Mirrors/hacktricks
2
0
Fork 0
mirror of https://github.com/carlospolop/hacktricks synced 2024-11-23 05:03:35 +00:00
Code Issues Projects Releases Packages Wiki Activity
hacktricks/mobile-pentesting/android-app-pentesting/frida-tutorial/frida-tutorial-2.md

9.9 KiB
Raw Blame History

Frida Tutoriaal 2

Leer AWS hakwerk vanaf nul tot held met htARTE (HackTricks AWS Red Team Expert)!

Bugsbounty wenk: teken aan vir Intigriti, 'n premium bugsbounty platform geskep deur hackers, vir hackers! Sluit by ons aan by https://go.intigriti.com/hacktricks vandag, en begin om belonings te verdien tot $100,000!

{% embed url="https://go.intigriti.com/hacktricks" %}

Dit is 'n opsomming van die pos: https://11x256.github.io/Frida-hooking-android-part-2/ (Dele 2, 3 & 4)
APKs en Bronkode: https://github.com/11x256/frida-android-examples

Deel 1 is so maklik.

Sommige dele van die oorspronklike kode werk nie en is hier gewysig.

Deel 2

Hier kan jy 'n voorbeeld sien van hoe om 2 funksies met dieselfde naam maar verskillende parameters te hook.
Verder gaan jy leer hoe om 'n funksie te roep met jou eie parameters.
En laastens, is daar 'n voorbeeld van hoe om 'n instansie van 'n klas te vind en dit 'n funksie te laat roep.

//s2.js
console.log("Script loaded successfully ");
Java.perform(function x() {
console.log("Inside java perform function");
var my_class = Java.use("com.example.a11x256.frida_test.my_activity");
//Hook "fun" with parameters (int, int)
my_class.fun.overload("int", "int").implementation = function (x, y) { //hooking the old function
console.log("original call: fun(" + x + ", " + y + ")");
var ret_value = this.fun(2, 5);
return ret_value;
};
//Hook "fun" with paramater(String)
var string_class = Java.use("java.lang.String");
my_class.fun.overload("java.lang.String").implementation = function (x) { //hooking the new function
console.log("*")
//Create a new String and call the function with your input.
var my_string = string_class.$new("My TeSt String#####");
console.log("Original arg: " + x);
var ret = this.fun(my_string);
console.log("Return value: " + ret);
console.log("*")
return ret;
};
//Find an instance of the class and call "secret" function.
Java.choose("com.example.a11x256.frida_test.my_activity", {
onMatch: function (instance) {
console.log(tring, and the it has"Found instance: " + instance);
console.log("Result of secret func: " + instance.secret());
},
onComplete: function () { }
});
});

Jy kan sien dat om 'n String te skep, dit eers die klas java.lang.String verwys het en toe 'n $new voorwerp van daardie klas met 'n String as inhoud geskep het. Dit is die korrekte manier om 'n nuwe voorwerp van 'n klas te skep. Maar, in hierdie geval, kon jy net enige String deurgee aan this.fun() soos: this.fun("hey there!")

Python

//loader.py
import frida
import time

device = frida.get_usb_device()
pid = device.spawn(["com.example.a11x256.frida_test"])
device.resume(pid)
time.sleep(1) #Without it Java.perform silently fails
session = device.attach(pid)
script = session.create_script(open("s2.js").read())
script.load()

#prevent the python script from terminating
raw_input()

python loader.py

Deel 3

Python

Nou gaan jy sien hoe om bevele na die gehookte program te stuur via Python om 'n funksie te roep:

//loader.py
import time
import frida

def my_message_handler(message, payload):
print message
print payload


device = frida.get_usb_device()
pid = device.spawn(["com.example.a11x256.frida_test"])
device.resume(pid)
time.sleep(1)  # Without it Java.perform silently fails
session = device.attach(pid)
with open("s3.js") as f:
script = session.create_script(f.read())
script.on("message", my_message_handler)
script.load()

command = ""
while 1 == 1:
command = raw_input("Enter command:\n1: Exit\n2: Call secret function\n3: Hook Secret\nchoice:")
if command == "1":
break
elif command == "2":
script.exports.callsecretfunction()
elif command == "3":
script.exports.hooksecretfunction()

Die bevel "1" sal afsluit, die bevel "2" sal 'n instansie van die klas vind en die private funksie secret() aanroep en die bevel "3" sal die funksie secret() hook sodat dit 'n verskillende string teruggee.

Dan, as jy "2" aanroep, sal jy die werklike geheim kry, maar as jy "3" en dan "2" aanroep, sal jy die vals geheim kry.

JS

console.log("Script loaded successfully ");
var instances_array = [];
function callSecretFun() {
Java.perform(function () {
if (instances_array.length == 0) { // if array is empty
Java.choose("com.example.a11x256.frida_test.my_activity", {
onMatch: function (instance) {
console.log("Found instance: " + instance);
instances_array.push(instance)
console.log("Result of secret func: " + instance.secret());
},
onComplete: function () { }

});
}
else {//else if the array has some values
console.log("Result of secret func: " + instances_array[0].secret());
}

});
}

function hookSecret() {
Java.perform(function () {
var my_class = Java.use("com.example.a11x256.frida_test.my_activity");
var string_class = Java.use("java.lang.String");
my_class.secret.overload().implementation = function(){
var my_string = string_class.$new("TE ENGANNNNEEE");
return my_string;
}
});
}
rpc.exports = {
callsecretfunction: callSecretFun,
hooksecretfunction: hookSecret
};

Deel 4

Hier sal jy sien hoe om Python en JS te laat interakteer deur JSON-voorwerpe te gebruik. JS gebruik die send()-funksie om data na die Python-klient te stuur, en Python gebruik post()-funksies om data na die JS-skrip te stuur. Die JS sal die uitvoering blokkeer totdat dit 'n respons van Python ontvang.

Python

//loader.py
import time
import frida

def my_message_handler(message, payload):
print message
print payload
if message["type"] == "send":
print message["payload"]
data = message["payload"].split(":")[1].strip()
print 'message:', message
data = data.decode("base64")
user, pw = data.split(":")
data = ("admin" + ":" + pw).encode("base64")
print "encoded data:", data
script.post({"my_data": data})  # send JSON object
print "Modified data sent"


device = frida.get_usb_device()
pid = device.spawn(["com.example.a11x256.frida_test"])
device.resume(pid)
time.sleep(1)
session = device.attach(pid)
with open("s4.js") as f:
script = session.create_script(f.read())
script.on("message", my_message_handler)  # register the message handler
script.load()
raw_input()

JS

console.log("Script loaded successfully ");
Java.perform(function () {
var tv_class = Java.use("android.widget.TextView");
tv_class.setText.overload('java.lang.CharSequence').implementation = function (x) {
var string_to_send = x.toString();
var string_to_recv = "";
send(string_to_send); // send data to python code
recv(function (received_json_object) {
string_to_recv = received_json_object.my_data;
}).wait(); //block execution till the message is received
console.log("Final string_to_recv: "+ string_to_recv)
return this.setText(string_to_recv);
}
});

Daar is 'n deel 5 wat ek nie gaan verduidelik nie omdat daar niks nuuts is nie. Maar as jy wil lees, is dit hier: https://11x256.github.io/Frida-hooking-android-part-5/

Bug bounty wenk: teken aan vir Intigriti, 'n premium bug bounty platform geskep deur hackers, vir hackers! Sluit by ons aan by https://go.intigriti.com/hacktricks vandag, en begin om belonings te verdien tot $100,000!

{% embed url="https://go.intigriti.com/hacktricks" %}

Leer AWS hak van nul tot held met htARTE (HackTricks AWS Red Team Expert)!