hacktricks/mobile-pentesting/android-app-pentesting/frida-tutorial/objection-tutorial.md

306 lines
9.9 KiB
Markdown
Raw Normal View History

2022-09-01 21:06:19 +00:00
# Objection Tutorial
2022-04-28 16:01:33 +00:00
<details>
<summary><strong>Support HackTricks and get benefits!</strong></summary>
Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
**Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.**
**Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
</details>
2022-09-01 21:06:19 +00:00
## **Introduction**
[![objection](https://github.com/sensepost/objection/raw/master/images/objection.png)](https://github.com/sensepost/objection)
**objection - Runtime Mobile Exploration**
`objection` is a runtime mobile exploration toolkit, powered by [Frida](https://www.frida.re). It was built with the aim of helping assess mobile applications and their security posture without the need for a jailbroken or rooted mobile device.
**Note:** This is not some form of jailbreak / root bypass. By using `objection`, you are still limited by all of the restrictions imposed by the applicable sandbox you are facing.
2022-09-01 21:06:19 +00:00
### Resume
The **goal** of **objection** is let the user call the **main actions that offers Frida**. **Otherwise**, the user will need to create a **single script for every application** that he wants to test.
2022-09-01 21:06:19 +00:00
## Tutorial
For this tutorial I am going to use the APK that you can download here:
{% file src="../../../.gitbook/assets/app-release.zip" %}
Or from its [original repository ](https://github.com/asvid/FridaApp)(download app-release.apk)
2022-09-01 21:06:19 +00:00
### Installation
```
pip3 install objection
```
2022-09-01 21:06:19 +00:00
### Connection
Make a **regular ADB conection** and **start** the **frida** server in the device (and check that frida is working in both the client and the server).
If you are using a **rooted device** it is needed to select the application that you want to test inside the _**--gadget**_ option. in this case:
```
objection --gadget asvid.github.io.fridaapp explore
```
2022-09-01 21:06:19 +00:00
### Basic Actions
Not all possible commands of objections are going to be listed in this tutorial, only the ones that I have found more useful.
2022-09-01 21:06:19 +00:00
#### Environment
Some interesting information (like passwords or paths) could be find inside the environment.
```
env
```
![](<../../../.gitbook/assets/image (64).png>)
2022-09-01 21:06:19 +00:00
#### Frida Information
```
frida
```
![](<../../../.gitbook/assets/image (65).png>)
2022-09-01 21:06:19 +00:00
#### Upload/Download
2021-04-12 10:24:17 +00:00
```bash
file download <remote path> [<local path>]
file upload <local path> [<remote path>]
```
2022-09-01 21:06:19 +00:00
#### Import frida script
2021-04-12 10:24:17 +00:00
```bash
import <local path frida-script>
```
2022-09-01 21:06:19 +00:00
#### SSLPinning
2021-04-12 10:24:17 +00:00
```bash
android sslpinning disable #Attempts to disable SSL Pinning on Android devices.
```
2022-09-01 21:06:19 +00:00
#### Root detection
2021-04-12 10:24:17 +00:00
```bash
android root disable #Attempts to disable root detection on Android devices.
2021-01-13 09:35:52 +00:00
android root simulate #Attempts to simulate a rooted Android environment.
```
2022-09-01 21:06:19 +00:00
#### Exec Command
2021-04-12 10:24:17 +00:00
```bash
android shell_exec whoami
```
2022-09-01 21:06:19 +00:00
#### Screenshots
2021-04-12 10:24:17 +00:00
```bash
android ui screenshot /tmp/screenshot
2021-04-12 10:24:17 +00:00
android ui FLAG_SECURE false #This may enable you to take screenshots using the hardware keys
```
2022-09-01 21:06:19 +00:00
### Static analysis made Dynamic
In a real application we should know all of the information discovered in this part before using objection thanks to **static analysis**. Anyway, this way maybe you can see **something new** as here you will only have a complete list of classes, methods and exported objects.
This is also usefull if somehow you are **unable to get some readable source code** of the app.
2022-09-01 21:06:19 +00:00
#### List activities, receivers and services
```
android hooking list activities
```
2022-09-01 22:02:18 +00:00
![](<../../../.gitbook/assets/image (78).png>)
```
android hooking list services
android hooking list receivers
```
Frida will launch an error if none is found
2022-09-01 21:06:19 +00:00
#### Getting current activity
```
android hooking get current_activity
```
2022-09-01 21:06:19 +00:00
![](<../../../.gitbook/assets/image (73) (1).png>)
2022-09-01 21:06:19 +00:00
#### Search Classes
Lets start looking for classes inside our application
```
android hooking search classes asvid.github.io.fridaapp
```
![](<../../../.gitbook/assets/image (69).png>)
2022-09-01 21:06:19 +00:00
#### Search Methods of a class
Now lets extract the methods inside the class _MainActivity:_
```
android hooking search methods asvid.github.io.fridaapp MainActivity
```
2022-09-01 21:06:19 +00:00
![](<../../../.gitbook/assets/image (70) (1).png>)
2022-09-01 21:06:19 +00:00
#### List declared Methods of a class with their parameters
Lets figure out wich parameters does the methods of the class need:
```
android hooking list class_methods asvid.github.io.fridaapp.MainActivity
```
![](<../../../.gitbook/assets/image (79).png>)
2022-09-01 21:06:19 +00:00
#### List classes
You could also list all the classes that were loaded inside the current applicatoin:
```
android hooking list classes #List all loaded classes, As the target application gets usedmore, this command will return more classes.
```
This is very useful if you want to **hook the method of a class and you only know the name of the class**. You coul use this function to **search which module owns the class** and then hook its method.
2022-09-01 21:06:19 +00:00
### Hooking being easy
2022-09-01 21:06:19 +00:00
#### Hooking (watching) a method
From the [source code](https://github.com/asvid/FridaApp/blob/master/app/src/main/java/asvid/github/io/fridaapp/MainActivity.kt) of the application we know that the **function** _**sum()**_ **from** _**MainActivity**_ is being run **every second**. Lets try to **dump all possible information** each time the function is called (arguments, return value and backtrace):
```
android hooking watch class_method asvid.github.io.fridaapp.MainActivity.sum --dump-args --dump-backtrace --dump-return
```
![](<../../../.gitbook/assets/image (71).png>)
2022-09-01 21:06:19 +00:00
#### Hooking (watching) an entire class
Actually I find all the methods of the class MainActivity really interesting, lets **hook them all**. Be careful, this could **crash** an application.
```
android hooking watch class asvid.github.io.fridaapp.MainActivity --dump-args --dump-return
```
If you play with the application while the class is hooked you will see when **each function is being called**, its **arguments** and the **return** value.
![](<../../../.gitbook/assets/image (72).png>)
2022-09-01 21:06:19 +00:00
#### Changing boolean return value of a function
From the source code you can see that the function _checkPin_ gets a _String_ as argument and returns a _boolean_. Lets make the function **always return true**:
![](<../../../.gitbook/assets/image (74).png>)
Now, If you write anything in the text box for the PIN code you will see tat anything is valid:
![](<../../../.gitbook/assets/image (77).png>)
2022-09-01 21:06:19 +00:00
### Class instances
Search for and print **live instances of a specific Java class**, specified by a fully qualified class name. Out is the result of an attempt at getting a string value for a discovered objection which would typically **contain property values for the object**.
```
android heap print_instances <class>
```
![](<../../../.gitbook/assets/image (80).png>)
2022-09-01 21:06:19 +00:00
### Keystore/Intents
You can play with the keystore and intents using:
```
android keystore list
android intents launch_activity
android intent launch_service
```
2022-09-01 21:06:19 +00:00
### Memory
2022-09-01 21:06:19 +00:00
#### Dump
2021-02-20 13:33:50 +00:00
```bash
memory dump all <local destination> #Dump all memory
memory dump from_base <base_address> <size_to_dump> <local_destination> #Dump a part
```
2022-09-01 21:06:19 +00:00
#### List
```
memory list modules
```
![](<../../../.gitbook/assets/image (66).png>)
At the bottom os the list you can see frida:
![](<../../../.gitbook/assets/image (67).png>)
Lets checks what is frida exporting:
![](<../../../.gitbook/assets/image (68).png>)
2022-09-01 21:06:19 +00:00
#### Search/Write
You can alse search and write inside memory with objection:
```
memory search "<pattern eg: 41 41 41 ?? 41>" (--string) (--offsets-only)
memory write "<address>" "<pattern eg: 41 41 41 41>" (--string)
```
2022-09-01 21:06:19 +00:00
### SQLite
You cals can use the command `sqlite` to interact with sqlite databases.
2022-09-01 21:06:19 +00:00
### Exit
```
exit
```
2022-09-01 21:06:19 +00:00
## What I miss in Objection
* The hooking methods sometimes crashes the application (this is also because of Frida).
* You can't use the instaces of the classes to call functions of the instance. And you can't create new instances of classes and use them to call functions.
* There isn't a shortcut (like the one for sslpinnin) to hook all the common crypto methods being used by the application to see cyphered text, plain text, keys, IVs and algorithms used.
2022-04-28 16:01:33 +00:00
<details>
<summary><strong>Support HackTricks and get benefits!</strong></summary>
Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
**Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.**
**Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
</details>