From ba628ec5d486cbe03749e09df05e13da30fb7f80 Mon Sep 17 00:00:00 2001 From: Ajin Abraham Date: Tue, 12 Nov 2024 12:56:47 -0800 Subject: [PATCH 01/16] Added Malware lookup for Android, iOS, Windows and other binary types --- mobsf/MobSF/init.py | 12 ++-- mobsf/MobSF/utils.py | 18 ++++++ .../views/android/manifest_utils.py | 3 + .../views/common/binary/strings.py | 1 + .../views/common/shared_func.py | 4 ++ .../android_binary_analysis.html | 62 ++++++++++++++++++- .../static_analysis/ios_binary_analysis.html | 54 ++++++++++++++++ .../windows_binary_analysis.html | 56 +++++++++++++++++ pyproject.toml | 2 +- 9 files changed, 203 insertions(+), 9 deletions(-) diff --git a/mobsf/MobSF/init.py b/mobsf/MobSF/init.py index b15da72d68..92b7101d85 100644 --- a/mobsf/MobSF/init.py +++ b/mobsf/MobSF/init.py @@ -18,13 +18,13 @@ logger = logging.getLogger(__name__) -VERSION = '4.1.9' +VERSION = '4.2.0' BANNER = r""" - __ __ _ ____ _____ _ _ _ - | \/ | ___ | |__/ ___|| ___|_ _| || | / | - | |\/| |/ _ \| '_ \___ \| |_ \ \ / / || |_ | | - | | | | (_) | |_) |__) | _| \ V /|__ _|| | - |_| |_|\___/|_.__/____/|_| \_/ |_|(_)_| + __ __ _ ____ _____ _ _ ____ + | \/ | ___ | |__/ ___|| ___|_ _| || | |___ \ + | |\/| |/ _ \| '_ \___ \| |_ \ \ / / || |_ __) | + | | | | (_) | |_) |__) | _| \ V /|__ _| / __/ + |_| |_|\___/|_.__/____/|_| \_/ |_|(_)_____| """ # noqa: W291 # ASCII Font: Standard diff --git a/mobsf/MobSF/utils.py b/mobsf/MobSF/utils.py index 46ce6fbd50..fef7dab042 100755 --- a/mobsf/MobSF/utils.py +++ b/mobsf/MobSF/utils.py @@ -966,3 +966,21 @@ def run_func(result, *args, **kwargs): if result: return result[0] return None + + +def set_permissions(path): + # Convert the path to a Path object + base_path = Path(path) + perm_755 = stat.S_IRWXU | stat.S_IRGRP | stat.S_IXGRP | stat.S_IROTH | stat.S_IXOTH + perm_644 = stat.S_IRUSR | stat.S_IWUSR | stat.S_IRGRP | stat.S_IROTH + # Set permissions for directories and files + for item in base_path.rglob('*'): # Recursively go through all items + try: + if item.is_dir(): + # Set permissions for directories to 755 + item.chmod(perm_755) + elif item.is_file(): + # Set permissions for files to 644 + item.chmod(perm_644) + except Exception: + pass diff --git a/mobsf/StaticAnalyzer/views/android/manifest_utils.py b/mobsf/StaticAnalyzer/views/android/manifest_utils.py index eac3d08c64..d2fbdcc3d9 100644 --- a/mobsf/StaticAnalyzer/views/android/manifest_utils.py +++ b/mobsf/StaticAnalyzer/views/android/manifest_utils.py @@ -58,6 +58,9 @@ def get_android_manifest_androguard(apk, app_dir): """Get AndroidManifest.xml using Androguard.""" try: logger.info('Extracting AndroidManifest.xml with Androguard') + if not apk: + logger.warning('Androgaurd APK parsing failed') + return manifest = apk.get_android_manifest_axml() if not manifest: return diff --git a/mobsf/StaticAnalyzer/views/common/binary/strings.py b/mobsf/StaticAnalyzer/views/common/binary/strings.py index 13ad86e79d..c1d1694f34 100644 --- a/mobsf/StaticAnalyzer/views/common/binary/strings.py +++ b/mobsf/StaticAnalyzer/views/common/binary/strings.py @@ -34,3 +34,4 @@ def strings_on_binary(bin_path): return list(set(strings_util(bin_path))) except Exception: logger.exception('Extracting strings from binary') + return [] diff --git a/mobsf/StaticAnalyzer/views/common/shared_func.py b/mobsf/StaticAnalyzer/views/common/shared_func.py index 13b6d30fbf..a80e7b2500 100755 --- a/mobsf/StaticAnalyzer/views/common/shared_func.py +++ b/mobsf/StaticAnalyzer/views/common/shared_func.py @@ -30,6 +30,7 @@ is_path_traversal, is_safe_path, print_n_send_error_response, + set_permissions, ) from mobsf.MobSF.views.scanning import ( add_to_recent_scan, @@ -108,6 +109,9 @@ def unzip(checksum, app_path, ext_path): unzip_b = shutil.which('unzip') subprocess.call( [unzip_b, '-o', '-q', app_path, '-d', ext_path]) + # Set permissions, packed files + # may not have proper permissions + set_permissions(ext_path) dat = subprocess.check_output([unzip_b, '-qq', '-l', app_path]) dat = dat.decode('utf-8').split('\n') files_det = ['Length Date Time Name'] diff --git a/mobsf/templates/static_analysis/android_binary_analysis.html b/mobsf/templates/static_analysis/android_binary_analysis.html index 5f8def15bc..c5133f86e5 100755 --- a/mobsf/templates/static_analysis/android_binary_analysis.html +++ b/mobsf/templates/static_analysis/android_binary_analysis.html @@ -184,6 +184,12 @@