Nmap (Enum phase)
PORT STATE SERVICE 80/tcp open http
Not much here apart from a webpage with default apache, Time for fuzzing!!
ffuf -w /usr/share/seclists/Discovery/Web-Content/raft-large-files-lowercase.txt -u http://10.150.150.224/FUZZ -mc all -fc 404,403 login.php [Status: 200, Size: 1213, Words: 400, Lines: 55] index.html [Status: 200, Size: 10701, Words: 3427, Lines: 369] . [Status: 200, Size: 10701, Words: 3427, Lines: 369] const.php [Status: 200, Size: 0, Words: 1, Lines: 1]
Going to the login page presents a pin protected login, after brute forcing i got no where. Then I noticed a .apk file download. Looks like we need to reverse engineer the apk.
(This was not the case but i left this here for information purpouses)
Decompile and Recompile
apktool -r d app.apk d2j-dex2jar ~/scratch/android/JunoClient.apk #jd-gui apktool -r b app.apk keytool -genkey -v -keystore my-release-key.keystore -alias alias_name \ -keyalg RSA -keysize 2048 -validity 10000 jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 -keystore my-release-key.keystore JunoClient.apk alias_name jarsigner -verify -verbose -certs JunoClient.apk
#Line 91 change value if-eqz v2, :cond_0
MobSF (nice tool)
I failed at the reverse engineering manually and had to seek a nudge. I got told of a software to try out next called MobSF
git clone https://github.com/MobSF/Mobile-Security-Framework-MobSF.git cd Mobile-Security-Framework-MobSF ┌─[puck@parrot-lt]─[/opt/Mobile-Security-Framework-MobSF] └──╼ $sudo apt-get install python3-venv
┌─[puck@parrot-lt]─[/opt/Mobile-Security-Framework-MobSF] └──╼ $sudo pip3 install -r requirements.txt ┌─[puck@parrot-lt]─[/opt/Mobile-Security-Framework-MobSF] └──╼ $sudo ./setup.sh
To Run the tool.
Then open a webpage to be presented with the tools interface where you can now upload an android file to be inspected.
Drag and drop the JunoClient.apk file onto the webpage to start the analysis.
Having already manually tring to do this, I had decompiled the apk file and already seen parts of the code I thought would be a good start.
Namily FLAG43 (seen in the code base) and youknowhat variables.
Using search on the webpage I qucklyu found them both.
FLAG 43 = c1d93b510b8f78d2b4f3336022618d8c5b04b27e
With the correct pin we can now log in to the webpage.
We are presented with the last 2 flags.
One is encoded the other is not. For the encoded one, I worked out that the ASCII shift cypher is being used so we can decompile it.
Then grab the last flag from the box!