SPRITEKING

使用Androl4b进行安卓APP安全测试(Part 1)

时间:公元16-07-29 栏目:Linux 作者:SPRITEKING 吐槽:2 被黑客围观: 1,199 次





作者:雪碧0xroot@漏洞盒子安全团队

文章首发地址:

http://www.freebuf.com/articles/terminal/110374.html

0x00 前言

移动客户端Ap测试中,相信有很多小伙伴都是在自己常用的手机中安装上需要测试的App。这种方法是比较常见的一种,但是常用的手机中难免会有其它不相关的App在后台运行、进行网络请求,导致我们拦截到很多测试中不需要要的数据包甚至有的情况下我们无法辨别数据包是否是需要测试的App发出的请求。介于这种情况我们需要一个更干净的测试环境来对移动端App进行测试。

0x01工欲善其事必先利其器

Androl4b是一个基于ubuntu mate的安卓安全评估&测试的系统,系统集成了一系列Android 应用程序评估测试所需的工具,可用于逆向工程和恶意软件分析,为安卓测试、安全研究从业人员节省了大量环境搭建配置所需的时间、精力。

Clipboard Image.png

Clipboard Image.png

该工具的中文介绍可参阅:工具推荐:Androl4b,安卓安全评估测试利器  一文。

下载链接:http://pan.baidu.com/s/1dEfkwLV 密码:57gu

MD5Sum : 0c2346b1dbd769e3eb2069026a3c8efe
SHA1Sum : 1119e5e225094191739281670e2aa6400a15f80f

0x02 系统优化

下载解压完成后,可在虚拟机中直接启动Androl4b:

账户:andro

密码:androlab

Clipboard Image.png

使用过程中发现系统中已经集成JDK环境、Android Studio、Pyhton、Wireshark、BurpSuite等常用工具,由于工具是老外打包的,所以系统里边没安装中文语言。

2.1 设置DNS

System->Control Center->Network->DNS:

Clipboard Image.png

sudo apt-get update

2.2 安装中文语言包

System->Control Center->Language Support->Install/Remove Languages->Chines (simplified)

Clipboard Image.png

Apply Changes使配置生效,账户输入密码后便开始下载语言文件:

Clipboard Image.png

下载完成后把Chines拖到第一项(位于English前一位),把中文作为系统语言首选项。重启系统后,配置生效。也可以通过下面的步骤修改系统配置文件把中文作为首选项:

2.3 修改系统语言配置文件

修改local文件:

sudo vim /var/lib/locales/supported.d/local
//删除所有内容,增加以下内容:
zh_CN.UTF-8 UTF-8
zh_CN GB2312
zh_CN.GBK GBK
en_US.UTF-8 UTF-8
fr_FR ISO-8859-1
zh_CN.GB18030 GB18030

生成相关的locales:

sudo locale-gen --purge

修改设置默认语言:

sudo vim /etc/default/locale
//删除所有内容,增加以下内容:
LANG="zh_CN.UTF-8"
LANGUAGE="zh_CN:zh"
LC_NUMERIC="zh_CN.UTF-8"
LC_TIME="zh_CN.UTF-8"
LC_MONETARY="zh_CN.UTF-8"
LC_PAPER="zh_CN.UTF-8"
LC_IDENTIFICATION="zh_CN.UTF-8"
LC_NAME="zh_CN.UTF-8"
LC_ADDRESS="zh_CN.UTF-8"
LC_TELEPHONE="zh_CN.UTF-8"
LC_MEASUREMENT="zh_CN.UTF-8"

修改完成后重启系统,最终效果:

Clipboard Image.png

0x03 安卓虚拟机

Emulator安卓模拟器是目前使用最方便的安卓模拟器,无需安装任何插件,下载安装后直接点击运行。支持windows、Linux系统。Androl4B中已经安装了该工具,并且有一个名为lab的虚拟安卓设备:

Clipboard Image.png

3.1 为虚拟设备设置代理

终端执行

emulator -avd lab -no-audio -http-proxy http://127.0.0.1:8090

3.2 配置Burp Suite

3.2.1 增加代理

Applications->tools->BurpSuite  Proxy->Option-add->Bind to port 8090

Clipboard Image.png

3.2.2 监听127.0.0.1:8090

Clipboard Image.png

使用系统自带浏览器打开一个网站,测试能否拦截到网络请求:

Clipboard Image.png

Burp Suit成功拦截到了安卓虚拟机中的网络请求。

0x04 ADB的一些使用

4.1 显示系统中的全部安卓平台

android list targets

Clipboard Image.png

4.2 列出电脑连接的设备

adb devices

Clipboard Image.png

emulator-5554设备为emulator模拟器模拟的安卓手机,LGD857是我连接到电脑中的手机。

4.3 安装应用程序

adb install xxx.apk

Clipboard Image.png

4.3.1 拦截App通信数据包:

Clipboard Image.png

4.4 获取模拟器中的文件:

adb pull <remote> <local>

4.5 向模拟器中写文件:

adb push <local> <remote>

4.6 进入模拟器的shell模式:

adb shell

Clipboard Image.png

4.7 卸载模拟器中的App

adb uninstall com.sina.weibo

0x05 Drozer

Clipboard Image.png

5.1 工具介绍

Drozer原名mercury,是一款Android安全审计与攻击框架,该工具分为免费版(社区版)和专业版,专业版增加了GUI界面这类的一些功能。

5.2 工具站点

工具介绍下载地址:https://labs.mwrinfosecurity.com/tools/drozer/

工具GayHub开源项目地址:https://github.com/mwrlabs/drozer/

5.3 工具安装

Androl4b中已有这个工具,我们在终端执行、查看一下帮助信息:

andro@l4b:~$ drozer
usage: drozer [COMMAND]

Run `drozer [COMMAND] --help` for more usage information.

Commands:
          console  start the drozer Console
           module  manage drozer modules
           server  start a drozer Server
              ssl  manage drozer SSL key material
          exploit  generate an exploit to deploy drozer
            agent  create custom drozer Agents
          payload  generate payloads to deploy drozer
andro@l4b:~$ drozer console --help
usage: drozer console [OPTIONS] COMMAND

Starts a new drozer Console to interact with an Agent.

The drozer Console connects to an Agent and allows you to interact with the
system from the context of the agent application on the device. The console
can connect directly to an agent, if its embedded server is enabled, or through
a drozer Server that the agent is connected to.

positional arguments:
  command               the command to execute
  device                the unique identifier of the Agent to connect to

optional arguments:
  -h, --help            show this help message and exit
  --server HOST[:PORT]  specify the address and port of the drozer server
  --ssl                 connect with SSL
  --accept-certificate  accept any SSL certificate with a valid trust chain
  --debug               enable debug mode
  --no-color            disable syntax highlighting in drozer output
  --password            the agent requires a password
  -c ONECMD, --command ONECMD
                        specify a single command to run in the session
  -f [FILE [FILE ...]], --file [FILE [FILE ...]]
                        source file

available commands:
  commands    shows a list of all console commands                              
  connect     starts a new session with a device                                
  devices     lists all devices bound to the drozer server                      
  disconnect  disconnects a drozer session                                      
  version     display the installed drozer version  

接下来我们需要在Emulator安装Drozer。

5.3.1 运行安卓模拟器(Terminal ①):

emulator -avd lab

5.3.2 下载Drozer APK文件(Terminal ②):

wget https://labs.mwrinfosecurity.com/system/assets/934/original/drozer-agent-2.3.4.apk

5.3.3 把Drozer安装到安卓模拟器中:

adb install drozer-agent-2.3.4.apk

Clipboard Image.png

5.4 开始使用

5.4.1 在安卓虚拟机中运行drozer Agent App,打开Embbdded Server:

Clipboard Image.png

5.4.2 使用 adb 进行端口转发,转发到 Drozer使用的端口 31415,并进入Drozer 控制台:

adb forward tcp:31415 tcp:31415
drozer console connect

Clipboard Image.png

run $module    执行Drozer功能模块
list       列出Drozer所有功能模块
dz> list
app.activity.forintent      Find activities that can handle the given intent    
app.activity.info           Gets information about exported activities.         
app.activity.start          Start an Activity                                   
app.broadcast.info          Get information about broadcast receivers           
app.broadcast.send          Send broadcast using an intent                      
app.broadcast.sniff         Register a broadcast receiver that can sniff        
                            particular intents                                  
app.package.attacksurface   Get attack surface of package                       
app.package.backup          Lists packages that use the backup API (returns true
                            on FLAG_ALLOW_BACKUP)                               
app.package.debuggable      Find debuggable packages                            
app.package.info            Get information about installed packages            
app.package.launchintent    Get launch intent of package                        
app.package.list            List Packages                                       
app.package.manifest        Get AndroidManifest.xml of package                  
app.package.native          Find Native libraries embedded in the application.  
app.package.shareduid       Look for packages with shared UIDs                  
app.provider.columns        List columns in content provider                    
app.provider.delete         Delete from a content provider                      
app.provider.download       Download a file from a content provider that        
                            supports files                                      
app.provider.finduri        Find referenced content URIs in a package           
app.provider.info           Get information about exported content providers    
app.provider.insert         Insert into a Content Provider                      
app.provider.query          Query a content provider                            
app.provider.read           Read from a content provider that supports files    
app.provider.update         Update a record in a content provider               
app.service.info            Get information about exported services             
app.service.send            Send a Message to a service, and display the reply  
app.service.start           Start Service                                       
app.service.stop            Stop Service                                        
auxiliary.webcontentresolver
                            Start a web service interface to content providers. 
exploit.jdwp.check          Open @jdwp-control and see which apps connect       
exploit.pilfer.general.apnprovider
                            Reads APN content provider                          
exploit.pilfer.general.settingsprovider
                            Reads Settings content provider                     
information.datetime        Print Date/Time                                     
information.deviceinfo      Get verbose device information                      
information.permissions     Get a list of all permissions used by packages on   
                            the device                                          
scanner.activity.browsable  Get all BROWSABLE activities that can be invoked    
                            from the web browser                                
scanner.misc.native         Find native components included in packages         
scanner.misc.readablefiles  Find world-readable files in the given folder       
scanner.misc.secretcodes    Search for secret codes that can be used from the   
                            dialer                                              
scanner.misc.sflagbinaries  Find suid/sgid binaries in the given folder (default
                            is /system).                                        
scanner.misc.writablefiles  Find world-writable files in the given folder       
scanner.provider.finduris   Search for content providers that can be queried    
                            from our context.                                   
scanner.provider.injection  Test content providers for SQL injection            
                            vulnerabilities.                                    
scanner.provider.sqltables  Find tables accessible through SQL injection        
                            vulnerabilities.                                    
scanner.provider.traversal  Test content providers for basic directory traversal
                            vulnerabilities.                                    
shell.exec                  Execute a single Linux command.                     
shell.send                  Send an ASH shell to a remote listener.             
shell.start                 Enter into an interactive Linux shell.              
tools.file.download         Download a File                                     
tools.file.md5sum           Get md5 Checksum of file                            
tools.file.size             Get size of file                                    
tools.file.upload           Upload a File                                       
tools.setup.busybox         Install Busybox.                                    
tools.setup.minimalsu       Prepare 'minimal-su' binary installation on the     
                            device. 
shell    进入Drozer Agent App的shell交互界面
 dz> shell
u0_a343@g3:/data/data/com.mwr.dz $ 

5.5 工具功能

5.5.1 列出模拟器设备中所有已经安装的App包列表

run app.package.list

Clipboard Image.png

5.5.2 列举APP的详细信息:

在文章第一部分我们安装了新浪微博,这里便以微博为例:

利用关键词“weibo”进行搜索得出包名:

dz> run app.package.list -f weibo
com.sina.weibo (微博)
dz> 

查看包信息:

run app.package.info -a  com.sina.weibo

Clipboard Image.png

通过上述方式,我们已经获得应用数据目录、apk的路径、UID、GID等信息。
5.5.3 APP攻击面分析&查找应用的IPS漏洞:

dz> run app.package.attacksurface com.sina.weibo
Attack Surface:
  139 activities exported
  21 broadcast receivers exported
  1 content providers exported
  16 services exported

微博中存在139个暴露的activity ,我们可以使用下面这条命令查看app的activity:

5.5.4 获取activity信息

dz> run app.activity.info -a com.sina.weibo
Package: com.sina.weibo
  com.sina.weibo.MainTabActivity
    Permission: null
  com.sina.weibo.composerinde.ComposerDispatchActivity
    Permission: null
..................省略若干........................
  com.sina.weibo.richdocument.RichDocumentDispatchActivity
    Permission: null
  com.sina.weibo.notepro.NoteActivity
    Permission: null

dz>

5.5.5 Reading from Content Providers

dz> run app.provider.info -a com.sina.weibo
Package: com.sina.weibo
  Authority: com.sina.weibo.sdkProvider
    Read Permission: null
    Write Permission: null
    Content Provider: com.sina.weibo.provider.SinaWeiboSdkProvider
    Multiprocess Allowed: False
    Grant Uri Permissions: False

5.5.6 Database-backed Content Providers (Data Leakage)

由于在写文章测试的过程中,没有找到合适的App来演示数据泄露利用模块以及sql注入模块的功能,直接贴一下使用指南中的案例演示:

dz> run scanner.provider.finduris 
-
a com.mwr.example.sieve 
Scanning com.mwr.example.sieve...
Unable to Query content://com.mwr.
example.sieve.DBContentProvider/
... 
Unable to Query content://com.mwr.example.sieve.DBContentProvider/Keys 
Accessible content URIs:
content://com.mwr.example.sieve.DBContentProvider/Keys/
content://com.mwr.example.sieve.DBContentProvider/Passwords
content://com.mwr.example.sieve.DBContentProvider/Passwords/

利用

dz> run app.provider.query 
content://com.mwr.example.sie
ve.DBContentProvider/Passwords/
--
vertical
_id: 1
service: Email
username: incognitoguy50
password: PSFjqXIMVa5NJFudgDuuLVgJYFD+8w== (Base64
-
encoded)
email: incognitoguy50@gmail.com

5.5.7 Database-backed Content Providers (SQL Injection)

dz> run app.provider.query content://com.mwr.example.sie
ve.DBContentProvider/Passwords/
--
projection "'" 
unrecognized token: "' FROM Passwords" (code 1): , while compiling: SELECT ' FROM Passwords

dz> run app.provider.query 
content://com.mwr.example.sie
ve.DBContentProvider/Passwords/
--
selection "'" 
unrecognized token: "')" (code 1): , while compiling: SELECT * FROM Passwords 
WHERE (')

Droer 使用指南

Drozer的更多功能、使用方法可参阅:Drozer 使用指南 : https://labs.mwrinfosecurity.com/assets/BlogFiles/mwri-drozer-user-guide-2015-03-23.pdf

0x06 ApkTool

6.1 工具介绍

Clipboard Image.png

ApkTool是谷歌提供的APK编译工具,支持反编译及回编译apk。同时安装反编译系统apk所需要的framework-res框架,清理上次反编译文件夹等功能。使用该工具需安装Java环境。

6.2 decode

decode命令用于进行反编译apk文件:

apktool decode xx.apk

Clipboard Image.png

反编译完成,我们可以看到一个”weibo”目录,目录中有一个AndroidManifest.xml文件:

Clipboard Image.png

通过分析AndroidManifest.xml,我们可以获取到这些信息:包名、版本信息、Activity组件等:

Clipboard Image.png

在<activity></activity>标签当中我们可以找到所有的activity:

Clipboard Image.png

0x07 refer

https://blogs.mcafee.com/mcafee-labs/testing-android-application-security-part-1/

https://github.com/sh4hin/Androl4b

工具推荐:Androl4b,安卓安全评估测试利器

Drozer 使用指南 : https://labs.mwrinfosecurity.com/assets/BlogFiles/mwri-drozer-user-guide-2015-03-23.pdf

blogs.mcafee.com : How to: Testing Android Application Security, Part 2

maxwithcoco.com : drozer:某APK ContentProvider安全测试

*本文作者:雪碧0xroot@漏洞盒子安全团队,转载须注明来自FreeBuf黑客与极客(FreeBuf.COM)

声明: 本文由( SPRITEKING )原创编译,转载请保留链接: 使用Androl4b进行安卓APP安全测试(Part 1)

使用Androl4b进行安卓APP安全测试(Part 1):目前有2 条留言

  1. 沙发
    xiaodi:

    跪求密码!

    2016-08-04 11时55分 [回复]

发表评论


Time

新浪微博

音乐

为您推荐