Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

4.2.0 #2450

Merged
merged 16 commits into from
Nov 18, 2024
Merged

4.2.0 #2450

Show file tree
Hide file tree
Changes from 7 commits
Commits
Show all changes
16 commits
Select commit Hold shift + click to select a range
ba628ec
Added Malware lookup for Android, iOS, Windows and other binary types
ajinabraham Nov 12, 2024
8d3e91a
QA
ajinabraham Nov 12, 2024
0e0040e
File download with sanitized file name
ajinabraham Nov 12, 2024
eb64e83
Split APK and ZIP logic to apk.py
ajinabraham Nov 12, 2024
f36ae46
Optimize apk and src analysis
ajinabraham Nov 13, 2024
d932575
Pathlib optimizations
ajinabraham Nov 13, 2024
e3ce0cf
fix untar permission errors, update ssl pinning scripts, add intent t…
ajinabraham Nov 14, 2024
0753b6f
Add support for async scan with djangoq2, improved frida scripts, new…
ajinabraham Nov 17, 2024
1eee28e
Fix save_ctx for a and dylib
ajinabraham Nov 17, 2024
e228def
Update codeql
ajinabraham Nov 17, 2024
5ff1ec5
suppress noisey rule
ajinabraham Nov 17, 2024
06bc2b4
1G for nginx
ajinabraham Nov 17, 2024
fa4e603
Queue improvements + webview frida scripts
ajinabraham Nov 18, 2024
41f770a
Code QA
ajinabraham Nov 18, 2024
5059941
Code QA
ajinabraham Nov 18, 2024
fbeb8a2
Final QA
ajinabraham Nov 18, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
77 changes: 73 additions & 4 deletions mobsf/DynamicAnalyzer/tools/frida_scripts/android/default/ssl_pinning_bypass.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -241,15 +241,84 @@ Java.perform(function() {
} catch (err) {
send('[SSL Pinning Bypass] Cronet not found');
}
/* Certificate Transparency Bypass
Ajin Abraham - opensecurity.in */
try{
/* Boye AbstractVerifier */
try {
Java.use("ch.boye.httpclientandroidlib.conn.ssl.AbstractVerifier").verify.implementation = function(host, ssl) {
send("[SSL Pinning Bypass] Bypassing Boye AbstractVerifier" + host);
};
} catch (err) {
send("[SSL Pinning Bypass] Boye AbstractVerifier not found");
}
/* Appmattus */
try {
/* Certificate Transparency Bypass Ajin Abraham - opensecurity.in */
Java.use('com.babylon.certificatetransparency.CTInterceptorBuilder').includeHost.overload('java.lang.String').implementation = function(host) {
send('[SSL Pinning Bypass] Bypassing Certificate Transparency check');
return this.includeHost('nonexistent.domain');
};
} catch (err) {
send('[SSL Pinning Bypass] babylon certificatetransparency.CTInterceptorBuilder not found');
}
try {
Java.use("com.appmattus.certificatetransparency.internal.verifier.CertificateTransparencyInterceptor")["intercept"].implementation = function(a) {
send("[SSL Pinning Bypass] Appmattus Certificate Transparency");
return a.proceed(a.request());
};
} catch (err) {
send("[SSL Pinning Bypass] Appmattus CertificateTransparencyInterceptor not found");
}
try{
bypassOkHttp3CertificateTransparency();
} catch (err) {
send('[SSL Pinning Bypass] certificatetransparency.CTInterceptorBuilder not found');
}

}, 0);


function bypassOkHttp3CertificateTransparency() {
// https://gist.github.com/m-rey/f2a235123908ca42395b6d3c5fe1128e
Java.perform(function () {
var CertificateTransparencyInterceptor = Java.use('com.appmattus.certificatetransparency.internal.verifier.CertificateTransparencyInterceptor');
var OkHttpClientBuilder = Java.use('okhttp3.OkHttpClient$Builder');

CertificateTransparencyInterceptor.intercept.implementation = function (chain) {
var request = chain.request();
var url = request.url();
var host = url.host();

// Dynamically access the VerificationResult classes
var VerificationResult = Java.use('com.appmattus.certificatetransparency.VerificationResult');
var VerificationResultSuccessInsecureConnection = Java.use('com.appmattus.certificatetransparency.VerificationResult$Success$InsecureConnection');
var VerificationResultFailureNoCertificates = Java.use('com.appmattus.certificatetransparency.VerificationResult$Failure$NoCertificates');

// Create instances of the desired VerificationResult classes
var success = VerificationResultSuccessInsecureConnection.$new(host);
var failureNoCertificates = VerificationResultFailureNoCertificates.$new();

// Bypass certificate transparency verification
var certs = chain.connection().handshake().peerCertificates();
if (certs.length === 0) {
send('[SSL Pinning Bypass] Certificate transparency bypassed.');
return failureNoCertificates;
}

try {
// Proceed with the original request
return chain.proceed(request);
} catch (e) {
// Catch SSLPeerUnverifiedException and return intercepted response
if (e.toString().includes('SSLPeerUnverifiedException')) {
send('[SSL Pinning Bypass] Certificate transparency failed.');
return failureNoCertificates;
}
throw e;
}
};

OkHttpClientBuilder.build.implementation = function () {
// Intercept the OkHttpClient creation
var client = this.build();
return client;
};
});
}
20 changes: 20 additions & 0 deletions mobsf/DynamicAnalyzer/tools/frida_scripts/android/others/detect-ssl-pinning.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
try {
var UnverifiedCertError = Java.use('javax.net.ssl.SSLPeerUnverifiedException');
UnverifiedCertError.$init.implementation = function(str) {
send('Unexpected SSLPeerUnverifiedException occurred');
try {
var stackTrace = Java.use('java.lang.Thread').currentThread().getStackTrace();
var exceptionStackIndex = stackTrace.findIndex(stack => stack.getClassName() === "javax.net.ssl.SSLPeerUnverifiedException");
var callingFunctionStack = stackTrace[exceptionStackIndex + 1];
var className = callingFunctionStack.getClassName();
var methodName = callingFunctionStack.getMethodName();
var callingClass = Java.use(className);
var callingMethod = callingClass[methodName];
send('SSL exception caused: ' + className + '.' + methodName + '. Patch this method to bypass pinning.');
if (callingMethod.implementation) {
return;
}
} catch (e) {}
return this.$init(str);
};
} catch (err) {}
110 changes: 91 additions & 19 deletions mobsf/DynamicAnalyzer/tools/frida_scripts/android/others/dump-intent.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,21 +1,93 @@
// https://gist.github.com/bet4it/b62ac2d5bd45b8cb699905fa498baf5e
Java.perform(function () {
var act = Java.use("android.app.Activity");
act.getIntent.overload().implementation = function () {
var intent = this.getIntent()
var cp = intent.getComponent()
send("[Intent Dumper] Starting " + cp.getPackageName() + "/" + cp.getClassName())
var ext = intent.getExtras();
if (ext) {
var keys = ext.keySet()
var iterator = keys.iterator()
while (iterator.hasNext()) {
var k = iterator.next().toString()
var v = ext.get(k)
send("\t" + v.getClass().getName())
send("\t" + k + ' : ' + v.toString())
}
var Activity = Java.use("android.app.Activity");

Activity.getIntent.overload().implementation = function () {
var intent = this.getIntent();
var component = intent.getComponent();

send("[Intent Dumper] Captured Intent for Activity:");

// Component (target package and class)
if (component) {
send(" Component:");
send(" Package: " + component.getPackageName());
send(" Class: " + component.getClassName());
} else {
send(" Component: None");
}
return intent;
};
})

// Action
var action = intent.getAction();
send(" Action: " + (action ? action : "None"));

// Data URI
var dataUri = intent.getDataString();
send(" Data URI: " + (dataUri ? dataUri : "None"));

// Flags
var flags = intent.getFlags();
send(" Flags: " + flags);

// Dumping extras in the Intent
var extras = intent.getExtras();
if (extras) {
send(" Extras:");
var iterator = extras.keySet().iterator();
while (iterator.hasNext()) {
var key = iterator.next();
var value = extras.get(key);
if (value !== null) {
send(" " + key + " (" + value.getClass().getName() + "): " + valueToString(value));
}
}
} else {
send(" Extras: None");
}

return intent;
};

// Helper function to convert intent extras to a readable string
function valueToString(value) {
var valueType = value.getClass().getName();

if (valueType === "android.os.Bundle") {
return bundleToString(Java.cast(value, Java.use("android.os.Bundle")));
} else if (valueType === "java.lang.String") {
return '"' + value + '"';
} else if (valueType === "java.lang.Integer" || valueType === "java.lang.Float" || valueType === "java.lang.Boolean") {
return value.toString();
} else if (valueType === "java.util.ArrayList") {
return arrayListToString(Java.cast(value, Java.use("java.util.ArrayList")));
} else {
send("Unsupported extra type for key. Type: " + valueType);
return value.toString();
}
}

// Function to handle nested Bundles
function bundleToString(bundle) {
var result = "{";
var iterator = bundle.keySet().iterator();
while (iterator.hasNext()) {
var key = iterator.next();
var value = bundle.get(key);
result += key + ": " + (value !== null ? valueToString(value) : "null") + ", ";
}
result = result.slice(0, -2); // Remove trailing comma and space
result += "}";
return result;
}

// Function to handle ArrayLists (if any)
function arrayListToString(arrayList) {
var result = "[";
for (var i = 0; i < arrayList.size(); i++) {
var item = arrayList.get(i);
result += valueToString(item) + ", ";
}
result = result.slice(0, -2); // Remove trailing comma and space
result += "]";
return result;
}
});
125 changes: 63 additions & 62 deletions mobsf/DynamicAnalyzer/tools/frida_scripts/android/others/ssl-pinning-bypass.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -720,69 +720,70 @@ function dynamicPatching() {
return null;
}
}
try {
var UnverifiedCertError = Java.use('javax.net.ssl.SSLPeerUnverifiedException');
UnverifiedCertError.$init.implementation = function(str) {
console.log('[!] Unexpected SSLPeerUnverifiedException occurred, trying to patch it dynamically...!');
try {
var stackTrace = Java.use('java.lang.Thread').currentThread().getStackTrace();
var exceptionStackIndex = stackTrace.findIndex(stack => stack.getClassName() === "javax.net.ssl.SSLPeerUnverifiedException");
var callingFunctionStack = stackTrace[exceptionStackIndex + 1];
var className = callingFunctionStack.getClassName();
var methodName = callingFunctionStack.getMethodName();
var callingClass = Java.use(className);
var callingMethod = callingClass[methodName];
console.log('[!] Attempting to bypass uncommon SSL Pinning method on: ' + className + '.' + methodName + '!');
if (callingMethod.implementation) {
return;
}
var returnTypeName = callingMethod.returnType.type;
callingMethod.implementation = function() {
rudimentaryFix(returnTypeName);
};
} catch (e) {
if (String(e).includes(".overload")) {
var splittedList = String(e).split(".overload");
for (let i = 2; i < splittedList.length; i++) {
var extractedOverload = splittedList[i].trim().split("(")[1].slice(0, -1).replaceAll("'", "");
if (extractedOverload.includes(",")) {
var argList = extractedOverload.split(", ");
console.log('[!] Attempting overload of ' + className + '.' + methodName + ' with arguments: ' + extractedOverload + '!');
if (argList.length == 2) {
callingMethod.overload(argList[0], argList[1]).implementation = function(a, b) {
rudimentaryFix(returnTypeName);
}
} else if (argNum == 3) {
callingMethod.overload(argList[0], argList[1], argList[2]).implementation = function(a, b, c) {
rudimentaryFix(returnTypeName);
}
} else if (argNum == 4) {
callingMethod.overload(argList[0], argList[1], argList[2], argList[3]).implementation = function(a, b, c, d) {
rudimentaryFix(returnTypeName);
}
} else if (argNum == 5) {
callingMethod.overload(argList[0], argList[1], argList[2], argList[3], argList[4]).implementation = function(a, b, c, d, e) {
rudimentaryFix(returnTypeName);
}
} else if (argNum == 6) {
callingMethod.overload(argList[0], argList[1], argList[2], argList[3], argList[4], argList[5]).implementation = function(a, b, c, d, e, f) {
rudimentaryFix(returnTypeName);
}
}
} else {
callingMethod.overload(extractedOverload).implementation = function(a) {
rudimentaryFix(returnTypeName);
}
}
}
} else {
console.log('[-] Failed to dynamically patch SSLPeerUnverifiedException ' + e + '!');
}
}
return this.$init(str);
};
} catch (err) {}
// try {
// var UnverifiedCertError = Java.use('javax.net.ssl.SSLPeerUnverifiedException');
// UnverifiedCertError.$init.implementation = function(str) {
// console.log('[!] Unexpected SSLPeerUnverifiedException occurred, trying to patch it dynamically...!');
// try {
// var stackTrace = Java.use('java.lang.Thread').currentThread().getStackTrace();
// var exceptionStackIndex = stackTrace.findIndex(stack => stack.getClassName() === "javax.net.ssl.SSLPeerUnverifiedException");
// var callingFunctionStack = stackTrace[exceptionStackIndex + 1];
// var className = callingFunctionStack.getClassName();
// var methodName = callingFunctionStack.getMethodName();
// var callingClass = Java.use(className);
// var callingMethod = callingClass[methodName];
// console.log('[!] Attempting to bypass uncommon SSL Pinning method on: ' + className + '.' + methodName + '!');
// if (callingMethod.implementation) {
// return;
// }
// var returnTypeName = callingMethod.returnType.type;
// callingMethod.implementation = function() {
// rudimentaryFix(returnTypeName);
// };
// } catch (e) {
// if (String(e).includes(".overload")) {
// var splittedList = String(e).split(".overload");
// for (let i = 2; i < splittedList.length; i++) {
// var extractedOverload = splittedList[i].trim().split("(")[1].slice(0, -1).replaceAll("'", "");
// if (extractedOverload.includes(",")) {
// var argList = extractedOverload.split(", ");
// console.log('[!] Attempting overload of ' + className + '.' + methodName + ' with arguments: ' + extractedOverload + '!');
// if (argList.length == 2) {
// callingMethod.overload(argList[0], argList[1]).implementation = function(a, b) {
// rudimentaryFix(returnTypeName);
// }
// } else if (argNum == 3) {
// callingMethod.overload(argList[0], argList[1], argList[2]).implementation = function(a, b, c) {
// rudimentaryFix(returnTypeName);
// }
// } else if (argNum == 4) {
// callingMethod.overload(argList[0], argList[1], argList[2], argList[3]).implementation = function(a, b, c, d) {
// rudimentaryFix(returnTypeName);
// }
// } else if (argNum == 5) {
// callingMethod.overload(argList[0], argList[1], argList[2], argList[3], argList[4]).implementation = function(a, b, c, d, e) {
// rudimentaryFix(returnTypeName);
// }
// } else if (argNum == 6) {
// callingMethod.overload(argList[0], argList[1], argList[2], argList[3], argList[4], argList[5]).implementation = function(a, b, c, d, e, f) {
// rudimentaryFix(returnTypeName);
// }
// }
// } else {
// callingMethod.overload(extractedOverload).implementation = function(a) {
// rudimentaryFix(returnTypeName);
// }
// }
// }
// } else {
// console.log('[-] Failed to dynamically patch SSLPeerUnverifiedException ' + e + '!');
// }
// }
// return this.$init(str);
// };
// } catch (err) {}
}

setTimeout(function() {
Java.perform(function() {
var X509TrustManager = Java.use('javax.net.ssl.X509TrustManager');
Expand Down
Loading
Loading