jueves, 15 de febrero de 2018

Write-up "Mission#003"

Rick y la bomba

Antes que nada, presentar nuestras disculpas por tardar tanto en liberar el write-up.


En esta misión volvemos a estar en el papel de Rick, tenemos que evitar que explote
una bomba, pero la información que tenemos es solo un código QR desordenado.


Puzzle QR


Podemos hacer uso de GIMP para rearmar el código QR, scripts en python...etc.
Hay bastante información en Google sobre esto, el rearme correcto sería el siguiente
que corresponde con una dirección de descarga de una apk:
Puzzle QR Resuelto


Y aquí empieza lo divertido, podemos instalarla en un emulador de android para
echar un primer vistazo a la aplicación.


Temporizador de la bomba
Explosión de la bomba
Hace poco vi por algún lugar oscuro de Twitter una distribución que me llamó mucho la atención
"Android Tamer" (dejo el link en el apartado "Herramientas" abajo del post).

Android Tamer es una distribución diseñada para hacer auditorias de seguridad a aplicaciones Android.
Así que nos viene perfecto para esta ocasión. Personalmente cuando me enfrento a este tipo de pruebas
lo que suelo hacer es analizarlo con "MobSF (Mobile Security Framework)".
Abrimos una terminal y ejecutamos el comando 'mobsf' se ejecutará un portal web:
(http://0.0.0.0:3000 por defecto en Android Tamer).


Consola MobSF



Portal Web MobSF




Y analizamos 'timer.apk'. En el apartado de 'Options' nos presenta varias opciones:

Options MobSF

Las más interesantes son 'View java / Download Java Code' y 'View smali / Download Smali Code'.
Descargamos los ficheros y podemos investigar mejor con esto nos valdrá, si vemos el 'MainActivity.java' y
nos fijamos en las funciones: 'onCreate()' y 'showCode()' vemos lo siguiente:

Código onCreate()


Código showCode()



Si nos descargamos desde MobSF los ficheros 'java' y 'smali' podemos modificarlos y recompilar la apk para que funcione según nuestras modificaciones. Dentro de 'MainActivity.smali' vemos las funciones 'showCode(), wasSuccess(), showBoom()'

MainActivity.smali




Podemos parchear estas funciones y reemplazar la función 'showBoom()' por 'showCode()'.


MaicActivity.smali modificado


Recompilamos la aplicación, la instalamos en nuestro dispositivo y/o emulador, veremos como no ha funcionado la aplicación, pero si matamos el proceso de la aplicación y esperamos a que pase los 30 segundos y ya obtenemos el código UAM{B0mb_D1S4BL3D_YOU_R0CK}

FLAG!!!

Espero que os haya ayudado este write-up, hay muchísimas formas de resolver este reto pero ha sido imposible recogerlas todas y organizarlas para un write-up más completo, quizás en próximas misiones podamos hacerlo. 
Recordar que cualquier duda podéis exponerla en el canal de Telegram (https://t.me/joinchat/AKWAVkxjj1GTE_cvkvQvIQ) o por privado a los administradores. 


Muchas gracias por participar en una misión más y bienvenidos a los que se enganchan ahora.





Mario Parra
@MPAlonso_

Herramientas usadas por los participantes

QR
-------------------------------------





APK
--------------------------------------







18 comentarios:

  1. I do trust all of the concepts you have presented to your post.
    They’re very convincing and can certainly work. 메이저사이트

    ResponderEliminar
  2. I like the valuable information you provide
    in your articles. I’ll bookmark your blog and check again here frequently. 온라인카지노

    ResponderEliminar
  3. Valuable info. Lucky me I found your website by accident. I bookmarked it. 사설토토

    ResponderEliminar
  4. Hello there! Big thumbs up for the excellent info have got here on this post. Im very pleased to read this article. Awesome post, Thanks for this one

    ResponderEliminar
  5. Great Post! Im looking forward to seeing more from this blog here. There are some great ideas above. Thanks for providing this good stories This website is useful. You made great points

    ResponderEliminar
  6. Very nice article and straight to the point. Keep it up, Hey there. Your article looks good. Keep on writing great article man! I bookmarked more article from this website. Nice blog provided here.

    ResponderEliminar
  7. Nice article! keep writing this kind of blog. Keep it up, thanks budddy!! I have read several excellent stuff here. Keep on writing great, superb blog layout! Magnificent

    ResponderEliminar
  8. Wow, superb blog layout! Magnificent, let alone the content Fantastic very informative blog. You must continue to do this. Very great post. I just stumbled upon this blog and its excellent point.

    ResponderEliminar
  9. I truly loved browsing this blog posts. Wonderful site you have here! Thanks Efficiently written information..Keep up the good work. Continue this

    ResponderEliminar
  10. I really like the concept you have in mind. You really have a creative idea.

    ResponderEliminar
  11. It is a great website.. The Design looks very good.. Keep working like that!.

    ResponderEliminar
  12. I’ve been watching out for your content. If ever you have some more updates please do notify me.

    ResponderEliminar
  13. "Rick and the Bomba" is an exciting journey that skillfully combines humor and tension. The story follows Rick, a charming lead character, as he navigates a world on the verge of anarchy brought on by an impending bomb threat. With its rapid-fire pacing and surprising turns, the story keeps readers on the edge of their seats. The characters are well-developed, and the suspenseful atmosphere is made more entertaining by Rick's wit. Readers are captivated by the author's deft writing and are left wanting to solve the mystery. For readers who are looking for a gripping, unpredictable story that deftly blends comedy and tension, "Rick and the Bomba" is a must-read.
    trucking accidents lawyer

    ResponderEliminar
  14. "Mission#003" is a compelling write-up that intricately weaves suspense and intrigue, keeping readers captivated from start to finish. With its skillful narrative and unexpected twists, it promises an immersive experience that leaves a lasting impression.||Abogado de Multas de Tráfico Nueva Jersey||Domestic Violence Charges New Jersey






    ResponderEliminar
  15. "Rick and the Bomb" is a thrilling narrative centered around Rick, a daring and skilled bomb disposal expert, who faces the ultimate test of his career when a highly sophisticated and enigmatic bomb threatens the heart of the city. Known for his unshakeable nerves and exceptional expertise, Rick navigates through this perilous situation with a blend of scientific knowledge, intuition, and sheer courage.
    lawyer for contract dispute
    truck accident law

    ResponderEliminar
  16. Laboratorio" is the Spanish and Italian word for "laboratory." It refers to a controlled environment equipped for scientific experimentation, research, or analysis. Laboratories are essential in various fields, including science, medicine, and technology, providing a space for controlled investigations and testing.
    lawyer for motorcycle accident
    virginia personal injury lawyer





    ResponderEliminar
  17. Having an experienced legal ally can make all the difference in Fairfax, where the complexities of the legal system can be intimidating. In addition to acting as your advocate in court, a Fairfax criminal defence attorney is a strategic partner dedicated to defending your rights and achieving the best result for your case.Fairfax Criminal Lawyer

    ResponderEliminar

  18. Laboratorio offers a range of innovative and high-quality products for scientific research and laboratory work. With a focus on precision and reliability, their equipment and supplies are trusted by professionals worldwide. Whether you're conducting experiments or analyzing data, Laboratorio provides the tools you need for success in the lab. abogado testamentario y testamentario

    ResponderEliminar