Lab Setup

Steps

  1. Install Android SDK
    1. Android Studio
    2. ADB
  2. Install following tools:
    1. Enjarify
    2. JD-GUI
    3. APKTool
    4. SignApk
    5. SQLite Browser
  3. Setup MobSF
  4. Setup Drozer

Install Android Studio

  1. Copy android-studio-ide-183.5522156-linux.tar.gz file from ./android-pentesting/installers/android-studio-ide path.

  2. Run following command:

    tar xvzf android-studio-ide-183.5522156-linux.tar.gz

  3. A new folder named as android-studio would be created in the destination path.

  4. Right-click on android-studio folder and select the option Open in Terminal, from the context menu.

  5. Run following command:

    $ ./bin/studio.sh

  6. Android Studio should start.

Install Android Debug Bridge

  1. Copy platform-tools_r28.0.3-linux.zip file from ./android-pentesting/installers/adb path.

  2. Open a terminal and run the following command:

    $  unzip platform-tools_r28.0.3-linux.zip
  3. A new folder named as platform-tools would be created in the destination path.
  4. Right-click on platform-tools folder and select the option Open in Terminal, from the context menu.

  5. Run following command:

    $ ./adb devices

Enjarify

  1. Install Python3.

  2. Install virtualenv by running following command:

     $ pip install virtualenv

  3. Create a virtual environment named as venv3:

     $ virtualenv -p /usr/bin/python3 venv3

  4. Activate the virtual environment by running following command:

     $ source venv3/bin/activate
 (venv3) $

    Note: To deactiavate the virtual environment, run the command deactivate.

  5. Copy enjarify-1.0.3.zip file from ./android-pentesting/installers path.

  6. Open a terminal and run the following command:

    $  unzip enjarify-1.0.3.zip

  7. A new folder named as enjarify-1.0.3 would be created in the destination path.

  8. Right-click on enjarify-1.0.3 folder and select the option Open in Terminal, from the context menu.
  9. Ensure that Python3 virtual environment is active (see step #4 above).

  10. Run following command to test if enjarify installation was successful:

    (venv3) $ ./enjarify.sh

JD-GUI

  1. Copy jd-gui-1.5.0.jar file from ./android-pentesting/installers path.

  2. Open a terminal and run the following command:

    $ java -jar jd-gui-1.5.0.jar

  3. A Graphical User Interface of JD-GUI tool should open.

APKTool

  1. Copy Linux wrapper script file apktool from ./android-pentesting/installers/Apktool/Wrapper/linux path.
  2. Copy apktool.jar file from ./android-pentesting/installers/Apktool path.

  3. Open a terminal and run following commands to make the files executable:

     $ chmod +x apktool
 $ chmod +x apktool.jar

  4. Move both files (apktool.jar & apktool) to /usr/local/bin directory by running following commands:

     $ sudo mv ./apktool.jar /usr/local/bin/
 $ sudo mv ./apktool /usr/local/bin

    Note: Root permissions are required.

  5. Type the command apktool in your terminal.

  6. Copy sieve.apk file from ./android-pentesting/ path.

  7. Open a terminal and run following command to decode the APK:

     $ apktool d sieve.apk

  8. Open a terminal and run following command to build the decoded application:

     $ apktool b sieve/ -o new_sieve.apk

SignApk

After the APK is built, it is important to sign it. The signature ensures that the app is genuine and comes from a trusted source.

  1. Copy sign.jar file from ./android-pentesting/installers path.

  2. Open a terminal and run following command to sign an APK:

     $ java -jar sign.jar new_sieve.apk

SQLite Browser

  1. Open a terminal and run following command to install sqlitebrowser:

     $ sudo apt-get install sqlitebrowser

  2. Start the SQLite browser by running following command:

     $ sqlitebrowser

Setup MobSF

  1. Open a terminal and run following command:

     $ sudo docker run -it -p 8000:8000 opensecurity/mobile-security-framework-mobsf:latest

  2. Open a browser and navigate to: http://127.0.0.1:8000/

  3. Upload an APK file and wait to see the results of static analysis.
  4. Copy MobSF_VM_0.3.ova file from ./android-pentesting/VM path.
  5. Open VirtualBox and import the copied OVA file.
  6. Start the imported virtual machine.
  7. While the VM is Booting up. Note down the VM IP.

  8. If the VM is not showing an IP, that means your Virtualbox network is not configured properly. Follow the steps given below.

    1. In VirtualBox, open the Host Network Manager (File > Host Network Manager)
    2. If a host network is not already present, create a new host network.
    3. In the host network's DHCP settings tab (viewable by clicking "Properties") make sure the "DHCP Enabled" box is checked.

  9. Once the VM Boots up, It will present a Lock Screen. The password for the Lock Screen is 1234.

    NOTE: If the VM does not boot up properly then you cannot perform Dynamic Analysis with MobSF VM.

  10. In your host machine, run the command ifconfig in a terminal, and note down the IP corresponding to the name of the Host-only Adapter (e.g, vboxnet0).

    NOTE: The VirtualBox Host-Only Adapter IP and MobSF VM IP should be in the same network range. If your MobSF VM IP and Adapter IP are in different network range, modify the Adapter IP to be in the same network range as that of MobSF VM IP.

  11. In the MobSF VM, go to Settings > Wi-Fi > WiredSSID.

  12. Long press on WiredSSID.
  13. Select Modify network.
  14. Set the Proxy IP as the Host/Proxy IP which you have obtained from the previous step (#10).
  15. Set port no as 1337.
  16. Save the settings and navigate to the Home Screen of MobSF VM.
  17. Wait for 30 seconds and take a snapshot of the MobSF VM in VirtualBox.
  18. Once the snapshot is saved, right click MobSF VM and select Show in File Manager.
  19. Open the File MobSF_VM_X.X.vbox in any Text Editor

  20. Search for the term <Machine uuid=.

    <Machine uuid="{851b9849-e6de-4c9a-a506-441e2902fcff}" name="MobSF_VM_0.2" OSType="Linux" currentSnapshot="{46d9gde4-b9cf-4cs2-b39f-99f88258d55d}" snapshotFolder="Snapshots" lastStateChange="2019-05-24T02:09:53Z">

  21. Note down the value of uuid as "VM UUID"

  22. Note down the value of currentSnapshot as "Snapshot UUID".

  23. Run following command and obtain the container ID (e.g., 6cjk1e37h81a):

    $ sudo docker ps -a | grep mobsf

  24. Run following command and copy the settings.py file to your host machine.

    $ sudo docker cp <CONTAINER_ID>:/root/Mobile-Security-Framework-MobSF/MobSF/settings.py ./

    Note: Replace <CONTAINER_ID> with actual value.

  25. Open the settings.py file in a text editor, and set appropriate values for UUID, SUUID, VM_IP and PROXY_IP:

    • UUID = VM UUID
    • SUUID = Snapshot UUID
    • VM_IP = VM IP
    • PROXY_IP = Host/Proxy IP

  26. Set ANDROID_DYNAMIC_ANALYZER = "MobSF_VM"

  27. Move the modified settings.py file into the running MobSF docker container by running following commands:

    $ sudo docker cp ./settings.py <CONTAINER_ID>:/root/Mobile-Security-Framework-MobSF/MobSF/settings.py

    Note: Replace <CONTAINER_ID> with actual value.

  28. Stop and restart the container by running following commands:

    $ sudo docker stop <CONTAINER_ID>
$ sudo docker start <CONTAINER_ID>

  29. This will configure MobSF to use Android VirtualBox VM for Dynamic Analysis.

Setup Drozer

  1. Copy Androl4b.ova file from ./android-pentesting/VM path.
  2. Open VirtualBox and import the copied OVA file.
  3. Start the imported virtual machine.
  4. When prompted for credentials, enter username as andro and password as andro.
  5. Click on the "Emulator" desktop icon.
  6. Start the drozer Agent app and ensure that "Embedded Server" is switched on.
  7. Click on Terminus icon from the bottom tray, and select the New terminal option.

  8. We need to set up a suitable port forward so that our PC can connect to a TCP socket opened by the drozer Agent inside the emulator, or on the device. By default, drozer uses port 31415. Run the following command in the terminal:

     $ adb forward tcp:31415 tcp:31415

  9. Start drozer CLI by running following command:

      $ drozer console connect

References

results matching ""

    No results matching ""