攻防世界mobile新手区之app2 write up
0x00拖进模拟器查看：
0x01上dex2jar：
查看MainActivity.class:
package com.tencent.testvuln;
import android.annotation.SuppressLint;
import android.app.Activity;
import android.content.Context;
import android.content.Intent;
import android.content.SharedPreferences;
import android.os.Bundle;
import android.os.Handler;
import android.util.Log;
import android.view.Menu;
import android.view.MenuItem;
import android.view.View;
import android.widget.Button;
import android.widget.EditText;
import android.widget.Toast;
import com.tencent.testvuln.c.SignatureTool;
@SuppressLint({"ShowToast"})
public class MainActivity extends Activity implements View.OnClickListener {
private Button a;
private Handler b = null;
private EditText c;
private EditText d;
public void onClick(View paramView) {
switch (paramView.getId()) {
default:
return;
case 2131165187:
break;
}
if (this.c.getText().length() == 0 || this.d.getText().length() == 0) {
Toast.makeText((Context)this, ", 1).show();
return;
}
String str1 = this.c.getText().toString();
String str2 = this.d.getText().toString();
Log.e("test", str1 + " test2 = " + str2);
Intent intent = new Intent((Context)this, SecondActivity.class);
intent.putExtra("ili", str1);
intent.putExtra("lil", str2);
startActivity(intent);
}
protected void onCreate(Bundle paramBundle) {
super.onCreate(paramBundle);
setContentView(2130903040);
this.a = (Button)findViewById(2131165187);
this.a.setOnClickListener(this);
this.c = (EditText)findViewById(2131165185);
this.d = (EditText)findViewById(2131165186);
SharedPreferences.Editor editor = getSharedPreferences("test", 0).edit();
editor.putLong("ili", System.currentTimeMillis());
editor.commit();
Log.d("hashcode", SignatureTool.getSignature((Context)this) + "");
}
public boolean onCreateOptionsMenu(Menu paramMenu) {
getMenuInflater().inflate(2131099648, paramMenu);
return true;
}
public boolean onOptionsItemSelected(MenuItem paramMenuItem) { return (paramMenuItem.getItemId() == 2131165188) ? true : super.onOptionsItemSelected(paramMenuItem); }
}
我们查看onclick方法：
public void onClick(View paramView) {
switch (paramView.getId()) {
default:
return;
case 2131165187:
break;
}
//c和d分别是两个输入框
//获取两个输入框的内容后做是否为空校验
if (this.c.getText().length() == 0 || this.d.getText().length() == 0) {
Toast.makeText((Context)this, ", 1).show();
return;
}
String str1 = this.c.getText().toString();
String str2 = this.d.getText().toString();
Log.e("test", str1 + " test2 = " + str2);
//空校验通过，通过startActivity()启动一个新的activity:SecondActivity
Intent intent = new Intent((Context)this, SecondActivity.class);
intent.putExtra("ili", str1);
intent.putExtra("lil", str2);
startActivity(intent);
}一波分析之后我们查看SecondActivity.class:,同时注意，SecondActivity初始化之后带入两个参数ili和lli,ili是变量c,lli是d。
package com.tencent.testvuln;
import android.content.BroadcastReceiver;
import android.content.Context;
import android.content.Intent;
import android.content.SharedPreferences;
import android.os.Bundle;
import android.view.Menu;
import android.view.MenuItem;
import android.widget.Toast;
import com.tencent.testvuln.c.Encryto;
public class SecondActivity extends a {
private BroadcastReceiver c = new BroadcastReceiver(this) {
public void onReceive(Context param1Context, Intent param1Intent) {
Toast.makeText(param1Context, "myReceiver receive", 0).show();
String str = param1Intent.getAction();
if (param1Context.getPackageName().equals(str));
}
};
protected void onCreate(Bundle paramBundle) {
super.onCreate(paramBundle);
setContentView(2130903041);
Intent intent = getIntent();
String str1 = intent.getStringExtra("ili");
String str2 = intent.getStringExtra("lil");
if (Encryto.doRawData(this, str1 + str2).equals("VEIzd/V2UPYNdn/bxH3Xig==")) {
intent.setAction("android.test.action.MoniterInstallService");
intent.setClass((Context)this, MoniterInstallService.class);
intent.putExtra("company", "tencent");
intent.putExtra("name", "hacker");
intent.putExtra("age", 18);
startActivity(intent);
startService(intent);
}
SharedPreferences.Editor editor = getSharedPreferences("test", 0).edit();
editor.putString("ilil", str1);
editor.putString("lili", str2);
editor.commit();
}
public boolean onCreateOptionsMenu(Menu paramMenu) {
getMenuInflater().inflate(2131099648, paramMenu);
return true;
}
public boolean onOptionsItemSelected(MenuItem paramMenuItem) { return (paramMenuItem.getItemId() == 2131165188) ? true : super.onOptionsItemSelected(paramMenuItem); }
}
老规矩，查看onCreate方法:
protected void onCreate(Bundle paramBundle) {
super.onCreate(paramBundle);
setContentView(2130903041);
Intent intent = getIntent(); //获取到传入的intent
String str1 = intent.getStringExtra("ili"); //读取c
String str2 = intent.getStringExtra("lil"); //读取d
//判断条件是c+d经过本地函数处理之后内容是否等于VEIzd/V2UPYNdn/bxH3Xig==
if (Encryto.doRawData(this, str1 + str2).equals("VEIzd/V2UPYNdn/bxH3Xig==")) {
intent.setAction("android.test.action.MoniterInstallService");
intent.setClass((Context)this, MoniterInstallService.class);
intent.putExtra("company", "tencent");
intent.putExtra("name", "hacker");
intent.putExtra("age", 18);
startActivity(intent);
startService(intent);
}
SharedPreferences.Editor editor = getSharedPreferences("test", 0).edit();
editor.putString("ilil", str1);
editor.putString("lili", str2);
editor.commit();
}这里有一个判断：判断条件是c+d经过本地函数处理之后内容是否等于VEIzd/V2UPYNdn/bxH3Xig==，如果判断结果为真则会开启一个新的activity: MoniterInstallService
我们先来研究这个判断条件内的函数，看看假如输入的c+d等于"VEIzd/V2UPYNdn/bxH3Xig=="会发生什么：
查看Encryto.doRawData（），发现是一个JNI方法。
上IDA，将so文件拖进IDA后找到j_doRawData之后无脑F5:
int __fastcall doRawData(int a1, int a2, int a3, int a4)
{
int v4; // r4
int v5; // r9
int v6; // r6
int v7; // r8
int result; // r0
int (__fastcall *v9)(int, char *, size_t); // r6
char *v10; // r5
size_t v11; // r2
int v12; // [sp+0h] [bp-28h]
int v13; // [sp+4h] [bp-24h]
int v14; // [sp+8h] [bp-20h]
int v15; // [sp+Ch] [bp-1Ch]
char v16; // [sp+10h] [bp-18h]
int v17; // [sp+18h] [bp-10h]
v4 = a1;
v5 = a4;
if ( j_checkSignature(a1) != 1 )
goto LABEL_7;
v12 = *(_DWORD *)"thisisatestkey==";
v13 = *(_DWORD *)"isatestkey==";
v14 = *(_DWORD *)"estkey==";
v15 = *(_DWORD *)"ey==";
v16 = aThisisatestkey[16];
v6 = (*(int (__fastcall **)(int, int, _DWORD))(*(_DWORD *)v4 + 676))(v4, v5, 0);
v7 = j_AES_128_ECB_PKCS5Padding_Encrypt(v6, (int)&v12);
(*(void (__fastcall **)(int, int, int))(*(_DWORD *)v4 + 680))(v4, v5, v6);
result = (*(int (__fastcall **)(int, int))(*(_DWORD *)v4 + 668))(v4, v7);
if ( _stack_chk_guard != v17 )
{
LABEL_7:
do
{
v9 = *(int (__fastcall **)(int, char *, size_t))(*(_DWORD *)v4 + 652);
v10 = UNSIGNATURE[0];
v11 = strlen(UNSIGNATURE[0]);
}
while ( _stack_chk_guard != v17 );
result = v9(v4, v10, v11);
}
return result;
}我们可以大胆的猜测（具体是为什么我也不知道），字符指针v6就是传入的字符串。
然后可以看到，输出是v7=j_AES_128_ECB_PKCS5Padding_Encrypt(v6, (int)&v12);
根据目测函数名，推测是128位的AES加密，模式是ECB,填充方式是PKCS5Padding。
然后我们观察到这个函数的v12是密钥，且前面有操作strcpy（v12,"thisisatestkey=="），因此可以知道密钥是v12.
然后打开在线解密网站：在线AES加解密
输入：
拿到明文为aimagetencent。
于是根据之前分析的，c+d拼接成aimagetencent。
不妨大胆假设c="aimage" ,d="tencent",输入一下试试看会发生什么。
我们在第一个输入：tencent
第二个输入框输入：aimage,
神奇的一幕出现了：
。。。。。。
开始我认为是我的模拟器版本只有4.4过低，于是用我的真机测试，依然闪退。
事情到此陷入了僵局。
分析一波判断结果为true之后发生的事情：
开启一个新的MoniterInstallService，点击进去这个MoniterInstallService看下代码：
package com.tencent.testvuln;
import android.app.Service;
import android.content.BroadcastReceiver;
import android.content.Context;
import android.content.Intent;
import android.content.IntentFilter;
import android.os.Environment;
import android.os.Handler;
import android.os.IBinder;
import android.os.Message;
public class MoniterInstallService extends Service {
private long a = 0L;
private String b = null;
private String c = null;
private c d = null;
private BroadcastReceiver e = new BroadcastReceiver(this) {
public void onReceive(Context param1Context, Intent param1Intent) {
this.a.b("");
try {
Thread.sleep(1000L);
} catch (InterruptedException interruptedException) {
interruptedException.printStackTrace();
}
param1Intent = new Intent("android.setting.word");
param1Intent.putExtra("1", MoniterInstallService.a(this.a));
param1Intent.putExtra("2", MoniterInstallService.b(this.a));
param1Context.sendBroadcast(param1Intent);
}
};
private Handler f = new Handler(this) {
public void handleMessage(Message param1Message) {
switch (param1Message.what) {
default:
return;
case 0:
break;
}
this.a.a("");
}
};
void a(String paramString) {
paramString = Environment.getExternalStorageDirectory().getPath() + "/crash/";
if (this.d == null)
this.d = new c(paramString);
this.d.startWatching();
}
void b(String paramString) {
if (this.d != null)
this.d.stopWatching();
}
public IBinder onBind(Intent paramIntent) { return null; }
public void onCreate() {
super.onCreate();
IntentFilter intentFilter = new IntentFilter();
intentFilter.addAction("com.tencent.testvul.service.MoniterFile");
intentFilter.setPriority(2147483647);
registerReceiver(this.e, intentFilter);
}
public void onDestroy() { super.onDestroy(); }
public void onStart(Intent paramIntent, int paramInt) {
super.onStart(paramIntent, paramInt);
this.b = paramIntent.getStringExtra("ili");
this.c = paramIntent.getStringExtra("lil");
(new Thread(this) {
public void run() {
Message message = new Message();
message.what = 0;
MoniterInstallService.c(this.a).sendMessage(message);
}
}).start();
}
}
大概扫了扫发现是一个广播开启和接收的Activity，和本次CTF关系应该不大，因此这个暂时不管它，继续往下分析SecondActivity的代码。
SharedPreferences.Editor editor = getSharedPreferences("test", 0).edit();
editor.putString("ilil", str1);
editor.putString("lili", str2);
editor.commit();.............发现这代码它也没干啥事啊，就存储了一下输入的变量。
事情再次陷入了僵局。。。。。。。
然后发现在一个从未被使用过的类（之所以说它从未被使用过是因为如下：search搜索该类只找到它自己）： FileDataActivity中发现了如下神秘代码：
package com.tencent.testvuln;
import android.os.Bundle;
import android.widget.TextView;
import com.tencent.testvuln.c.Encryto;
public class FileDataActivity extends a {
private TextView c;
protected void onCreate(Bundle paramBundle) {
super.onCreate(paramBundle);
setContentView(2130903042);
this.c = (TextView)findViewById(2131165184);
this.c.setText(Encryto.decode(this, "9YuQ2dk8CSaCe7DTAmaqAA=="));
}
}
然后我们拿着串神秘代码去AES解密，就拿到了flag:
这题我不知道说什么好
-------end----------