本文为看雪论坛优秀文章看雪论坛作者ID&＃xff1a;neilwu0x00 说明
刷Android CTF题&＃xff0c;感觉涉及的点不错&＃xff0c;分享一下做题过程。
题目&＃xff1a;
2015 RCTF / 攻防世界高手区 where
描述(提示)&＃xff1a;
Where is the flag.(The flag should include RCTF{})
hint: where is body
hint2: the KEY is visible strings, -k -nosalt
涉及的漏洞点&＃xff1a;
1、炸弹引爆
2、dex修复
0x01 漏洞简析
>>>>
1. 炸弹引爆
“炸弹引爆”&＃xff0c;先将恶意代码作为炸弹&＃xff0c;隐藏在手机设备之中&＃xff0c;然后再使用引爆器来点燃隐藏炸弹。
这道题的隐藏点是/META-INFO文件夹中&＃xff0c;关于隐藏点看如下图&＃xff1a;
详细介绍参考&＃xff1a;
https://www.blackhat.com/ldn-15/summit.html#what-can-you-do-to-an-apk-without-its-private-key-except-repacking>>>>
2. dex修复
dex修复首先要了解dex格式&＃xff1a;
header : DEX 文件头&＃xff0c;记录了一些当前文件的信息以及其他数据结构在文件中的偏移量string_ids : 字符串的偏移量type_ids : 类型信息的偏移量proto_ids : 方法声明的偏移量field_ids : 字段信息的偏移量method_ids : 方法信息(所在类&＃xff0c;方法声明以及方法名)的偏移量class_def : 类信息的偏移量data : &＃xff1a;数据区link_data : 静态链接数据区这道题重点是 header、string_ids、type_idsdex修复我的理解就是格式对应清楚就可以进行修复&＃xff0c;具体的结构可以查看Android源码。0x02 逻辑分析
>>>>
1. 查看apk
java层没有flag&＃xff0c;但是指向了assets和META-INF文件夹。
(1)assets/abc
这是dex header 大小是112&＃xff0c;dex总大小是1395184&＃xff0c;dex body大小是 1395072 &＃61; 1395184-112
基本上这道题的思路就出来了&＃xff0c;按漏洞点的思路找到隐藏的dex。
(2)META-INF/CERT.RSA
CERT.RSA的大小是很有问题的&＃xff0c;这里应该是隐藏了代码&＃xff0c;看大小应是dex body。
按照漏洞点隐藏代码应该是追加在CERT.RSA尾部&＃xff0c;CERT.RSA大小是1396394-1395072 &＃61; 1322(0x52A)。
在0x52A附近可以找到如下线索&＃xff1a;
尾部发现&＃xff1a;
KEY&＃61;Misc&＃64;inf0#fjhx11
DEX&＃61;
aes-128-cbc
根据题目的提示&＃xff0c;DEX&＃61;之后的信息应该是dex body&＃xff0c;需要是openssl进行解密获得真正的body。
openssl enc -d -aes-128-cbc -in body -out decrypted -k &＃39;Misc&＃64;inf0#fjhx11&＃39; -nosalt解密前&＃xff1a;encode_body
解密后&＃xff1a;decode_body
(3)META-INF/y
暂时看不出用处 大小是 0x93&＃xff1a;
>>>>
2.dex修复还原
(1)dex header&＃43;body
将abc和decode_body拼接之后&＃xff0c;发现文件无法进行反编译&＃xff0c;原因是dex header中string_ids、type_ids值是0。
修复前&＃xff1a;
修复后&＃xff1a;
(2)dex2jar
m3ll0t_yetFLag 不是正确的flag&＃xff1a;
/* access modifiers changed from: protected */ public void onCreate(Bundle bundle) { throw new VerifyError("bad dex opcode"); }说明onCreate方法有问题&＃xff1a;
CODE:00097390 # Source file: MainActivity.javaCODE:00097390 protected void com.example.hello.MainActivity.onCreate(CODE:00097390 android.os.Bundle savedInstanceState)CODE:00097390 this &＃61; v6CODE:00097390 savedInstanceState &＃61; v7CODE:00097390 0000 nopCODE:00097392 .prologue_endCODE:00097392 .line 15CODE:00097392 0000 nopCODE:00097394 0000 nopCODE:00097396 0000 nopCODE:00097398 .line 16CODE:00097398 0000 nopCODE:0009739A 0000 nopCODE:0009739C 0000 nopCODE:0009739E 0000 nopCODE:000973A0 0000 nopCODE:000973A2 0000 nopCODE:000973A4 .line 17CODE:000973A4 0000 nopCODE:000973A6 0000 nopCODE:000973A8 0000 nopCODE:000973AA 0000 nopCODE:000973AC 0000 nopCODE:000973AE 0000 nopCODE:000973B0 0000 nopCODE:000973B2 .local name:&＃39;strb&＃39; type:&＃39;Ljava/lang/StringBuilder;&＃39;CODE:000973B2 strb &＃61; v1CODE:000973B2 .line 18CODE:000973B2 0000 nopCODE:000973B4 0000 nopCODE:000973B6 0000 nopCODE:000973B8 0000 nopCODE:000973BA 0000 nopCODE:000973BC 0000 nopCODE:000973BE .line 19CODE:000973BE 0000 nopCODE:000973C0 0000 nopCODE:000973C2 0000 nopCODE:000973C4 0000 nopCODE:000973C6 0000 nopCODE:000973C8 0000 nopCODE:000973CA 0000 nopCODE:000973CC .line 20CODE:000973CC 0000 nopCODE:000973CE 0000 nopCODE:000973D0 0000 nopCODE:000973D2 0000 nopCODE:000973D4 0000 nopCODE:000973D6 0000 nopCODE:000973D8 0000 nopCODE:000973DA 0000 nopCODE:000973DC 0000 nopCODE:000973DE .line 21CODE:000973DE 0000 nopCODE:000973E0 0000 nopCODE:000973E2 0000 nopCODE:000973E4 0000 nopCODE:000973E6 0000 nopCODE:000973E8 0000 nopCODE:000973EA 0000 nopCODE:000973EC 0000 nopCODE:000973EE .line 22CODE:000973EE 0000 nopCODE:000973F0 0000 nopCODE:000973F2 0000 nopCODE:000973F4 0000 nopCODE:000973F6 .local name:&＃39;flag&＃39; type:&＃39;Ljava/lang/String;&＃39;CODE:000973F6 flag &＃61; v0CODE:000973F6 .line 23CODE:000973F6 0000 nopCODE:000973F8 0000 nopCODE:000973FA 0000 nopCODE:000973FC 0000 nopCODE:000973FE 0000 nopCODE:00097400 0000 nopCODE:00097402 0000 nopCODE:00097404 0000 nopCODE:00097406 0000 nopCODE:00097408 0000 nopCODE:0009740A 0000 nopCODE:0009740C 0000 nopCODE:0009740E 0000 nopCODE:00097410 0000 nopCODE:00097412 0000 nopCODE:00097414 0000 nopCODE:00097416 0000 nopCODE:00097418 0000 nopCODE:0009741A 0000 nopCODE:0009741C 0000 nopCODE:0009741E 0000 nopCODE:00097420 0000 nopCODE:00097422 .line 24CODE:00097422 0000 nopCODE:00097422 Method EndCODE:00097422 # ---------------------------------------------------------------------------
(3)修复onCreate
onCreate的大小是 0x97423 - 0x97390 &＃61; 0x93 正好和 META-INF/y大小相似&＃xff0c;将y填充到onCreate方法中。
找到0x97390在dex中的位置&＃xff1a;
将y进行填充&＃xff1a;
dex2jar之后&＃xff1a;
最后得到根据代码获取flag&＃xff1a;
public String seed &＃61; "m3ll0t_yetFLag"; /* access modifiers changed from: protected */public void onCreate(Bundle bundle) { super.onCreate(bundle); setContentView((int) R.layout.activity_main); StringBuilder sb &＃61; new StringBuilder(this.seed); sb.replace(0, 1, "h"); sb.replace(5, 6, "2"); sb.replace(10, 11, "f"); sb.replace(7, 8, "G"); Toast.makeText(this, "flag is " &＃43; sb.toString(), 0).show();}0x03 总结1、简单修复dex header
2、简单修复onCreate
3、修复过程中的文件在附件中
4、了解一个Android漏洞- End -
看雪ID&＃xff1a;neilwu
https://bbs.pediy.com/user-590753.htm
*本文由看雪论坛 neilwu 原创&＃xff0c;转载请注明来自看雪社区。
推荐文章&＃43;&＃43;&＃43;&＃43;
* 为了理解反汇编引擎而写的X86/X64反汇编引擎
* 捆绑包驱动锁首病毒分析
* **游戏逆向分析笔记
* 对宝马车载apps协议的逆向分析研究
* x86_64架构下的函数调用及栈帧原理
好书推荐
﹀﹀﹀
公众号ID&＃xff1a;ikanxue官方微博&＃xff1a;看雪安全商务合作&＃xff1a;wsc&＃64;kanxue.com
戳
京公网安备 11010802041100号