrackable1.js frida完整代码：

// owasp.mstg.uncrackable1 
// hookroot检测 
function hookrootuncrackable1(){
    Java.perform(function () {
        send("hook start");
        var c=Java.use("sg.vantagepoint.a.c");
        //返回值改成false
        c.a.overload().implementation = function(){
            return false;
        }
        var a =Java.use("sg.vantagepoint.a.a");
        /**
         *重载报错 根据报错把overload添加上就可以了
         * Error: a(): argument count of 0 does not match any of:
	.overload('[B', '[B')
    at throwOverloadError (frida/node_modules/frida-java-bridge/lib/class-factory.js:1020)
    at frida/node_modules/frida-java-bridge/lib/class-factory.js:686
    at /uncrackable1.js:13                                                      
    at frida/node_modules/frida-java-bridge/lib/vm.js:11
    at E (frida/node_modules/frida-java-bridge/index.js:346)
    at frida/node_modules/frida-java-bridge/index.js:332
    at input:1
         */
        a.a.overload('[B', '[B').implementation=function(arg1,arg2){
            //执行函数
            var ret = this.a(arg1,arg2);
            console.log(jhexdump(ret));
            // console.log(byte2string(ret));
            /***
             * retval = this.a(arg1, arg2);
            password = ''
            for(i = 0; i < retval.length; i++) {
               password += String.fromCharCode(retval[i]);
            }
            console.log("[*] Decrypted: " + password);
             */
            return ret;
        }


        send("hook end");
    });
}
function jhexdump(array,off,len) {
    var ptr = Memory.alloc(array.length);
    for(var i = 0; i < array.length; ++i)
        Memory.writeS8(ptr.add(i), array[i]);
    //console.log(hexdump(ptr, { offset: off, length: len, header: false, ansi: false }));
    console.log(hexdump(ptr, { offset: 0, length: array.length, header: false, ansi: false }));
}

function main(){
    hookrootuncrackable1();
}
setImmediate(main)
// owasp.mstg.uncrackable1
//frida -U -f  owasp.mstg.uncrackable1 --no-pause -l uncrackable1.js

执行结果：

~ » frida -U -f  owasp.mstg.uncrackable1 --no-pause -l uncrackable1.js                   
     ____
    / _  |   Frida 12.8.0 - A world-class dynamic instrumentation toolkit
   | (_| |
    > _  |   Commands:
   /_/ |_|       help      -> Displays the help system
   . . . .       object?   -> Display information about 'object'
   . . . .       exit/quit -> Exit
   . . . .
   . . . .   More info at https://www.frida.re/docs/home/
Spawned `owasp.mstg.uncrackable1`. Resuming main thread!                
[Google Pixel XL::owasp.mstg.uncrackable1]-> message: {'type': 'send', 'payload': 'hook start'} data: None
message: {'type': 'send', 'payload': 'hook end'} data: None
7062ac63b0  49 20 77 61 6e 74 20 74 6f 20 62 65 6c 69 65 76  I want to believ
7062ac63c0  65                                               e

I want to believe 是最后的值

2.分析代码使用aes算法进行输出

 » echo 5UJiFctbmgbDoLXmpL12mkno8HT4Lv8dlat8FxR2GOc= | openssl enc -aes-128-ecb -base64 -d -nopad -K 8d127684cbc37c17616d806cf50473cc
I want to believe%

解题参考链接： https://www.codemetrix.io/hacking-android-apps-with-frida-2/ 翻译【技术分享】利用FRIDA攻击Android应用程序（二）

Android Level 2

UnCrackable2下载考察的知识点： java逆向、root检测绕过、so逆向工具：jadx、frida、IDA、Ghidra

安装应用：adb install UnCrackable-Level2.apk 发现仍然有root检测

用jadx打开UnCrackable-Level2.apk分析下代码吧~ jadx-gui UnCrackable-Level2.apk 依旧搜索Root detected! 发现跟第一道题是一样的，就是类名换掉了，用frida在hook下，就可以解决了

frida代码：

Java.perform(function(){
        var b=Java.use("sg.vantagepoint.a.b");
        b.a.overload().implementation = function(){
            return false;
        }
        b.b.overload().implementation = function(){
            return false;
        }
        b.c.overload().implementation = function(){
            return false;
        }
    });

正常启动后再搜索Try again

verify()
···
 if (this.m.a(obj)) {
            create.setTitle("Success!");
            str = "This is the correct secret.";
        } else {
            create.setTitle("Nope...");
            str = "That's not it. Try again.";
        }
···

private native boolean bar(byte[] bArr);

    public boolean a(String str) {
        return bar(str.getBytes());
    }

最后分析到a方法最后到了bar方法是native函数里，是写在so里的，需要用IDA进行分析解压UnCrackable-Level2.apk 到Level_02/UnCrackable-Level2/lib/armeabi-v7a文件夹中有个libfoo.so文件用IDA打开进行分析搜索bar函数

按F5查看伪c代码

发现有个Thanks for all the fish字符串尝试输入，发现已经Success了

除了IDA还可以用Ghidra打开尝试搜索bar函数打开

分析代码发现有几个值进行对比然后拼接后转字符串查看小端序所以是倒着的 6873696620656874206c6c6120726f6620736b6e616854 使用十六进制转换工具进行查看十六进制转换工具：https://zixuephp.net/tool-str-hex.html 选择16进制转字符串就可以了工具：https://gchq.github.io/CyberChef