The next vulnerability in the login mechanism of insecure bank is the forgotten and hidden button for
admin users.
So we'll change the source code to display this button, rebuild, resign and reinstall it to the device.
All right, let's get started.
So let's make sure, first of all, that the Android emulator and application server are running.
What I'll do is I'll merge the two screens together so you can see the changes instantly cuz.
So now let's check to see if the Wi-Fi EDB is enabled and connect the emulator to Carly.
All right, so it looks like we're ready.
So first up, I want to show you the piece of code that has this vulnerability, so.
Let's go to the bytecode viewer.
And search for log in.
Find that method in a log in activity.
OK, here it is in the uncreate method.
So here, a check is performed to determine if a resource string called is admen set to know.
So if it's true and the set visibility eight method is used to set the button invisible without taking
any space for layout purposes.
So we can alter this value just by patching the application and changing the value from no to yes.
So let's open up terminal screen and change directory where the APK file is.
And we'll use something called a tool to decompiled the eight piqué.
So we'll run the APK Tool D Command and add the epic file.
OK, let's go to the decompiled APIC folder.
And the file that will change is in the values folder, under the resources folder.
Over the strings XML file with nanotech senator.
Scroll down.
Yes, it's here, we'll just switch no to yes, and that'll make it visible.
That's the hidden button, remember?
So we'll say the file and exit.
Now go back to the main directory.
And now we need to rebuild the RPK.
So run the ABCDE, who'll be command?
And now it's built.
So the mobile app will not allow you to install the rebuilt RPK on your emulator or phone without signing
it first, so to achieve this, we need to create a key store.
Give these parameters to generate a key and a password must be specified when creating the key store,
which will be needed later.
And here we can skip these steps.
Now in this step, right, yes.
OK, so see how that generates a RSA key pair.
And now it's in the current directory, so let's sign the APK with this key using Jaris Sinar.
The same one we used to sign the APK file is not secure, of course, but we've especially said it so
that we can exploit it.
So add the key store and the rebuilt APK file.
And place it under the desk folder after rebuilding.
Now we can finally add the alias and Aitor.
Now, enter the password that we used to creating my key store earlier.
All right, resigning is complete.
So let's verify that the APK has been signed using Zha Sinar.
So run Jah Seiner Dasch, verify, dash verbose dash certs.
And add the rebuilt APK file.
OK, so it's now verified.
So finally, the APK is aligned for optimal loading using a tool called Zippel Line.
So we'll install it quickly with a pseudo Apte install zip line command.
All right, so I already have it.
And to align the APK file and just run zip line with the dash V parameter, add four numbers.
So the four numbers define the bite alignment boundaries.
Now, it's always got to be four because that provides 32 bit alignment or else it basically does nothing.
So then you can add the existing APIC file.
If a full path and a name for the new APK file.
OK, so the AK is now aligned and ready to install onto the device.
Now, before installing the new APIC, we need to uninstall the old one from the device, so we'll go
to Yapp.
So just click and hold on the app info.
And uninstalling.
All right.
Now we can install the new APIC to the device with ADB, so first let's check the device will go to
the directory.
And this is where you created the new APIC.
Run, ADB install and new APK file.
As you can see in the screen, there is a warning because we installed the older version of the app.
After Android six Dotto Marshmallow Google Play, Protech started warning users when they try to install
apps targeting older Android versions.
But for you and for me right now will continue and disregard it because we want to test this AP Kaifa.
All right, so as you can see, we have a success message and the new APK file is now installed.
So Google Play Protect also asks us to scan the app, so we'll assume that the user didn't send an app
for scanning, let's open the insecure bank application.
And like I said before, the version of Android 10 will ask us to access these files.
Prior Android six, you could reasonably assume that if your app is running, it will grab all of the
permissions that it will declare in the app manifest.
And for security testing, we will assume that the user has granted full access permissions for these
files.
And what are you looking at?
We made the hidden button visible.
So when he click on the button, you'll see that no function has been defined for this button yet.
And it doesn't actually allow us to create a user, but.
It could also have been defined and you could pose a great risk, you get it.
The important thing here in this test is that we can statically change the function of the application.