- Hello all and welcome to the Android Security and Exploitation training series
by Pentester Academy. My name is Aditya and I'm your course instructor for this
particular video training series. You're watching this video on
PentesterAcademy.com and if you want to go for the certifications you can
go to securitytube-training.com. So in the previous few videos, we had look at
Drozer and how you can use Drozer to exploit vulnerabilities in the content
providers. Now in this particular video, we are going to have an application called
CSIP Simple, which looks quite secure in the start. But if you look deeper into the
application, you will see the vulnerabilities. Now this application uses
custom permissions to protect the content providers from being exploited. Now, what
this actually means is an application can define their own permissions and use it to
prevent the content providers from being queried by another application. Now, one
of the things which developers often miss in this particular scenario is whenever
you are defining a custom permission make sure the permissions are also protected by
signature. That means whenever you're protecting a content provider the Android
checks for both the permission as well as the signature of the application. Now,
there could be one of the thing that could happen in this scenario is we can have
Drozer ask for the same set of permissions and then exploit the vulnerable content
providers. Now, this vulnerability was discovered by Joshua Drake, in his book
the Android Hackers Handbook which is a really interesting read if you want to
look deep into the Android security and internals. Let's jump into this
vulnerability. So I have got Santoku running and I'll go to
Downloads/training/vulnapps/ and let's make a folder CSIPSimple, and we see
CSipSimple.apk to CSIPSimple. Here I have the CSipSimple.apk and it's also installed
on my device here. And one of the things I have set over here is the outgoing
Filters. These are the two outgoing filters rule which I have written and I
will now try to query them using Drozer. So let's start up Drozer and let's see if
we can query this particular one. Before that, let's install a new version of
Drozer, which is a fresh installation of Drozer. So let's uninstall the previous
one com.mwr.dz and look for agent.apk. Install. /home/adi/Downloads/agent.apk .
So, the new Drozer has been installed and I can start up the new Drozer. So the
first thing is I will look for the package name of CSIP Simple. So, in order to look
for the package name, you can do app.package.list -f csipsimple. So, this
will give me the package name of the applications CSIP Simple. Another way to
look for the package name is you can just do a quick adb shell ps and it will show
you a list of all the running processes and you can grab the package name from
there. So, adb shell ps grep -I csip. So, here you get the package name, also in the
meanwhile Drozer also found it. Once we have the package name, now we can go ahead
and find out the content providers URIs for this particular application. So we can
do run app.provider.finduri and parse in the package name. So this will list down
all the different content URIs which the application has. Now, this is the list of
all the different content URIs and we can select any of them and try to query them.
So in this case, let's go for outgoing filters`because we have set up a few
outgoing filters which we'd like to query. I can do run app.provider.query and it
shows me an error which says permission denial because in order to open this
particular content provider or the database, it needs this particular
permission. Interesting. So what we can do here is, we can decompile the CSIP Simple
application. And look into how it's asking for permissions. Vulnerable applications,
CSIP Simple. Here we have the CSIPSimple apk. So apktool d and then CSIPSimple.apk.
The application is now decompiled and if you go inside the applications decompiled
folder and look into the AndroidManifest.xml, you'll see that there
is a permission uses which looks something different from the normal Android
permissions. So this says android.permission. CONFIGURE_SIP and
there's another permission android.permission. USE_SIP. If you'll
look down there's also the permission declaration over here. So what we can do
here is we can simply copy these permissions to the Drozer's
AndroidManifest.xml and recompiled Drozer and then try out the same query with the
new compiled Drozer. Let's do that. So here we are. Let's open this in leafpad so
it's easy for us to copy and paste. Leafpad CSIP AndroidMainfest.xml. Put it
in the background and also let's copy the agent.apk which is a Drozer application.
So apk tool d agent.apk. And also open up Drozer's AndroidManifest.xml. Now we have
the two AndroidManifest.xml opened with us. So all we need to do is simply copy
the permission declaration and the uses from csipsimple AndroidManifest.xml to the
Drozer's AndroidManifest.xml. We'll copy this over here and also copy the uses.
These two lines. So paste it over here. It looks like everything is done. There's
just one small thing missing over here. This is our agent's AndroidManifest.xml
and if you look here like android:label, this is not a regular hard coded string.
This is actually a reference to a file strings.xml and a string which has a tag
permlab_useSip and the same for permlab_configureSip, and
pemdesc_configureSip, permdesc_use. So these are the four tags which we have to
copy from the strings.xml of csipsimple to the Drozer's string.xml. Let's save this
particular file and close it. Close that. Now let's open the strings.xml for both
the files. So CSipSimple/res/values/strings.xml and
similarly for Drozer, agent/res/values/strings.xml. We'll copy
from the CSipSimple's strings.xml to the Drozer' strings.xml. So you can paste
any way you like in the strings.xml. You can just save it. Close. Now we have the
agent modified and now we can recompile it into a new Drozer's agent. You can simply
use apktool, b for build and then agent -o let's say newagent.apk. I will compile
the newagent.apk with the additional permissions which we have just now given.
Let's wait for it to get compiled. So now it has been compiled and the only thing
left is to sign the newagent.apk. Let's copy the certificate from Downloads, CTF,
cocon, my keystore. Let's copy the signing.txt.
This is the newagent.apk and the password is android. Invalid keystroke format.
Okay.my-release-key.keystore. Cat signing.txt, newagent.apk. Okay. So let's
do one thing, let's copy this newagent.apk to the location where the cocon exists
training/CTF/cocon. Go to that location CTF/cocon. So here we have the
signing.txt. You can change it to newagent.apk as that is our application
name. Save it, cat signing.txt, password is android and it again says Invalid
keystore format. Now this is an interesting error because... Okay, so this
is because the my-release-key.keystore is not a valid one. So let's look for
where else this is present and we can copy this in there. So let's copy this one from
here. So there was an issue with the keystore because it accidently got mixed
but with the correct keystore, it works and the application is now signed. So now
we can install the application and before that we'll uninstall the previous one.
Install agent new agent.apk. And here we can start up Drozer again with the new
agent.apk. In the earlier case, we were getting a permission denial message. So
let's try the same content provider query with this one, - - vertical. Okay, so now
it works. This is how we have bypassed the permission protection of the content
provider because it wasn't protected along with the signature. So this is some of the
vulnerable implementation of security which you'll see with the content
providers. Now we can play around with a lot many different applications, you can
see into how they are protecting the application and you can figure out a way
to bypass it. So that's all for this video. I hope you enjoyed it and if you
have any more feedback or queries, feel free to reach out to me at adi@attify.com
or you can tweet me @adi1391. Thanks a lot.