It's been a while since My last post on android security. This couple of months have been really busy with the final exam and now this is over let's do some android security challenge.
This post will talk about how to solve the "InjuredAndroid" challenge from b3nac, you can download the challenge from his official repository(https://github.com/B3nac/InjuredAndroid). Overall, I really enjoy this challenge because it's new and contains some of the really good study cases that you usually encounter when doing bug bounty or android application pentesting.
To make this less drowsy I will chop up the write up into three parts and if it's possible I will show you how to create the exploit to solve the challenge(It took me 3 days to finish all of the challenges)
Preparation & Installation:
Preparing the application is pretty straightforward the author already gives us everything including the original source code and the apk file. All you have to do is just use adb to install the application and you can use it immediately
Note: Before we go any further as you may notice that the original source code is supplied by the author so there are a lot of you who may think that we don't need to do decompilation of the apk file. This is true! But to make this more interesting and challenging I'll choose to decompile the apk file to get the source code and start the analysis there so it's more similar to a real-world situation.
Challenge 1:
In the First Challenge, we are greeted by the usual CTF style challenge we need to find the flag to pass this level. Looking at the decompiled source code(I'm using jadx-gui to do the decompilation) it is pretty straightforward to get the flag since the flag is hardcoded.
1st Flag => Flag_0n3
Challenge 2:
the second challenge demands us to invoke other activities inside the application to pass this level. To find the exported activities we need to find an activity that has android:exported="true" setting inside the AndroidManifest.xml file this means that it can be invoked by other applications inside the device.
But there is so many of them, is there any way that we can reduce the scope?
Shoruken!
we can use drozer, which is an android pentesting tool to fuzzed the android application components. Using drozer we can invoke the activity of the InjuredAndroid app
we can gather the information on how many activities that are exported and by check each one of them we can see b25lActivity is the activity that we need to invoke since inside the source code it contains the second flag
using the following command we can call the exported activity and we got the second flag
we can also achieve the same result using adb tools, like below:
if you want to go hardcore mode we can create another android application that sends intent to invoke these exported activities. I want to make this as simple as possible thus I only put simple UI on it.
2nd Flag =>S3c0nd_F1ag
Challenge 3:
challenge 3 is the same as challenge 1 we can get the flag by simply looking at the source code however it is not that easy anymore since it is "kinda" obfuscated by putting the real value at the resource file in android. It is pretty easy to trace the real value all you need to do is to find "strings.xml" file in the decompiled apk this file contain all strings that used in the application
once you find the strings.xml file all you need to is to locate the resource index like below figure:
3rd Flag => F1ag_thr33
Challenge 4:
The next challenge is also the same with the 3rd and 1st challenge but the flag was obfuscated with base64 encoding.
the encoded string of the flag is stored inside a class named Decoder and in order to retrieve the real string the program use the get method
4th Flag =>4_overdone_omelets
Challenge 5:
Unlike the previous 4 challenges, challenge 5 expects us to exploit the exported broadcast receiver. It starts when the user clicks the "FLAG FIVE" button and it will take them first to the TestBroadcastReceiver.class
the following class used to call the FlagFiveReceiver class that contains the fifth flags.
The class start by registering itself as a broadcast receiver at runtime with intent-filter "com.b3nac.injuredandroid.intent.action.CUSTOM_INTENT" then it will invoke a function named "send()" that responsible to call the FlagFiveReceiver class using the same intent-filter and put string extra along with intent that contains word "blah"
if you click the button for the first time it will show this following information that basically contains the intent that is sent to them
looking at the source code of the class the first chunk of the code is responsible for printing the previous information, if we invoke the receiver once again it will increment the "wtf" variable into two that will execute the second chunk code which print "keeps trying" and lastly if we send the receiver again for the third time it will execute the third chunk of code that will decrypt the flag for us
so what do we need to do then?
the easiest one will be for you to just normally click the "FLAG-FIVE" button three times since it will invoke the broadcast receiver automatically and you will get the flag
but this is not enough for me, we will address this further by creating a new function in the previous android application we just made in challenge 2 to invoke the challenge 5 broadcast receiver.
We don't need to worry about the permission since it is set to be true
The new function above basically just craft intent with action "com.b3nac.injuredandroid.intent.action.CUSTOM_INTENT" and set the destination to the FlagFiveReceiver class. Notice that this mechanism is pretty similar with the send() function from TestBroadcastReceiver.class
by sending the broadcast three times we got the fifth flag :)
5th Flag =>{F1v3!}
Some thoughts in challenge 5(Optional):
If you go back to the TestBroadcastReceiver.class you can observe that there is a registered broadcast and if we trace the function call we can see that this broadcast did receive an intent and use the value inside this intent to invoke webview function. Webview is basically a function in android that let you turn your application as a browser
the broadcast receiver use "ImagesContract.URL" as the index to get the string from the intent which is equivalent to "url" this value will then set to the webview to render a website
I try to create another function that will invoke this receiver.
I try to execute the following piece of code and it doesn't load the webview but rather called the receiver again that spit out the fifth flag.
hmmmmm idk where I got it wrong so I just slip this out
Okay that's all folks I hope you enjoy this blog and see you at the next part of this series
Comments
Post a Comment