Mission: Override the smart ac ! (Part 2)

Option 1 - Dynamic Instrumentation (Runtime brute force)

Overview

In this method we are going to attempt to inject a bypass script into the running app to force the app to accept our user installed certificate so that it communicates with our proxy as though it is communicating with the origin server.

Pre requisites and set up.

• Rooted Android device (physical or emulator)
• Intercept proxy configured to listen to the app communication
• User installed trusted CA certificate on the android device
• Frida tools installed on the host machine with the frida version and android version specific frida server file transferred to /data/local/tmp/frida-server on the android device and running as root.
• objection installed

Root emulator

• In the mumu player android device window, click the three dots icon and select device settings.
• Navigate to Developer options and turn on Enable root
• Also change the Disk sharing mode to Writable system disk

Configure proxy

• On your host machine, open a terminal window and run ipconfig or similar alternative.
• Copy the host machine's IPv4 address.

• In your android emulator, open Settings, navigate to Network & internet. Click on internet and click the gear icon for your wifi connection.

• Click on the pencil icon in the top right corner of the screen to open wifi configurations.

• In advanced settings, select manual proxy and enter your host machine's IPv4 address followed by the port on which you want to listen to. The default port is 8080 in mitmproxy.

• Finally click Save and close Settings.

Transfer proxy certificate to android and install

• mitmproxy generates a certificate when you first run any of their tools in your user directory in a hidden folder ~/.mitmproxy called mitmproxy-ca-cert.cer
• copy this file location and navigate to the location where adb (android debug bridge) is installed on your host machine. You will need to know the port on which your device allows the bridge.
• In mumu player open the mumu application window and click the hamburger icon and click on settings. This opens the Settings Center.

• Scroll down to find ADB port and note the ports. for me it was 5555, 16384

• from the adb directory or if you have adb on your PATH run
  adb connect 127.0.0.1:5555
adb -s 127.0.0.1:5555 push "C:\Users\rauna\.mitmproxy\mitmproxy-ca-cert.cer" /sdcard/Download
  this establishes a connection to the android device and pushes the certificate file onto the Downloads folder in Files.

• Navigate to Settings > Security & privacy > More security & privacy > Encryption & credentials > Install a certificate, in the android device

• Select CA certificate and confirm "Install anyway" and select the certificate from the Downloads folder.

Frida tools

• install frida-tools
  pip install frida-tools
  and download the frida server file for example
  my frida --version -> 17.16.1
  my android version adb shell getprop ro.product.cpu.abi -> x86_64

frida releases link

• extract the binary from this file and push it to /data/local/tmp/frida-server. It must be run as root.
• adb root start adb as root
• adb -s [host address]:[port] shell to start a shell in your device
• navigate to /data/local/tmp and run ./frida-server
• frida-ps -Ua to view process running
• objection --name [process-name] start
• android sslpinning disable

You should now be able to intercept communication..

Option 2 - Static repackaging (Patched APK) [FAILING]

• Download and install Java, NodeJs, mitmproxy, android emulator.
• Download the apk/xapk for your app. (I used softonic)
• Run npx apk-mitm [path/to/com.your.app.apk] to remove SSL pinning and obtain the patched apk.
• Configure your android device (emulator) to use the proxy.
• Install the patched apk on your android device (remove the official app if you have already installed it).
• Inspect the traffic on the proxy

Pass 2 - Results