Welcome back, guys.
We have reached the end of this chapter over here.
And this is also the perfect moment to make the transition into the next one where we talk about runtime
manipulation in the next step that we will extensively talk about freedom, which is an really amazing
framework.
I mean, this one, it's it's mind blowing.
Many tools have been built up as some kind of wrap up for this freedom framework.
And one of them is abstraction.
This framework has some prepared scripts that tries to solve our basic tasks and for example, patching
away certificate pinning or the routine detection.
And this is where we get back to this point over here, patching away a certificate pinning.
But this time it's not regarding to Smiley.
In this time it will be done in the memory of this application, which is absolutely amazing.
So if you have to deal with certificate pinning, objection can come super handy this framework at all
and in case abstraction should fail.
So if abstraction is not able to perform this task, then we are now skilled enough to perform this
by ourself so we can do this also in smiley on our own right now, which is also pretty amazing.
But to be honest, by not going for the easiest way in this case, it would be simply just running abstraction
and disabling the certificate pinning.
Therefore, let's have a look into this framework, how it works and how we can perform these tasks.
Let's go.
So here we are now.
Do you want to be m Let's have a look how objection is able to get rid of this certificate pinning over
here.
As already mentioned, objection is based on free de and free de isn't really amazing framework.
So we will have an extensive look into freedom within the next chapter.
If you do not understand some certain parts over here, this is absolutely no problem because we haven't
talked about them yet.
We will discuss them in the next chapter.
I just want to give you an preview of what abstraction is capable to do, what runtime manipulation
is, and how you can deal with certificate pinning by not patching this code.
All righty.
Okay, so let's have a look into our setup over here.
We start with a very clean one.
So our regulatory setup, then we will verify if the application really works after we will establish
our man in the middle connection and then the application should not work anymore.
And then we will use abstraction to make this application work again.
So we will use abstraction to perpetuate the certificate pinning, but this time it will be a runtime
approach.
So abstraction will connect to this process and yeah, it will modify the memory that this certificate
pinning has gone.
Absolutely amazing, right?
Absolutely.
So let's start right now.
Okay.
So first, let's verify our setup.
Is it running?
No, that's great.
So we plug it in and let's see.
There we have it.
Now let's make sure that no IP travel rules are being enabled.
So we get our router and then we print out the the IP table rules which are listed for the table.
Not nothing in here.
That's great.
All right, now we install our application and we start with the certificate pinning.
Underscore search.
So let's get back our smartphone.
Whoops.
Hasn't been installed here.
That's also great.
New terminal apps and certificate pinning underscore cert.
And of course, we use the original version of the modified version.
And this one over here.
All right.
This should work right now if we have an Wi-Fi connection.
So let's fix this one real quick.
WI fi connect.
Now we are connected.
Now it should work.
So let's start this application.
Send request.
Yes.
Here we have it.
Successful.
Okay.
Nice.
The app is working.
The developer has done a great job.
All right, now let's start the burp suite.
So let's get into the burp suite and towards the burp suite.
And we run it over here.
We chose temporary projects in default settings.
And then the then proxy whoops, sorry, proxy options.
We select this interface 1042 0.1 and we also enable invisible proxy.
So the suite has been set up.
Nice.
All right.
So this time, we also disable the Hdcp support, because otherwise it will be way too confusing.
We can do this within the project options and then within http need disable this one.
Okay.
Now the burp suite has been set up.
Let's forward our packages to the burp suite and then we are done.
So let's get back our shell.
And now we want to apply our IP table rule regarding to the table nut.
We want to append a new pre routing rule regarding to TCP destination port 80.
We want to change the destination address to destination 1042 zero 188.
All right.
And there's also four, four, four, three.
Okay.
Setup is done.
Now, if you get into the history and if you hit this button again and let's see if the certificate
pinning works, yes, we get an error.
And also on the dashboard, we got this over here.
The client failed to negotiate on the TLS connection.
Maybe let's close this one and make this a little bit larger certificate.
And.
If you click this once again, we can see this number is increasing.
So the developer has also done a great job onto these certificate pinning.
Well done.
All righty.
So we have verified everything is working properly now.
And let's get rid of this certificate pinning approach with our objection framework or to be more exact,
with Frida.
Okay, so how can we do this?
First of all, we need to start and free the server which needs to be placed on the smartphone.
I have already done this and we will talk about this extensively in the next chapter.
Therefore, you can just lean back and watch.
Okay, so we get onto the smartphone and then we need to go into the data local temp directory because
that's the only directory that can run binaries.
So executables, therefore all these executables need to be placed here and yet the temp directory is
not in real time directory.
So even after restart we can see those binaries are still there.
Okay.
So this is now running on the smartphone.
Now we need a route to start this free server over here.
But you will also learn how you can use free without having root privileges.
And this is even more mind blowing because you can see in a moment what Frida is capable to do.
And yeah, having this on a non rooted device for an application, it's absolutely mind blowing.
Okay, but this time we need to stick to the root privileges.
Trust can make it not more complex right now.
All right.
So after getting these privileges, we start to free the server and this one is now running on the device.
So we put this on the right and this one here.
So it's running on the device.
Okay.
Now we can use abstraction to connect to this reader instance or here, to be more exact, into this
process over here.
And then we can manipulate this process memory.
Nice.
So let's see, we have to install objection of course first.
But this is simply just PIP three in style.
Objection.
Then this chop is done and then we can use objection.
And what we need to tell this objection to which process we want to connect in this case, this can
be done by a gadget.
And now we have to provide the package name of this application which is com app hacking and certificate
pinning.
Okay, now we can provide another parameter which is explore and this will open an interactive shell
to this to this process over here.
Okay.
And there we go.
Now we are connected to the certificate pinning application, and all we have to do is simply running
Android.
And here we have a lot of options, prepared scripts that objection can use and for example, interact
with the clipboard with the heap but the key store and disabling rooting detection also pretty nice.
And here we have our SSL pinning so we run Android as is opening disable that's all so we can see objection
has now hooked or Frida has hooked into the trust manager into the certificate pin and also enter this
one.
Let's see if this one really works and let's let's put this down here.
Okay.
And now within proxy history.
So let's see.
Send request.
There we go.
We have it.
Nice.
We have disabled certificate pinning with just this one liner.
Absolutely fantastic.
Right.
So we can now intercept and forward the stuff and we can see over here it's working.
So we can also now manipulate the response, of course, and let's solve this really quick.
So with an options, intercept responses at domain domain name matches any then we enabled the intercept
once again we had sent request.
That's the request.
And here we have the response.
Nuts.
It definitely works.
But we have already seen this by seeing the request in the burbs with over here.
So objection is absolutely great if you want to deal with certificate pinning.
But unfortunately it doesn't work all the time because we can see this over here.
Objection has some prepared scripts that do an amazing job regarding through these libraries, but sometimes
developer yeah, customize these libraries, apply their own patches, or they're using proprietary
libraries which are not known to objection.
In this case, unfortunately, it fails.
And this is also the case for the second application for the Underscore Hedge.
So let's have a look and let's minimize this one and then we uninstall this application.
Whoops.
Here we go.
Okay.
Now within apps, we have the certificate pinning underscore hash.
That's the original application.
Success.
If you now go into this one and hit the send request button, nothing happens.
But objection is also not connected anymore.
We can see within the dashboard these numbers are going to increase.
All right.
Objection has been connected to the last process.
So if we go back into this framework, we can see session detached.
If it closes application where objection is attached to, then objection, of course, loses the connection.
So we have to restart it, we simply exit out and then we have to run it once again because the developer
has provided the same package name for both applications.
Well done developer.
To be honest, it doesn't affect us overall.
It makes it a little bit easier by just simply running this command once again.
Okay, so now we attach to this process and let's disable it once again.
All right.
We can see it has found some certificate pin helper.
And now if you go back, let's keep it maybe in foreground once again.
So I'm sorry for this clicking around.
Okay, so happy history.
Now we have it.
I guess it sticks to the foreground.
All right, now let's see if abstraction has patched it away in send request pinning that fail, and
we can see as a side context in it.
So it seems to have done something, but it doesn't work.
So we do not see any requests over here.
And yeah, this means the certificate pinning has not been disabled.
Okay.
Yeah, so that's a little bit unfortunate, but we are now prepared and equipped with all the skills
to do this on our own.
We know how to reverse engineer and patch an application based on Smiley.
So we have done this in the past and if objection did fail, it's not a big deal for us right now.
We have to skin a knowledge to do this by ourself, which is super amazing.
So in total, using abstraction to get rid of certificate pinning is absolutely great.
And if this works, then take the easy way.
There's no need to get into this and patch it away manually in case if abstraction doesn't work.
You have all the skills and knowledge to do this on your own right now, which is even more amazing.
So we are now very prepared to deal with certificate pinning applications, right?
Absolutely.
All alrighty.
So this is the end of this chapter over here.
And then the next one we will take a look at runtime manipulation.
We will have an extensive look into the freedom framework, which is absolutely amazing.
We will have a lot of fun and for example, we will write our own trainer and trainer like you know
this from computer games.
They can enable and disable certain features.
And for example, we will write our trainer to make our player have infinite of lives, be invisible,
be invincible, have multiple shots, make a coin, reign and stuff like this.
So we will do a lot of amazing things with Frida and I'm really looking forward to see you in the next
chapter.