Internal Network Pentest and IR Reference: android applications

# Android Application

## Lab

* [payatu/diva-android](https://github.com/payatu/diva-android) - Damn Insecure and vulnerable App for Android
* [HTB VIP - Pinned](https://app.hackthebox.com/challenges/282) - Hack The Box challenge
* [HTB VIP - Manager](https://app.hackthebox.com/challenges/283) - Hack The Box challenge

## Extract APK

### ADB Method

Connect to ADB shell and list/download packages.
You might need to enable `Developer mode` and `Debugging` in order to connect with `adb`

```powershell
adb shell pm list packages
adb shell pm path com.example.someapp
adb pull /data/app/com.example.someapp-2.apk
```

### Stores

Warning: Downloading APK files from unofficial stores can compromise your device's security. These sources often host malware and malicious software. Always use trusted and official app stores for downloads.

* [Google Play](https://play.google.com/store/apps) - Official Store
* [Apkpure.fr](https://apkpure.fr/fr/) - Alternative to Google Play
* [Apkpure.co](https://apkpure.co) - Alternative to Google Play
* [Aptoide](https://fr.aptoide.com/) - Alternative to Google Play
* [Aurora Store](https://f-droid.org/fr/packages/com.aurora.store/) - Alternative to Google Play

Download APK from Google Play using a 3rd Party:

* [apkcombo.com](https://apkcombo.com/downloader/)
* [apps.evozi.com](https://apps.evozi.com/apk-downloader/)

## Static Analysis

### Extract Contents From APK

Search for strings `flag`,`secret`, the default string file is `Resources/resources.arsc/res/values/strings.xml`.

```powershell
apktool d application.apk
```

### Decompile Data as Java Code

* Rename `application.apk` to `application.zip`: `mv application.apk application.zip`
* Extract `classes.dex`: `unzip application.zip`
* Use `dex2jar` to obtain a jar file: `/usr/bin/d2j-dex2jar classes.dex`
* Use `jadx` using full CPU: `jadx classes.dex -j $(grep -c ^processor /proc/cpuinfo) -d Downloads/app/ > /dev/null`

    ```powershell
    jadx-gui
    --deobf # remove obfuscation by AndroGuard
    -e      # generate a gradle project for Android Studio (easy to find function)
    ```

To reverse `.odex` you need to provide the `/system/framework/arm`, fortunately since we have the firmware we have it.

```powershell
java -jar baksmali-2.3.4.jar x application.odex -d k107-mb-8.1/system/framework/arm -o application
apktool d application.apk 
apktool b rebuild_folder -o rebuilt.apk
```

### Decompile Native Code

Native library are represented as `.so` files.
These libraries by default are included in the APK at the file path `/lib/<cpu>/lib<name>.so` or `/assets/<custom_name>`.

Use `IDA`, `Radare2/Cutter` or `Ghidra` to reverse them.

| CPU Native         | Library Path                |
|----------------------|-----------------------------|
| "generic" 32-bit ARM | lib/armeabi/libcalc.so      |
| x86                  | lib/x86/libcalc.so          |
| x64                  | lib/x86_64/libcalc.so       |
| ARMv7                | lib/armeabi-v7a/libcalc.so  |
| ARM64                | lib/arm64-v8a/libcalc.so    |

:warning: The shared object file (`.so`) doesn't need to be embedded in the app.

### Sign and Package APK

* `apktool` + `jarsigner`

    ```powershell
    apktool b ./application.apk
    keytool -genkey -v -keystore application.keystore -alias application -keyalg RSA -keysize 2048 -validity 10000
    jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 -keystore application.keystore application.apk application
    zipalign -v 4 application.apk application-signed.apk
    ```

* `apktool` + `signapk`

    ```powershell
    apktool b app-release
    ./signapk app-release/dist/app-release.apk
    ```

* [patrickfav/uber-apk-signer](https://github.com/patrickfav/uber-apk-signer) (Linux only)

    ```powershell
    java -jar uber-apk-signer.jar --apks /path/to/apks
    ```

* [APK Toolkit v1.3](https://xdaforums.com/t/tool-apk-toolkit-v1-3-windows.4572881/) (Windows only)

### Mobile Security Framework Static

> Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.

* [MobSF - Documentation](https://mobsf.github.io/docs/#/)
* [MobSF - Github](https://github.com/MobSF/Mobile-Security-Framework-MobSF)
* [MobSF - Live Demo](https://mobsf.live/)

Run [MobSF/Mobile-Security-Framework-MobSF](https://github.com/MobSF/Mobile-Security-Framework-MobSF)

* Latest version from DockerHub

    ```powershell
    docker run -it --name mobsf -p 8000:8000 opensecurity/mobile-security-framework-mobsf:latest
    ```

* Enable persistence on the Docker container

    ```powershell
    docker run -it --rm --name mobsf -p 8000:8000 -v <your_local_dir>:/root/.MobSF opensecurity/mobile-security-framework-mobsf:latest
    ```

### Online Assets

:warning: Uploading APKs to uncontrolled websites risks data leaks, malware, intellectual property theft, and privacy violations. Use trusted platforms only to ensure the security and integrity of your app.

* [appetize.io](https://appetize.io/) - Instantly run mobile apps in your browser
* [mobsf.live](https://mobsf.live/) - Demo version of MobSF
* [hybrid-analysis.com](https://www.hybrid-analysis.com/sample/573df0b1cb5ffc0a25306be5ec83483ed1b2acdba37dd93223b9f14f42b2fdea?environmentId=200) - Sandbox analysis of APK files

### React Native and Hermes

Identify React Native app with `index.android.bundle` inside the `assets` folder

```ps1
Hermes: pip install hbctool
╰─$ hbctool disasm index.android.bundle indexasm
[*] Disassemble 'index.android.bundle' to 'indexasm' path
[*] Hermes Bytecode [ Source Hash: 4013cb75f7e16d4474f5cf258edc45ee16585560, HBC Version: 74 ]
[*] Done
```

### Flutter

Indentify Flutter use in the `MANIFEST.MF` and search for `libflutter.so`.

* [worawit/blutter](https://github.com/worawit/blutter) - Flutter Mobile Application Reverse Engineering Tool

    ```ps1
    blutter jadx/resources/lib/arm64-v8a/ ./blutter_output
    ```

## Dynamic Analysis

Dynamic analysis for Android malware involves executing and monitoring an app in a controlled environment to observe its behavior. This technique detects malicious activities like data exfiltration, unauthorized access, and system modifications. Additionally, it aids in reverse engineering app features, revealing hidden functionalities and potential vulnerabilities for better threat mitigation.

### Burp Suite

* Proxy > Listen to all interfaces
* Import/Export CA certificate
* `adb push burp.der /sdcard/burp.crt`
* Open the Settings on the device and search "Install Cert"
* Click Install certificates from SD card
* Configure the AVD to use the proxy

```ps1
# Convert Burp certificate for Android
openssl x509 -inform DER -in burp.der -out burp.pem
openssl x509 -inform PEM -subject_hash_old -in burp.pem |head -1
mv burp.pem <hash output>.0

# Push the certificate in the AVD
emulator -list-avds
emulator -avd Pentesting_Device -writab