OWASP crackme write up version 3 level 1 ∠( ᐛ 」∠)＿ (day 11)

This is again "another" way to crack the owasp crack me challenge, but this time i used xposed framework to bypass the function authentication.

Before using the xposed framework, you guys remember that the application has a root detection method inside the main function that will prevent us to hook into the method using xposed framework, to circumvent the check of the root detection i tamper the smali code of the application like the figure below.

as you can see i tamper three function of the root checker inside the main function. This 3 function is equivalent to this source code:

 if (c.a() || c.b() || c.c()) {
            this.a("Root detected!");
        }

repackage the application and install it to the rooted vm or rooted device. Because we already taking care of the root detection now its time to move on to the xposed framework.

This is the code i write to bypass the authentication function:

package com.example.root.hooking_owasp_level1;

import de.robv.android.xposed.IXposedHookLoadPackage;
import de.robv.android.xposed.XC_MethodHook;
import de.robv.android.xposed.XposedBridge;
import de.robv.android.xposed.callbacks.XC_LoadPackage;
import de.robv.android.xposed.callbacks.XC_LoadPackage.LoadPackageParam;
import static de.robv.android.xposed.XposedHelpers.findAndHookMethod;

public class hooking implements IXposedHookLoadPackage{
    @Override
    public void handleLoadPackage(LoadPackageParam loadPackageParam) throws Throwable {
        XposedBridge.log("loaded app:" + loadPackageParam.packageName);
        if(loadPackageParam.packageName.equals("owasp.mstg.uncrackable1")){
            XposedBridge.log("we find our apps");

            findAndHookMethod("sg.vantagepoint.uncrackable1.a", loadPackageParam.classLoader, "a",String.class, new XC_MethodHook() {
                @Override
                protected void afterHookedMethod(MethodHookParam param) throws Throwable {
                    super.afterHookedMethod(param);
                    param.setResult(true);
                    XposedBridge.log("bypass :)");
                }
            });
        }
    }
}


i already explain most of the function in my previous tutorial, right now i want to emphasize in the findAndHookMethod function. The following function will help us to hook into the specific method of application that we want to tamper. as you can see:

• The first param is the class name that we want to hook
• The second param is responsible for loading the class
• The third param is the method name that we want to tamper

now the rest of the parameter is little bit tricky if you dont pay attention. the param between the method name and new XC_MethodHook() is reponsible for taking the input of how many param on the "method we want to hook".

Example:
The "a" function inside the "sg.vantagepoint.uncrackable1.a" class of the owasp crack me challenge only have one parameter like the following source code:

public static boolean a(final String s) {
.....
}

so you need to only provide one param which is "String.class" (use the same type as the used param). If you don't provide the "String.class" the xposed cannot find the method you want to hook. (i hope is not confusing)

After we get the method, notice the "a" function return a boolean value all you need to do is set the value into "true" by using param.setResult(true)

Load the xposed module and enjoy the result :) As you can see from the below figure i input the wrong text and get the correct result.

There you go i hope you enjoy this post :)