OWASP MASTG Lab Uncrackable1

When we open UnCrackable-Level1.apk in JADX-GUI, it was observed that code checks using three functions (a, b, and c) that the device is rooted.

1. Function a: iterates all paths separated by ":" and adds "su" to the string to check if the path exists; if it exists, then it is considered that the phone is rooted by returning true.
2. Function b: checksBuild.TAGS, Android has build information like release-keys (null means rooted) and test-keys (contains means rooted device).
3. Function c: checks for common root files.

Pentester Mindset:

1. This root detection can be bypass using Frida, which can modify methods inside the class.
2. Secondly, prevent the app from closing using System.exit.implementation.
3. Hook AES Class: Suppose the code workflow is App-> decrypt()-> AES-> Plaintext

But after Frida the call becomes

App -> Frida Hook -> Original decrypt() -> Plaintext -> Print Secret -> Return Plaintext.

Creating a Frida Script(hook.js):

Java.perform(function () { console.log("[*] Target Hook Loaded");

// 1. Bypass Root Detection var RootCheck = Java.use("sg.vantagepoint.a.c"); RootCheck.a.implementation = function () { return false; }; RootCheck.b.implementation = function () { return false; }; RootCheck.c.implementation = function () { return false; };

// Prevent System.exit from killing the app var System = Java.use("java.lang.System"); System.exit.implementation = function (code) { console.log("[*] Prevented System.exit(" + code + ")"); };

_// 2. Hook AES Decryption to leak the secret var AES = Java.use("sg.vantagepoint.a.a"); AES.a.implementation = function (key, ciphertext) { var decryptedBytes = this.a(key, ciphertext);

var secret = ""; for (var i = 0; i < decryptedBytes.length; i++) { secret += String.fromCharCode(decryptedBytes[i]); }

console.log("[+] Intercepted Flag: " + secret); return decryptedBytes; }; });_

Start the Frida server in the victim machine and find the package name of the Android app.

❯ frida -U -f owasp.mstg.uncrackable1 -l hook.js

1. Enter any dummy text into the app input field.
2. Click Verify.
3. The flag was received.
4. Flag:_ I want to believe_

Lab solved: