Objection Kifundisho

Tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Jifunze na fanya mazoezi ya Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks

Utangulizi

objection - Uchunguzi wa runtime wa programu za simu

Objection ni toolkit ya uchunguzi wa runtime wa programu za simu, inayoendeshwa na Frida. Imetengenezwa kwa lengo la kusaidia kutathmini programu za simu na msimamo wao wa usalama bila hitaji la kifaa cha simu kilicho jailbroken au rooted.

Note: Hii sio aina ya jailbreak / root bypass. Kwa kutumia objection, bado umehifadhiwa na vikwazo vyote vinavyowekwa na sandbox unayokabiliana nayo.

Muhtasari

Lengo la objection ni kumruhusu mtumiaji kuita vitendo vikuu vinavyotolewa na Frida. Vinginevyo, mtumiaji atahitaji kuunda script moja kwa kila programu anayotaka kuipima.

Kifundisho

Kwa kifundisho hiki nitatumia APK ambayo unaweza kupakua hapa:

Or from its original repository (download app-release.apk)

Usakinishaji

pip3 install objection

Muunganisho

Fanya muunganisho wa kawaida wa ADB na anzisha server ya frida kwenye kifaa (na hakikisha kwamba frida inafanya kazi katika client na server).

Ikiwa unatumia kifaa kilicho root inahitajika kuchagua programu unayotaka kujaribu ndani ya chaguo la –gadget. Katika kesi hii:

frida-ps -Uai
objection --gadget asvid.github.io.fridaapp explore

Hatua za Msingi

Si amri zote zinazowezekana za objections zitatajwa katika mafunzo haya; ni zile tu ambazo nimezipata kuwa za muhimu zaidi.

Mazingira

Baadhi ya taarifa za kuvutia (kama nywila au njia za faili) zinaweza kupatikana ndani ya mazingira.

env

Maelezo ya Frida

frida

Upload/Download

file download <remote path> [<local path>]
file upload <local path> [<remote path>]

Ingiza frida script

import <local path frida-script>

SSLPinning

android sslpinning disable #Attempts to disable SSL Pinning on Android devices.

Ugunduzi wa Root

android root disable  #Attempts to disable root detection on Android devices.
android root simulate #Attempts to simulate a rooted Android environment.

Exec Command

android shell_exec whoami

Picha za skrini

android ui screenshot /tmp/screenshot
android ui FLAG_SECURE false  #This may enable you to take screenshots using the hardware keys

Static analysis imefanywa Dynamic

Katika programu halisi tunapaswa kujua taarifa zote zilizogunduliwa katika sehemu hii kabla ya kutumia objection shukrani kwa static analysis. Hata hivyo, kwa njia hii huenda ukaona kitu kipya kwani hapa utapata tu orodha kamili ya classes, methods and exported objects.

Hii pia ni muhimu ikiwa kwa namna fulani huwezi kupata readable source code ya app.

Orodha ya activities, receivers and services

android hooking list activities


android hooking list services
android hooking list receivers

Frida itatoa error ikiwa hakuna itakayopatikana

Kupata activity ya sasa

android hooking get current_activity

Tafuta Madarasa

Tuanze kutafuta madarasa ndani ya programu yetu

android hooking search classes asvid.github.io.fridaapp

Tafuta Mbinu za darasa

Sasa tuchukue mbinu zilizomo ndani ya darasa MainActivity:

android hooking search methods asvid.github.io.fridaapp MainActivity

Orodhesha Methods zilizotangazwa za class pamoja na parameters zao

Hebu tuone ni parameters gani methods za class zinahitaji:

android hooking list class_methods asvid.github.io.fridaapp.MainActivity

Orodhesha madarasa

Unaweza pia kuorodhesha madarasa yote yaliyopakiwa ndani ya programu ya sasa:

android hooking list classes #List all loaded classes, As the target application gets usedmore, this command will return more classes.

Hii ni muhimu sana ikiwa unataka hook the method of a class and you only know the name of the class. Unaweza kutumia function hii ili search which module owns the class na kisha hook its method.

Hooking being easy

Hooking (watching) a method

Kutoka kwenye source code ya application tunajua kwamba function sum() from MainActivity inaendeshwa kila sekunde. Hebu tujaribu dump all possible information kila wakati function inapoitwa (arguments, return value and backtrace):

android hooking watch class_method asvid.github.io.fridaapp.MainActivity.sum --dump-args --dump-backtrace --dump-return

Hooking (kuangalia) class nzima

Kwa kweli ninapata methods zote za class MainActivity kuwa za kuvutia sana; hebu hook them all. Kuwa mwangalifu, hii inaweza crash programu.

android hooking watch class asvid.github.io.fridaapp.MainActivity --dump-args --dump-return

Unapocheza na programu wakati class ime-hooked utaona wakati kila function inapoitwa, hoja zake na thamani ya kurudi.

Kubadilisha thamani ya kurudi ya boolean ya function

Kutoka kwa source code unaweza kuona kuwa function checkPin inapata a String kama argument na inarudisha a boolean. Tufanye function daima irudishe true:

Sasa, ukandishi chochote kwenye boksi la maandishi la PIN utaona kwamba chochote ni halali:

Mifano za class

Tafuta na chapa mifano hai za Java class maalum, zilizobainishwa kwa jina la class lililo kamili. Out ni matokeo ya jaribio la kupata thamani ya string kwa objection iliyogunduliwa ambayo kwa kawaida itakuwa na thamani za sifa za object.

android heap print_instances <class>

Keystore/Intents

Unaweza kuchezea keystore na intents ukitumia:

android keystore list
android intents launch_activity
android intent launch_service

Kumbukumbu

Utoaji

memory dump all <local destination> #Dump all memory
memory dump from_base <base_address> <size_to_dump> <local_destination> #Dump a part

Orodha

memory list modules

Katika sehemu ya chini ya orodha unaweza kuona frida:

Hebu tuchunguze frida inachotoa (exports):

Tafuta/Andika

Unaweza pia kutafuta na kuandika ndani ya memory kwa kutumia objection:

memory search "<pattern eg: 41 41 41 ?? 41>" (--string) (--offsets-only)
memory write "<address>" "<pattern eg: 41 41 41 41>" (--string)

SQLite

Unaweza kutumia amri sqlite kuingiliana na hifadhidata za sqlite.

Kutoka

exit

Ninachokosa katika Objection

  • Mbinu za hooking mara nyingine husababisha programu kuanguka (hii pia ni kwa sababu ya Frida).
  • Huwezi kutumia instances za classes kuita functions za instance. Pia huwezi kuunda instances mpya za classes na kuzitumia kuita functions.
  • Hakuna shortcut (kama ile ya sslpinnin) ya ku-hook methods zote za kawaida za crypto zinazotumika na application ili kuona cyphered text, plain text, keys, IVs na algorithms zinazotumika.

Marejeleo

Tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Jifunze na fanya mazoezi ya Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks