慎重搭建MobSF

前情提要

MobSF是一款移动安全框架。支持静态代码分析和动态分析，听说还能测试WebAPI接口。为什么是听说，因为我动态分析功能没搭成功。。。。。。

之前用docker搭好了，但是只能使用静态分析功能，想试试动态分析和webAPI接口的测试，需要本地搭

结合官网教程和网上安装博客

环境：
centos7 64位，python3

python3 使用命令是python3,pip3

# 下载安装包
git clone https://github.com/MobSF/Mobile-Security-Framework-MobSF.git
cd Mobile-Security-Framework-MobSF
# 安装依赖
pip3 install -r requirements.txt

报错

raise ImproperlyConfigured(‘SQLite 3.8.3 or later is required (found %s).’ % Database.sqlite_version)
django.core.exceptions.ImproperlyConfigured: SQLite 3.8.3 or later is required (found 3.7.17).

MobSF的框架是django 2.2，对sqlite版本有需求，centos自带sqlite版本低，更新sqlite

官网查看最新版本链接
https://www.sqlite.org/download.html

# 下载sqlite安装包
cd ~
wget https://www.sqlite.org/2019/sqlite-autoconf-3300100.tar.gz
# 解压
tar zxvf sqlite-autoconf-3300100.tar.gz
cd sqlite-autoconf-3300100/
./configure
make && make install

# 替换旧的sqlite，进入home目录
cd ../
mv /user/bin/sqlite3 /usr/bin/sqlite3_old
ln -s /usr/local/bin/sqlite3   /usr/bin/sqlite3
echo "/usr/local/lib" > /etc/ld.so.conf.d/sqlite3.conf
ldconfig
# 查看版本
sqlite3 -version

3.30.1 2019-10-10 20:19:45 18db032d058f1436ce3dea84081f4ee5a0f2259ad97301d43c426bc7f3df1b0b

开启服务

python3 manage.py runserver 192.168.56.204:8000

提示：

You have 14 unapplied migration(s). Your project may not work properly until you apply the migrations for app(s): auth, contenttypes, sessions.
Run ‘python manage.py migrate’ to apply them.

其他教程说官网安装方式少了一步，数据库初始化

python3 manage.py makemigrations
python3 manage.py migrate

启动服务
提示如下，没有报错，但是内网机器浏览器访问不到

[INFO] 06/Dec/2019 06:57:34 - Watching for file changes with StatReloader
Performing system checks...

[DEBUG] 06/Dec/2019 06:57:34 - Waiting for apps ready_event.
[INFO] 06/Dec/2019 06:57:36 - 
  __  __       _    ____  _____         ____    ___  
 |  \/  | ___ | |__/ ___||  ___| __   _|___ \  / _ \ 
 | |\/| |/ _ \| '_ \___ \| |_    \ \ / / __) || | | |
 | |  | | (_) | |_) |__) |  _|    \ V / / __/ | |_| |
 |_|  |_|\___/|_.__/____/|_|       \_/ |_____(_)___/ 

[INFO] 06/Dec/2019 06:57:36 - Mobile Security Framework v2.0.7 Beta
REST API Key: 3beefa6b2c8e9dd334d96ef34afb04f469a8b0a8e0e1e9ad9d2fdc4c7eb98497
[INFO] 06/Dec/2019 06:57:36 - OS: Linux
[INFO] 06/Dec/2019 06:57:36 - Platform: Linux-3.10.0-957.27.2.el7.x86_64-x86_64-with-centos-7.4.1708-Core
[INFO] 06/Dec/2019 06:57:36 - Dist: centos 7 Core
[INFO] 06/Dec/2019 06:57:36 - MobSF Basic Environment Check
[WARNING] 06/Dec/2019 06:57:36 - Dynamic Analysis related functions will not work. 
Make sure a Genymotion Android VM is running before performing Dynamic Analyis.
[INFO] 06/Dec/2019 06:57:36 - Checking for Update.
[DEBUG] 06/Dec/2019 06:57:36 - Apps ready_event triggered. Sending autoreload_started signal.

检查端口开放情况和防火墙

# 新开一个窗口
netstat -ant |grep 8000

tcp        0      0 192.168.56.204:8000     0.0.0.0:*               LISTEN 
可以看到端口开了

本机telnet连接

>telnet 192.168.56.204 8000

不通，检查防火墙

# 查看防火墙状态
service firewalld status
# 关闭防火墙
service firewalld stop
# 其实关闭防火墙是为了图省事，不应该关闭造成不可预知的风险，只需要把8000端口开发就行了
firewall-cmd --zone=public --add-port=8000/tcp --permanent

本机telnet连接

>telnet 192.168.56.204 8000

可以连通，浏览器也可以成功访问

又报错

[ERROR] 06/Dec/2019 07:52:02 - Cannot Check for updates.
Traceback (most recent call last):
  File "/usr/local/python3/lib/python3.6/site-packages/urllib3/connection.py", line 160, in _new_conn
    (self._dns_host, self.port), self.timeout, **extra_kw)
  File "/usr/local/python3/lib/python3.6/site-packages/urllib3/util/connection.py", line 80, in create_connection
    raise err
  File "/usr/local/python3/lib/python3.6/site-packages/urllib3/util/connection.py", line 70, in create_connection
    sock.connect(sa)
socket.timeout: timed out

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/local/python3/lib/python3.6/site-packages/urllib3/connectionpool.py", line 603, in urlopen
    chunked=chunked)
  File "/usr/local/python3/lib/python3.6/site-packages/urllib3/connectionpool.py", line 344, in _make_request
    self._validate_conn(conn)
  File "/usr/local/python3/lib/python3.6/site-packages/urllib3/connectionpool.py", line 843, in _validate_conn
    conn.connect()
  File "/usr/local/python3/lib/python3.6/site-packages/urllib3/connection.py", line 316, in connect
    conn = self._new_conn()
  File "/usr/local/python3/lib/python3.6/site-packages/urllib3/connection.py", line 165, in _new_conn
    (self.host, self.timeout))
urllib3.exceptions.ConnectTimeoutError: (, 'Connection to raw.githubusercontent.com timed out. (connect timeout=5)')

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/local/python3/lib/python3.6/site-packages/requests/adapters.py", line 449, in send
    timeout=timeout
  File "/usr/local/python3/lib/python3.6/site-packages/urllib3/connectionpool.py", line 641, in urlopen
    _stacktrace=sys.exc_info()[2])
  File "/usr/local/python3/lib/python3.6/site-packages/urllib3/util/retry.py", line 399, in increment
    raise MaxRetryError(_pool, url, error or ResponseError(cause))
urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='raw.githubusercontent.com', port=443): Max retries exceeded with url: /MobSF/Mobile-Security-Framework-MobSF/master/MobSF/settings.py (Caused by ConnectTimeoutError(, 'Connection to raw.githubusercontent.com timed out. (connect timeout=5)'))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/home/hanbairu/Mobile-Security-Framework-MobSF/MobSF/utils.py", line 117, in check_update
    proxies=proxies, verify=verify)
  File "/usr/local/python3/lib/python3.6/site-packages/requests/api.py", line 75, in get
    return request('get', url, params=params, **kwargs)
  File "/usr/local/python3/lib/python3.6/site-packages/requests/api.py", line 60, in request
    return session.request(method=method, url=url, **kwargs)
  File "/usr/local/python3/lib/python3.6/site-packages/requests/sessions.py", line 533, in request
    resp = self.send(prep, **send_kwargs)
  File "/usr/local/python3/lib/python3.6/site-packages/requests/sessions.py", line 646, in send
    r = adapter.send(request, **kwargs)
  File "/usr/local/python3/lib/python3.6/site-packages/requests/adapters.py", line 504, in send
    raise ConnectTimeout(e, request=request)
requests.exceptions.ConnectTimeout: HTTPSConnectionPool(host='raw.githubusercontent.com', port=443): Max retries exceeded with url: /MobSF/Mobile-Security-Framework-MobSF/master/MobSF/settings.py (Caused by ConnectTimeoutError(, 'Connection to raw.githubusercontent.com timed out. (connect timeout=5)'))

除非改代码，不然就只能等一等再连

web页面也报错

# 打开/recent_scans/
OperationalError at /recent_scans/

no such table: StaticAnalyzer_staticanalyzerandroid

Request Method: 	GET
Request URL: 	http://192.168.56.204:8000/recent_scans/
Django Version: 	2.2.8
Exception Type: 	OperationalError
Exception Value: 	

no such table: StaticAnalyzer_staticanalyzerandroid

Exception Location: 	/usr/local/python3/lib/python3.6/site-packages/django/db/backends/sqlite3/base.py in execute, line 383
Python Executable: 	/usr/bin/python3
Python Version: 	3.6.1
Python Path: 	

['/home/Mobile-Security-Framework-MobSF',
 '/usr/local/python3/lib/python36.zip',
 '/usr/local/python3/lib/python3.6',
 '/usr/local/python3/lib/python3.6/lib-dynload',
 '/usr/local/python3/lib/python3.6/site-packages',
 '/usr/local/python3/lib/python3.6/site-packages/pip-9.0.1-py3.6.egg']

Server time: 	Fri, 6 Dec 2019 07:42:08 +0000

安装StaticAnalyzer

python3 manage.py makemigrations
python3 manage.py makemigrations StaticAnalyzer
python3 manage.py migrate

重新运行

./setup.sh

问题1：

两种安装运行方式，暂不知道有什么区别
官网版：

git clone https://github.com/MobSF/Mobile-Security-Framework-MobSF.git
cd Mobile-Security-Framework-MobSF
./setup.sh # For Linux and Mac

网上教程版,上面那种，这个可以指定IP和端口

# 启动
python3 manage.py runserver 192.168.56.204:8000

两种运行方式都会有一定报错，等一等能好，都不能稳定运行

与docker安装相比，静态分析速度明显变慢，动态分析还没有装

---

动态分析装不上的分割线QAQ

---

小结

动态分析装起来太麻烦，而且努力了一波也没装上。。。

使用一段时间感觉确实比较鸡肋。就是食之无味弃之可惜的感觉。

没找到啥正经漏洞，还被满眼的英文绕晕。但是把app分析得非常详细，字符变量都给你列出来。如果做逆向分析应该会有点帮助。

在云主机上装应用一定要记得设置防火墙端口开放！切记！！