OWASP crackme write up version 2 level 1 ∠( ᐛ 」∠)＿ (day 10)

 

So this is another alternative way to solve owasp crackme challenge level 1. In this post i will use adb jdwp to bypass the anti-debugging feature of the application and retrieve the clear text secret string of the application

i already told you from my previous post of debugging jdwp ( https://court-of-testing-analysing.blogspot.com/2018/11/going-old-fashion-debugging-android.html ) that in order to debug an application you need to add android:debuggable="true" option inside the application tag but this application is not stupid, as soon as we want to launch the app, the app is force to close because it has an anti debugging feature on them. Thus, we cannot tap into our jdwp :(

so how do we do circumvent the anti-debugging feature inside the application ?

According to OWASP documentation "Android's 'Developer options' contain the useful "Wait for Debugger" feature, which allows you to automatically suspend an app doing startup until a JDWP debugger connects. With this feature, you can connect the debugger before the detection mechanism runs, and trace, debug, and deactivate that mechanism."

sweet !

to enable the following feature, first of all you need to install the the tampered application and go to the "developer options". Scroll down until you find an option called "select app to be debugged"

once you click the option you will be presented with a list of applications that can be debugged and our targeted will be shown in the list.

after that enable the "wait for debugger" option so the application will wait for jdwp connection like in the figure below.

Now lets set up our jdwp to tap into the application process. First we need to know what process id that the application is running, you can do this by using adb command to list all of the application id. The result may be differ when you try to run it by yourself.

~# adb shell ps

Forward the adb connection to the jdwp tools and connect it.

the "{ echo "suspend"; cat; }" is important part of this command. It is used to prevent the application to resume the application execution.

Before we proceed lets review the code from the application. There is method called "a" in the mainactivity class. This class has a callback method will terminates the app once the user taps the “OK” button. To prevent the user from simply canceling the dialog, the setCancelable method is called.

lets tamper the following method so we could exit from the prompt that will kill our application. Set breakpoint at android.app.Dialog.setCancelable. NOTE: when you do the following command the app is still in pause stage you can resume the application after you set the breakpoint

Type resume and the application will resume until it hit its breakpoint.

once you hit the breakpoint type "locals" command to show the variable that was used. there is variable called flag that used to determine whether the prompt could be cancel or not. Change the value by using the "set"  command

~# set flag = true

and resume the process again until it show the prompt and "tap" outside of the prompt box to cancel it and walaaaa you just bypass the anti-debugging. NOTE: if you get the flag value to be true when hitting a breakpoint that means you are in the wrong stop try to resume the thread until the variable of flag is set by the application to false.


Now the only thing is left is to retrieve the secret string. Do you remember that  our input is compare with the decrypted string using .equals method  ? Set a method breakpoint on java.lang.String.equals and input the string

Once the breakpoint is reached, you can read the method argument with the locals command.

so that's it hope you enjoy my post and good luck trying it :)