Okay, guys, after all this theory, now let's have a look into a practical exercise.
Let's start exploiting those activities.
Are you ready for this?
Let's switch back to the Ubuntu VM.
Back at Ubuntu VM, we go back to an application which we have already analysed a little bit.
I'm talking about the CV application which has been developed by MOI Labs, which is now F-Secure.
So this is really amazing.
Capture the flag application and this is where we are going to practice our knowledge right now.
So therefore let's go.
Okay.
As always, you can find this application as an attachment of the section.
So I've already downloaded it and it's over here.
Okay.
So the first thing we want to do is we want to install this application and verify that it's working
on our device.
Which device?
I'm using the emulator.
But you can also go for a real device.
So this should work perfectly fine.
Okay, so let's see which emulator I've got.
Emulator list IDs.
There we have it next.
So six applicable 30.
I will keep repeating this pretty often in this course.
So sorry for this if you have heard it now multiple times.
But yeah, regarding to those emulators next so 60 bytes, it's in my opinion the best one.
It's not that powerful, which is good because this means it doesn't require a lot of resources and
it's therefore not as likely as a pixel device, which might require a lot of resources.
All right.
So let's start this one emulator and then we simply provide this name.
So the emulator is starting and we already get the spawning, running and nested virtualization.
It's not a good idea, but even within this virtual machine, it works perfectly fine.
Okay, maybe not perfectly.
It's a little bit laggy, but not as bad as you might think right now.
You can also use device or our x86 approach with our external virtual machine.
No problem.
So here we have it.
Let's start it.
Okay, perfect.
Now devices running.
So let's go back into our application directory and see and let's install this application.
It's hanging a little bit.
Och.
So here we have it right now.
Let's start it.
And it's loading.
And we already get this this message that this application wants to access our files and media.
And this is something we definitely need to take care of, not regarding to privacy.
More regarding if we are analyzing an application, then we should figure out what this application
is doing with those files.
For example, might there be some access to the SD card and public available directory where some sensitive
information could be stored, things like this?
So if we're dealing with some permissions like this one over here within a penetration test, we should
figure out what is being done with those permissions.
And maybe we can we can exploit this stuff for now.
We do not go too deep into this.
We just want to focus on those activities so we grant this permission.
Okay.
And here we have it slowly.
The fan is spinning a little bit.
I do not.
Oh, I hope it's not that horrible on the microphone.
Okay.
So here we've got that right now.
And there's the warning.
This app was built for an older version.
But don't worry, I have tested it on an AP level 30 device, which is Android 11.
I guess it's working perfectly fine there.
So simply click okay and we're good to go.
Okay.
We have already talked about this application and therefore I do not want to extend this video unnecessarily
long and see if it's capture the flag password manager so we can provide the password over here, which
will be used to encrypt and decrypt our passwords stored in this application.
So that's the whole functionality about see, okay.
So let's fill this out real quick.
And therefore I'm using the ADB shell and I'm using input text and we provide an 16 character long password
and there we go.
And we can see normally we should use alphanumeric digits, capital letters and at least 16.
But we can, we can simply use 60 numbers.
This would be already in finding if we have this in a mobile application, if it recommends to use this
character set.
But we can move on with this one.
So let's submit.
Our password seems to fit.
I mean, we can see it over here then we cannot make mistakes typing in it.
Fun fact, by the way, if you're having things like this and PIN, for example, and you enter this,
yes, those numbers appear over here.
So I was once sitting in a presentation where someone did enter and password by on form field on the
on the presenter so everyone could see the password even if they are dots.
I mean the characters visible for a certain amount of time.
So it's not a good idea to do this.
But over here it's fine.
You can see my passwords.
So now we have to provide an pin and this pin will be used to access this within a quick mode.
So if you put it into the background and opening it once again, then we only have to enter an pin if
we have already decrypted the database with this password over here.
So let's define a pin.
We submit this.
And now.
Now we have to enter the password.
So we have an initial setup right now.
Okay.
We should keep in mind what we are seeing right now because these are all activities.
So we had an activity regarding Tune PIN.
We also having a password, an activity regarding to entering a password and things like this.
So if you browse an application, we have now to see this through the eyes of an attacker.
So we have already seen a few activities.
All right, so let's insert our password here.
Okay.
Let's sign in.
Okay.
Now we've got another activity.
So that's different screen content.
And over here we've got settings.
This is another activity.
All right.
We can change pin, delete passwords, back up to SD card and things like this.
And over here we can now define a new entry.
So let's do this at New Passport.
We have seen another screen has been open.
So this is another activity we got.
We've got tons of activities in here.
So let's say this is our banking application.
The username is app hacking and the password is super secret.
Okay.
And safe.
Now we are back in our passports activity and.
There we have the entry.
Entry.
EDIT Okay, so now we can see this is our banking entry and if you click on this, the password will
be copied to the clipboard.
So this is our password manager.
And on the first view it looks, it looks decent because if it closes application or let's say if we
put it into the background and if we are opening it once again.
What?
No recent items.
So let's see.
Okay.
There we go.
So if we are opening it once again, we do not get access.
We have to enter our pin.
If we do this, then let's see.
Okay, then we are in.
And if we close this application, we have to enter the complete password.
So let's see.
Yes.
So you can see we have to enter the password.
Let me check something quick.
If you're are entering a wrong password and try to sign in.
Password is incorrect.
Let's see if we could brute force it.
Yes, it would be generally possible.
But having 16 characters, even if these are just digits, it's not really practical.
The PIN approach that's different.
That's a different story.
So the PIN consisting of four digit numbers means we are having 1000 possibilities, ten square four.
And this would be possible to brute force, but not this 16 character long password over here.
Okay.
Now, finally, let's start hacking this application.
So let's get back off the ADB shell and let's start analyzing it.
Our reversing methods are limited right now.
We have a complete reverse section where we go through analyzing an application based on the source
code.
So maybe a little bit of spoiler.
If we are using shady screen and opening this APK file, then this tool is reconstructing the Java code
out of those classes, the text file.
So here we are having now Java code.
Let's open something.
For example, this activity.
So here we can see the code.
But this is something we cannot do right now.
We will talk about this whole approach in the reversing section.
I just want to show you already that things like this are possible.
I mean, this is not the original Java code, it's an interpretation of the original one, but it's
pretty close to the original one.
So we get a few arrows maybe from methods that could not be compiled, but the rest, I mean, it's
pretty decent at least for reversing.
It's well enough to do this, but it's already mentioned not an option.
And that's still not a problem because what we could do or what we want to exploit are now those activities.
And where do we find those activities?
Absolutely correct in the Android manifest example.
And how do we get this file?
The decoded version, absolute correct tool with the APK tool.
So let's leave up.
Sorry, let's use the APK tool D on our C application.
Now we can see decoding android manifest with the resources.
All right.
We are also decoding a little bit more, but I mean, that's okay here.
We have no directory until we have our Android manifest and let's see, opening it with.
Yes.
Yeah, we have it.
Absolutely beautiful layout, but let's not do this on them.
So if you now stack at them, don't worry.
This is I guess or this was the the most asked question on StackOverflow a while ago.
You can simply go back by by hitting src, colon, queue and exclamation mark to force it.
So this is the way to exit them in case if you didn't know this, this is an absolutely lifesaver for
you right now.
Okay.
We're not opening it with when we are going for the Visual Studio code approach.
Okay.
So it's been loaded and here we have it.
We can also select the rep.
Then we make sure that every line will be visible in case if it's longer, then it simply gets wrapped
around.
Okay.
We have already analyzed this application file within the Android manifest example.
So in case if you haven't watched this video, I mean, it's it's good to have it because there's a
lot of interesting stuff over here, like, for example, these custom permissions.
But we're not going to do this right now.
We only want to focus on our activities.
So we simply focus on those activity texts.
No services, no content providers.
We are only focusing on the activities right now.
Later on, don't worry, we will also exploit them, those those new components over here.
But for now, yes, let's focus on this one.
So our first activity we've got in here is the let's see the file select activity.
I mean, the name could be everything, but most of the time developer name, there are things like
the things they are doing.
So in this case, we might have an activity where we can simply select and file in there.
The most important part is this activity being exported.
So let's see, maybe let's, let's do it in this way and zoom in.
We zoom out.
That's that's not good.
Here we have it in one line.
So Android exported.
True.
Perfect.
So this means this file select activity is being exported and this means we can start this activity
from the outside world.
We could write our own application, which is sending this intent to start this, this activity.
Or we can use the ADB shell to do this.
We will use the ADB shell and maybe at the end have a quick bonus section on on how to write our own
application to exploit this.
But for now, we do this on the ADB shell because this is pretty easy in there.
All right.
This means we can start the file select activity.
Okay.
What else can we do then?
We've got this activity.
That's the main logging activity.
And the question right now, is this being exported?
So please think about this at least for a few seconds and pause and rewind this video already.
Okay.
So here we are back.
And the answer is yes, it is being exported because we have this intent folder.
So this application maybe let's let's get some graphical output over here in this application.
Let's see if I can draw this with a mouse.
Was.
Yes, I guess that's pretty good.
Oh, that's decent.
So that's an idea in case if you haven't seen this right now.
So this activity is listening into the smartphone and this one is waiting for an intent.
And this intent needs to have the action main and the category launcher, which means that those two
operations will be triggered.
If we click on the icon of this application on our smartphone, then those two, this action and this
category will be sent for our application and we're listening to this event right now.
So this activity is listening when those events appear and then it's starting this one, the main logging
activity, and this is our entry, our screen entry.
So our entry point of this application, which we see over here, this is our main logging activity
and this is how the intent filter is working.
So we have registered our intent folder to listen to those two events.
Alrighty.
Okay.
Having an intent folder means we're having an implicit export, which means this main logging activity
is also exported, even if it's not being defined like this one.
But we have it.
This one exploded.
So both of them are being exported.
Explicit.
Implicit.
Alrighty.
Perfect.
Then let's see.
We've got this activity, which is p w list activity.
Is it exported?
Yes, it is also being exported.
And if you search for this one, I mean, we can we can shorten this path right now.
We can see we have this one file, select p w list and those two.
These services are also exported and broadcast.
Sorry, the content provider that's that's an content provider is also being exported, but we skipped
them for now.
We will analyze them later.
Okay.
Here we can see nothing of them are being exported.
We are not having these settings at entry.
Short locking.
Interesting.
Welcome and pin activity.
None of them are being exported.
So this means we could possibly attack the file, select p w list and theoretically also this one.
But I mean, that's the launching activity.
So it would be ridiculous if we are having a vulnerability in here.
Okay.
Now ask the question, how can we start an activity?
So how can we tell the smart phone or this application in this case to open the file select activity,
we could write our own application.
Or in this case we are now using the ADB shell because that's the most easy way to to trigger this event
right now.
All right.
So let's have a look.
We are opening a new terminal.
We put this to the left and we go into the ADB shell.
So the weapon of choice we are using right now is the activity manager.
And we can we can open this with AM.
All right.
The activity manager is there's a lot of stuff in here because the name is a little bit misleading.
It's not just regarding two activities.
We could also perform actions regarding to services or broadcast receivers.
And this help over here, this one is being defined into two parts.
So at the beginning, this help might be a little bit confusing, but once we have figured it out and
we are doing this right now, then we will have no problems anymore with this one.
Alrighty.
Okay.
So let's see.
On the first half of this, of this activity manager, we've got lots of options we can see.
We've got this option, start activity.
Perfect.
This sounds exactly what we want to do and we have a lot of parameters in here.
Start profiler use and let's see the user is it regarding tool which user to run us so we can define
another user which we want to start this activity.
We can enable debugging, native debugging, we can wait for launch to complete and things like this.
So we could start an activity and say, okay, wait until the jetpack architectures or attaches and
things like this, but we do not want to do anything of this.
We just want to start our activity and that's all.
Okay, so we are using AM activity manager start activity and let's type this in.
Okay.
Now we need to define which activity we want to start and if we go upwards back again, we cannot find
any information about this one over here.
We can see we also got start service broadcast so interacting with broadcast receivers but we cannot
define which activity we want to start.
This is now in the second half.
So in the second half of this help we will find this intent declaration, this one, and here we have
now all the necessary information.
So we need to have a look at the beginning to figure out what we want to do.
Just then, let's say an and basic task starting an activity, interacting with broadcast receiver or
with service.
And in the second half, we have to define our our task right now.
Okay.
So let's see in the second half we have now things like action data, URI or category.
We will talk about them later.
So this is something which is important in the intent topic, which we will have next.
But for now we can simply skip this.
We are only interested in the dash and option because that's the component name and the component name
is simply just the name of the activity we want to start.
Of course it has to be an exporter, but this is the case for us right now.
If we go back here, we can see our file select activity is being exported and now we have to address
this file select activity.
We need to tell our activity manager to start exactly this one over here.
And this is being done with dash and component name.
So all we need to do is we need to tell our activity manager to start this one and we have to reference
it in a certain way because file select activity might be used quite often in applications and therefore
the the Android system would know which one we want to start.
The component name exists therefore often package name, which is a unique identifier in this one over
here and then slash and then our activity name.
All right.
So our component name is our unique identifier slash and then the activity name.
And by having it in this way, we we can make sure that we are exactly starting this file select activity,
not the one within another application.
Exactly within this one over here.
Back to the activity manager am start activity dash MN which is the component name and now the package
name.
Which just this one slash and then we take the activity name.
So Android name this one over here we keep this thought the start is required the quote notch but the
dot is being required.
Let's go back.
Yes, this activity is being exported through, which means we can start this right now.
All right, let's do this.
So let's keep the phone on the right and this on the left.
And let's do this in 3 to 1.
Nice.
Awesome.
We have bypassed the locking screen and we are now only five select activity.
But it doesn't mean that this one over here is already in vulnerability.
I mean, yes, we are now only select file activity, but we need to figure out what we can do right
now.
So therefore, let's have a look.
We do not have extra buttons over here and we got this storage emulated Android data directory.
So we see this path.
But I mean, that's not a secret.
So let's try going into this one, for example.
Oh, for that can be read.
Okay.
And if we go backwards, then we've got files.
But there's nothing in here.
Okay.
It could be the case that no backup has been already created and therefore this one is empty.
It's therefore also good to perform all these actions in an application if you're testing something.
So for now, it doesn't seem like the select file activity is is doing anything for us as an attacker
right now.
We can also check if we can use the back button.
Yes.
But then we are within the enter password activity again.
Okay.
So we can start this file select activity.
But we cannot do anything right now.
Maybe because the content has not been created yet.
We should go back to this topic after creating it back up.
But for now, it's not vulnerability.
All right.
By the way, this one over here might be also interesting.
What's this one?
Settings.
This is already in finding.
I mean, we can access the settings activity via the main locking activity.
To be honest, I'm not sure if this is an intended behavior or an programming mistake within captured
if like I would assume it's an intended behavior.
So this is also something we should look for.
All right.
But for now, we're having the settings activity.
But we can simply exploit this by having.
By by clicking on this button, and that's not cool.
So let's see what ads can we do?
Because there was one additional activity.
By the way, the settings activity is not being exported.
So this is something we cannot start right now.
But DPW list activity is being exported.
So let's see.
Perhaps a start activity and I'm not using a copy pasting the example or the code before because by
typing it in it will be a little easier.
Remember this in the future.
So it's good to not always copy this stuff.
It's good to write them once again.
Okay.
If you now want to address the p list activity, we need to have the package name in front so can come
m-w r example c slash dot and this one because t dot is also being included included over here.
Okay.
Let's see.
Three, two, one.
Nice.
This is also working and this might be already in finding because we can see right now and service inside
this application.
So we've gotten banking service and now let's see if we can open this.
I click open and.
No error.
Unable to connect to the service force, quit the app and try again.
Okay, so this one over here, this is in perfect example.
We have successfully bypassed the logging screen of our application by directly starting the list activity,
the export at P.W List activity so we do not have to enter the password.
We are now directly entering this activity of our application, but now we're getting an error.
I mean, we can see that we've gotten banking entry, but this banking entry cannot be opened.
The reason for this is if the application starts this P.W list activity, it has to start and service
before.
So after successfully locking in into this application by providing the correct password, this application
would first start in service and this service is being used to decrypt our passwords in our password
safe.
The service has not been started right now and therefore we are trying to enter this banking entry.
But this banking entry cannot be decrypted because this service which needs to be started before, has
not been started.
There is no service.
So this is gone.
And this means this application is now throwing an error because this service has not been started before
and therefore those entries are still being encrypted.
So we couldn't read them right now, which means, yes, we've got an information leakage, but it's
not as bad as you might think at the first view.
So this example is pretty great.
We could maybe circumvent this by also starting the service manually and then entering the P.W list
activity.
But this is something we will do after talking about services because I do not want to to get into other
topics.
Right now we have seen that this activity can be started, but we cannot fully use it because some certain
states has not been has not been configured yet, which would have been configured if we normally log
in into this application already.
Okay.
It doesn't mean that we are done right now because now we have entered the secure context of this application.
We are now in the secure context and we have to figure out what else we can do over here.
For example, let's see if we can create new entry.
Yes, we can enter a new one and we have now an add new password activity.
So let's see this one.
What might this be at entry activity?
So this is the ADD entry activity and this one is not being exported through.
So from the list activity which has been exported, we could now also opening this activity and this
one has not been exported, but this one has.
So if we are opening this one, we have entered the secure application context, which means we could
also start and interact with all other components that are linked in this activity over here.
Alrighty.
Okay.
So let's see if we can really add a new entry because this is something we do not know right now.
Okay.
So here behalf and service banking tool username is test and password is one, two, three, four.
Now let's click save and.
Yes, unable to connect to the service.
So once again, the service needs to be running to interact with those components.
So it's not a huge vulnerability.
For now, we are only getting an information leakage, but we can now also opening this one.
So what's over here?
This is the settings activity.
And now let's imagine this activity wouldn't be available from the logging screen.
So this one is also not being exported, right?
Yes, this is not being exported.
But once again, we have entered the secure context via the P.W list and this one can now also start
these settings activity so we can also hunt for vulnerabilities inside here.
Okay.
Let's see what we can do.
Change pin.
Let's see.
Let's open this one.
And unfortunately, we have to enter the old pin.
So in case if you wouldn't have to enter the old pin, if you could provide a new pin, then this might
be exploitable.
So after the user has logged in and put this application into the background, we do not require an
password.
We do require the pin, which means if you are now entering the pin activity, then we could define
a new password.
If you do not have to enter the old ones because we do not know this right now.
Okay.
So this could be exploitable, but in this case right now, it's not because we have to enter the old
pin and we cannot simply overwrite the new one.
Okay.
But nevertheless, do not give up.
So let's go back.
Delete passports.
Let's see.
This will delete the entire database.
This is something we definitely want to test at the end.
So not right now.
But if we could delete the whole database, this might be also pretty bad.
Okay, back up to SD card.
So let's see.
And this will save the database to the SD card.
Let's do this.
Let's see if this is working.
Database exported.
All right, so now we have exported the database to the SD card.
Let's verify this ADB shell SD card and let's see.
Okay, let's make this laptop.
We cannot see it over here.
Which means those data might be saved in the Android directory on the SD card.
And this is on modern smartphones and protected directory.
Which means even if we try to access the data directory, we have permission denied.
Okay.
We need to have root privileges to access this one, which doesn't makes it in finding.
But nevertheless, let's have a look into this one.
Okay.
We can get root privileges by simply entering as you then let's see.
Yes.
Here, we can already see this.
And yes, the user ID of this application is a 127.
This A can be replaced with 10,000 because this is the entry point where our application start.
So we have talked about this in the permission section that we will find out what's what's behind this
user ID, which means only this user or higher privileged user can access this directory.
So now we are higher privilege.
Let's see, we've got this files.
Oh, do you still remember the site's directory?
So we have seen this in the in the other activity in the file select activity.
So maybe we have known file inside here.
All right, let's simply print out what's inside this file and then we go.
Okay, here we have know the password and the pin and this is being stored in clear text in this file.
Okay.
So if I wouldn't count this as an, as in real finding, I mean, yes, those information could be protected,
but we need higher privileges to access this file.
All right.
But on on older smartphones, this might be in funding because there we do not have this Android directory
and it might be directly stored on the SD card and can be accessed by every other application tool.
All right.
Okay.
So far, we do not care about this.
We just want to talk about activities and take a little bit and left and right look into this application
analysis.
So also this one, it's not too bad.
Okay, next, we've got backup to net.
Let's see.
And this food safety database to the server.
Okay, let's do this.
Okay.
I'm not getting any message or things like this.
And therefore, let's also open up the ATP lockout because this is something.
Oops, not this one again, because this is something you should always observe within the ATP log that
we will find a lot of useful information regarding through those applications.
So let's do this once again.
Back up to Annette.
Yes.
All right.
So he is the network manager.
And failed to connect.
Okay.
So here we've got this server where this application tries to connect to, but this isn't topic regarding
to men in the middle.
We have a whole chapter on this how to get into the network connection of device and intercepting and
analyzing this traffic.
This is nothing we are going to do right now, but so far we can see, okay, the smartphone cannot
connect to the server, but the functionality would be would be given right now.
And then we've got restore from SD card.
Let's open this one.
This will replace the current database.
Yes.
And there we go.
This is our fight, select activity.
And now we've got this back up file over here.
So within our file, select activity, if you are now opening it once again, we might have this back
up and we could overwrite the current configuration with an old once with months which has been back
up.
So this could be also an finding.
So far it's not too bad for this application.
So maybe let's close this one.
Okay.
So far it's not too bad for this application.
So we can we can delete maybe those entries.
Let's do this at last.
So let's see.
Yes.
Database deleted.
Okay, let's go back.
Yes, it has been gone.
So as an user, we could circumvent the locking screen, then we can enter the p w list activity.
We could start the settings activity out of this one and then we could delete these entries.
All right.
It's an finding.
But I mean, it's more like denial of service.
We do not get those information right now.
Also, the back up to Sdcard, it's not working on modern smartphones anymore.
And I do not want to show you stuff which sounds absolutely amazing but doesn't work on modern applications.
So the things we want to analyze and learn right now is related to newer, modern applications and not
things that work on Android for backup to net.
Might be interesting if we can perform a man in the middle attack and then triggering this event manually,
then we might be able to fetch those information.
So the passwords and things like this.
So this would be in finding if we could achieve this task, we will have a look into this one in the
men in the middle section.
Alrighty.
Okay.
Last but not least, we've got this restore from SD card where we can simply restore an old version
and we could also directly access this activity over here.
Okay, so this is all for this video right now.
I mean, it has been a little bit long just for the case that we have learned how to start an activity.
But we are also talking talking view left and right and also talked intensively about the exploitation
of the stuff we can see having access to the ADB shell.
We could start an activity.
I mean, that's the most easy way.
And if you want to have some proof of concept, we can write our own application that performs this
bypass.
So I will I will do this in a bonus video afterwards.
Okay.
Nevertheless, we need some kind of physical access because if we if we are bypassing the locking screen,
then we need to have the smartphone in front to perform those actions, which makes it not that interesting
anymore.
It could be still dangerous, but it's not that fancy anymore.
If we if we have to have the smartphone in front of us.
All right.
We could have additional attack vectors for our activities, which means if we have an intent, which
we talk about next, then we can provide additional information to our activity.
And those information might be required by this application, which could lead to to other vulnerabilities.
We will talk about this after the intent section, because then we know what an intent is, how to trigger
and how to interact with this one.
Nevertheless, the activity needs to be exported.
So this should be your first view.
So if the activity is being exported, export A through explicit or based on intent filters, then we
might have additional attack vectors in case if it's not being exported like this one, for example,
the settings activity, we might be able to open these settings activity based on another one.
And in case if you do not have any reference to an activity like this, for example, the short logging
activity, then there's nothing more we can do right now.
So that's all for now.
And I'm really looking forward to see you in the next video.