Welcome back.
Let's do the bonus video regarding to our activity hacking.
So we will write in own application which is performing this task to start an activity without having
access to the ADB shell.
Alrighty.
Okay, let's go.
Okay.
So here we are back at Ubuntu VM.
And yeah, one thing I would like to mention over here is that I'm not a huge fan of showing things
which we haven't talked about so far because now to start an activity we need to interact with intents
and intense is something we do not know right now.
But don't worry, we will have an extensive view onto Intense in the next video.
So this is some kind of preview regarding to intense.
Alrighty.
Okay.
The other thing is, I mean, this one over here, it's an app hacking course.
It's not in development course.
But nevertheless, I think it's a good idea to have at least a little bit knowledge about this app development
process to write and simple proof of concept like we are going to do right now.
Let's say we want to present the last finding, bypassing the logging activity by directly starting
the p w list activity.
So if you have to explain this to the customer, we have to tell them right now, well, an attacker
needs access to the ADB shell.
Then the attacker could use the activity manager to start this application.
The customer would, of course answer something like, Well, if an attacker needs ADB access, then
we do not consider this as an finding because that's not an use case.
And to be honest, the customer would be right with this one, but not regarding to the vulnerability
itself, because we do not need access via the ADB shell to exploit this.
We could also do this with malicious application and therefore let's simply demonstrate this to the
customer right now.
Let's write an simple application and keep this as simple as possible.
Alrighty, let's go.
So to do this, we are going to open the Android studio.
So it's within tools Android studio and here we have it.
I simply starting the studio tortoise script with the shell.
All right.
Now the ID is loading.
And here we have it.
So if you want to create new application, we simply click on Create a New Project.
And now we have to choose the the the skeleton of our project.
I mean, we could use something like a Google Maps activity and fullscreen activity, button navigation
activity and things like this.
But we want to keep it as simple as possible and therefore we simply choose empty activity because by
choosing, purchasing activity and application will be already created for us.
And this has some kind of helloworld text in there.
So we do not have to take care about creating our own activity.
We, we have a nice skeleton which is, which is pretty easy to use.
So we move on with empty activity and now we simply have to give it a name.
Let's say C log in.
Sorry, let's name it.
See if logging bypass and this is the package name which is being automatically being created.
We could also give it a different name, for example.
Com hacking.
It doesn't matter.
It has to be unique.
But that's all okay and safe location.
This is our project location.
We leave this as it is and then within language I like to use Java, but if you are familiar with Kotlin
then you can also choose Kotlin.
Of course.
So I stick to Java.
Last but not least, we've got the minimum SDK and I go backwards to Android nougat.
So this means how far back what's compatible our application is in case if it's simply just in proof
of concept and we want to demonstrate it on a smartphone which is running Android version 11, for example.
Then we could also just select this one over here.
But if you want to apply this to many devices, we can already see this application would run approximately
on just 25% of those devices because the other ones are more outdated right now.
And therefore, we I mean, we do not have to have fancy UIs or things like this.
We can go back to to version seven.
This works perfectly fine.
And we have in compatibility about 90% already.
That's all so far.
Yes.
By clicking on finish.
Now our project will be will be created and we can observe this as the in the bottom of this.
So he is not a great build and the whole application is being set up.
We can see we are already displaying our main activity.
So this is our entry point of this application and this is our screen content.
The application would be absolutely ready to build and to install after this process has been finished.
So let's wait.
But I guess.
Yes.
Okay, nice.
It has been finished.
Okay.
So let's see what we've got over here.
We've got our main activity and this is our entry point of our application.
So the first thing that gets launched if you click on our icon is this part over here.
And this is pretty amazing because all we need to do is we need to insert our code into this method
in the on create method.
This is the method that's being called when we are starting our application and everything that we put
into this one will be automatically be executed.
All right.
So if you're putting our code over here, it will run, all right.
Within our own create method.
We've got some some stuff we've gotten saved instance stage.
We do not take care about this one.
Set content view is simply just the layout of our activity.
So it's been defined and let's see in resources layout this one.
If we double click on this XML file, we can see we've got an Hello World.
So the XML file is giving this structure for our layout.
But don't worry, you do not have to know anything about this one.
So I just want to give you a quick introduction into this.
And within the broadcast example, we will have a little bit deeper look into this whole application.
Okay.
And so for now, we just keep in mind, okay, an activity is in screen content.
The screen content has some form of layout.
In this case, it's named activity underscore main.
We can also switch to the code path.
Then you will see the structure of this layout.
But we do not take care of what this one.
So this means if we start this application, our screen content will be visible to us.
And I would suggest let's simply let's simply build this app and see what happens.
We haven't entered anything right now.
This is just in comment.
This is not in code, but this is already in working application.
Nice, isn't it?
So how can we start this or how can we build it?
And where do we want to run this?
The easiest option would be using the emulator.
And the nice thing is we've got a direct connection in our Android studio.
So first, let's start the emulator and then we will install this app so we can start this emulator
if we go into the apps, if we go onto the top, right.
And the AVD manager.
And then we've got here our Nexus device and we simply click this play button.
Okay.
On the left, we see we see our emulator.
And we also get this warning once again, that running and nested virtualization, it's not a good idea,
but we have already tested it.
It's fine.
Can we drag and drop this?
Not yet.
So we have to wait until this this emulator has been booted up.
Okay.
So it seems to be now the case if you click on this power icon.
Yes.
So here we have our our see application still open.
Let's close this one.
Okay.
Let's put this to the right.
Okay.
Now, if you want to build and install our application, all we need to do is simply clicking on display
icon.
This one, this will run our app and on the left we can see the Android studio has already made an connection
to our virtual machine over here.
So to this emulator, if we click on this one, we can see.
Yes, so we can see this one over here is our running device and we want to install our application
on this running device.
So by clicking this play button, let's open the emulator once again.
The great debate is running at the bottom and then we will make an ADB connection and install this app
without doing anything.
So I keep my hands up and let's see.
Okay.
This build might take a while if you're doing it for the first time, so I hope it doesn't take too
long.
Yes.
There we go.
Great.
Little vacation finished.
Now the activity get started.
And.
There we have it.
Seif locking bypass.
Hello World.
We have written our first application.
Okay, so to be fair, we haven't done anything right now, but this is something we will change.
Okay, so here we have now our application and the task our application needs to do is starting the
p w list activity of the CV application because by starting this one we can circumvent the logging screen
and entering the internal function of the set.
Okay, so let's get this together right now.
The first thing we need to know is the the exact activity we want to start.
And to get this information, we simply have to look back into the CV application once again.
So within apps and see here we have it and we are opening the Android manifest example.
So let's see.
Yes.
This is our file.
We have already observed us.
Nice.
Okay.
In this case, we are now having to.
We've got the p w list and also the file select activity which are being exported through.
And also the main locking activity which is implicit exported.
I mean, we only have to start one activity, DPW list activity because from there we can also reach
the file select activity.
So it doesn't give us an advantage.
If we have them separate, we can simply access this one via the P list activity.
So all our application needs to do is I mean, it's exactly the same like we have done this in the practical
part regarding to the activity manager, we need to tell our application to send out the request to
start the com nwr example c slash p w list activity.
Alrighty.
Okay, so let's get those information.
Okay.
So that's the package name.
And also let's get the activity name.
In this one.
So now the question, how can we do this?
And the answer for this one is an intent.
And don't worry, we will have an extensive look into Intense in the next couple of videos.
So for now, let's see this as some kind of preview.
All right.
So an intent is simply just some kind of message object.
And we can yeah, we can start certain things with this message object.
For example, we can start activities.
We can interact with broadcast receivers and also services.
In our case, right now we want to start an activity and we can define our message object and then send
it out with the method start activity and our message object.
In our intent.
We need to define the component we want to start, which is this one over here in this part, and then
the application or the smartphone verifies if we are allowed to perform this action and in case if we
are, then the smartphone accepts our message.
And yeah, I mean, the smartphone simply executes it.
All right.
And so let's do this.
So first, we need to define or create a new intent object.
And we can do this in the following way intent.
We name this intent, and then we are creating a new intent object.
Okay.
And here we are already getting our first arrow.
I mean, nice, right?
We have just written one line and it's already read.
But this one, I mean, it's easy to solve the application is complaining about the the class intent
is not known right now, but it also offers us an solution.
And do we want to include this class into our app?
And yeah, this is exactly what we want to have.
Therefore we click on intent and then hitting all enter and then the issue has been solved and with
an import we now have imported android content intent.
Okay, so far so good.
This was this was not that hot.
Right.
Now, next, we have to define our message object.
So we need to tell which activity we want to start.
So we need to address this and therefore we are using this package name and also the activity, this
class reference.
We can do this in the following way.
We are now using our intent and then we're using dot set component.
And within set component, we can see we have to provide a parameter and the parameter is a component
name.
So within our set component, we now have to define and component name.
And I mean we haven't defined one yet, so therefore we are creating a new one new component name.
And if you have now two options, I mean, we could also split this up.
I guess maybe that's a little bit easier to see.
So let's split this up.
Component name.
Okay.
So, yes, that's easier.
So this component name will be later on applied over here.
But but first, we have to define the component name.
Let me get this fixed.
Okay.
So now.
Now we can define the component name.
And the component name simply consists of our package name, which is this one.
And then the second parameter is the class reference.
So this one is our first one.
We apply this essence string.
Okay.
And we can already see the first one is a string of the package name and the second parameter is a string
of the class name.
The class name is simply just P.W. List.
So let's take this one.
Okay.
And that's all?
Yes.
Here we define a new component name.
Then we are using our message object and we are setting this component name.
And all we need to do right now is simply starting it.
Okay, so I'm not sure if this one is easier for you.
We could also write it in in shorter version in this one.
So that's exactly the same.
Now you have seen both.
And yeah, you can make the decision what's easier to read.
Okay, so now let's simply start our activity.
And there's already a method for, for tasks like this and the method is named start activity and we
can see we need to have an intent parameter.
So let's double click on this one and we are providing our intent and this is all so this is all we
need to do to start in code, to start the following activity.
Alrighty.
So when we install our application and opening this one, we are opening the we are starting the main
activity.
This main activity starts the on create.
This happens automatically.
We do not have to do anything and just clicking on the app icon.
And then within this method we are automatically creating a new intent.
We are setting a new component.
So we are defining.
We want to address the following class and the following package name, and then we simply say, Please
start this activity.
So our application is sending out this intent into the smartphone.
The smartphone receives this intent, looks it up and says, okay, let me try.
If you have the permission or the ability to start this activity in case if we have, then those activity
appears and otherwise we get an error.
Alrighty, let's do this.
So let's simply click this one run app.
So then the app will be built and it will be re installed.
All right.
Let's observe this on the smartphone.
And what should happen now is the following Our app should appear, but then afterwards directly the
CV applications should be start should be started.
So let's see.
This is our app and it looks good.
Doesn't look good.
Okay, it doesn't look good.
Let's see, we also got this locket error and I think it's related to the class name.
I guess within our application code this dot is not required.
But let's observe this.
Okay.
So he'll be having the locket.
And there was this score not met.
There are a lot of crashes.
Okay, let's go upwards a little bit.
Maybe let's search for our package over here.
So.
Com hacking?
Yes.
If you're searching for this now, it's easier to find this error.
So here we can see activity not found.
Exception.
Unable to find explicit.
You will have look into this one.
What this means activity class.
And here we have it.
Okay.
So DPW list activity has not been declared or it couldn't be found on the system right now.
The problem is regarding to the dot, so I would have assumed that it works, but it doesn't work.
It means beside the package name we also have to provide the full class name.
This means this dot is simply just in reference for this one.
So we need to append it, I guess, in the following way.
This is the package name.
Yes.
And this one he has now the complete class path to our P.W list activity.
Okay, so let's see if this works and let's run this and open the emulator.
Nothing happened so far.
Not sure.
Let's see.
Yes.
Nice deceive activity has been started and we can see it's working right now.
So all we have to do to demonstrate this behavior is simply closing this application once again.
So here we are back.
Unfortunately, the emulator did freeze for me right now and I had to restart it.
But that's not a big deal.
It simply restarted.
And then we are good to go.
All righty.
If you now want to demonstrate this behavior, we do not have to have Android, studio open or things
like this.
So let's close this one over here.
Okay.
We are now having everything on our smartphone.
All we need to do is we show it to the customer.
All right, let's start this application.
So here we have now to enter and password and we do not know this password.
So let's do this test.
Password is incorrect.
Okay, we.
We.
We cannot log in right now, but let's go back.
And what's.
And let's start our application, the safe locking bypass application.
So let's do this in 3 to 1.
Okay.
He.
It will be opened and we do nothing.
Now we are in this application.
So if you go, for example, into settings.
Then we can also execute all the stuff.
Let's see where we start from SD card.
Do we have back up already?
I mean, we have created once, but not sure if it has been deleted.
Yes.
Yes, we can see we've got access to the backup.
Okay.
So we can see we we can use this to bypass the logging screen even by not having access to the ADB shell.
All righty.
Okay.
So this is all for this video right now.
And the next one we will have a deep look into in text because these are amazing.
Also, if you have to explore them.
I'm looking forward to see you there.