So here we are back at our familiar Ubuntu VM.
And what we've done so far is we always decompile an application, modify it, build it back again,
and then we have signed this application with our own certificate.
Wouldn't it be nice if we can modify an existing application with the original certificate?
I guess this depends on the view because this would also mean that the complete Android system would
be broken and that you can infect people with malware by having original certificates.
So for me, I would say no, this wouldn't be that nice.
But for an attacker, of course this would be ridiculous.
Nice.
And this was the approach of this vulnerability.
An attacker could modify an existing application with the original certificate by exploiting a nice
behavior during the verification of this process.
But before we jump right into this, let's verify what would happen if you modify an existing application
and therefore I go into our original application directory first.
So I open the files app's space pane and here we have the APK file.
We can double click or right click open with Archive Manager and then we've got the zip archive where
we can directly at those files.
So we go into the assets directory and we use a file which is not in binary form.
So no Excel files.
Let's see.
Skin.
You eyes, skin.
Jason, this one right here.
Okay, now we open this one and we make our modification.
We say, for example, this one is now a two.
We save this file.
Do we say update?
And now we have modified this APK archive right here and let's install this application.
So I right click, say open a new terminal because then I'm already in this directory right here.
And then I say ADB connect and ADB install this application.
Now it says, oh, there is some check and the check failed because.
The manifest.
MV has an invalid digest, and this is why we get through this whole process.
What these hashes are for and things like this in deciding section just before.
So we know how to calculate this one and why the digest has been changed right now.
So let's do this real quick.
So we go into the asset directory, we go into skin, then we open the UI skin trace, and then we make
also here our modification.
And then we use this file now to calculate our SHA1 sum.
So open as is l sha one binary ui skin dot chaisson.
All right, now we pipe this through base64 and we replace now this value in the package archive.
So I open this in a new terminal space pane.
This one right here.
MI ten directory.
Manifest MF and we look for UI skin dot shades and you do not need to do this because it will be a dead
end at the end so you can sit back and relax while I'm doing this.
We have now modified this one right here, and we also need to change the the hash in the signature
file.
Therefore, I copy paste this one right here.
And then we use the album as a command regarding to the name and one digest to calculate the signature
file hash.
So this is one this one right here.
If these things are too complex, an easier way would be to make this modification in our original application.
So decompile this app, make this modification, and then build this app back again.
Because then all those hashes has been automatically updated and we can simply copy paste them out from
there.
But yeah, we are also ready for now.
So this isn't really faster, but it's way easier.
All right, here we have this second signature.
So we after changing this one, did I update us?
I guess?
Yes.
Let's verify this really quick that I do not mess up something during this copy paste process.
So you guys can.
It's this one.
Yep, that's correct.
All right.
And now we go into the signature file.
This one right here.
You guys can and this one needs to be replaced right now with this one here.
So we adjusted those hashes.
This is a normal operation and everyone can do this.
Let's see what happens if we try to install this application right now.
We hit update, we close all those windows.
Oops.
And now we say open a new terminal and we say ADB installer.
All right.
We still get an error, but it's not related to the manifest EMF anymore.
It's regarding two failed certificate, failed verification in the signature file.
Right here.
So here we can see we've got a new error.
This is now regarding to install pass fail, no certificates.
It's not with the manifest EMF.
We have calculated this hashes.
Correct.
And we also place them in the correct position.
So this part has been successful, but now it says install pass fail certificate by adjusting those
files or modifying those files.
We did break the signature of this APK and this is something we cannot yet correct because this is something
that only the developer can do by having the private key.
So we do not have the private key and therefore we are not able to modify these files.
So how was this exploit even possible to circumvent this issue?
Well, it did not circumvent the signing process because this is pretty stable and you build probably.
So there's no issue within the signing process.
But there's an issue within the verification process.
And this is something I would like to show you right now.
Okay.
So here I have restored the original version because we have modified the last one.
So we have a clean base and we can install this application just to make sure that it's the original
one and we can install this.
Yeah.
Success.
Okay.
So if you open this, we cannot modify those files.
But what about adding in file?
Well, let's see.
Let's take for example.
This one right here, the APK to meter information.
All right.
It has been packed into the file.
Now let's try to install this one.
Here we have the error that there is no entry for this file available in the application.
So adding completely new files does not work.
But what happens if we add a file with the exact same name?
For example, if we add a new class text file.
So let's find this out.
First, I'm going to delete this one that we get the original state back and now we add a new class
text file with exactly the same name.
So let's see what happens.
And here we've got this class stored text.
So let's see what happens if we drag and drop this one right into this.
We can see the file size has been changed, so this file has been overwritten.
It's also not working this way, so we cannot add to files with the exact same name into one single
zip directory.
What can we.
Well, let me get the original state right here and then.
Yeah, let's have a look how this one would work.
All right.
Here I have restored the original value back again.
We can see the date is the same and also 2.1 and B, so this is the original class, the text file from
this base paying application right here.
I go back into our CIF application right here and then.
I renamed this file because adding new files with new file names is possible.
So we rename the list to class with set at the end.
And now we put this into here and we can see, yes, we have both classes, text and classes with set
at the end.
Now let's open this zip archive in in hex editor.
So I go back to the space patent application, this one right here, and I say open terminal cheeks
and this application all right here, we already can see those five names.
So we are looking for.
Class starts with the set dot x, and here we have one.
And what we now do is we simply change this binary content by pressing this set and replacing it with
an SSE.
All right.
Now find the next one.
Here's one again.
And the next one, that's all.
Now, let's save this file and open it back again to see what has changed.
So I open it and voila, we've got to exact five names into one zip archive.
So now is the question what would happen if we installed this application?
Which classes?
The text will be installed?
Well, the answer is the last one that has been added by the attacker, and this was the exact vulnerability.
So by having to exact five names in the zip archive, the last one gets installed and not the previous
one.
And this one also does not get checked.
So the last one, the attacker is able to provide a new complete source code into this application.
This could be the original one which has been modified or even a complete different application.
And having the original certificate and this is ridiculous, amazing because it's like, yeah, the
circumvention of the security issue is so genius.
I'm super excited about this one.
This is what hacking is about.
And yeah, this is something you get with a lot of practice and thinking creative, and this comes handy
for maybe other applications for you.
So let's assume you have a customer application and they perform the verification in the same way that
the Android system did in 2013.
Therefore, you can bypass this with this check, or at least maybe you can bypass this.
This is something you should try out at this point after having some relaxing session.
Now you get your hands dirty.
You have to hack this application.
So let's face the challenge and modifying this application.