Android app抓包场景详解

Java.perform(function() {/*hook list:1.SSLcontext2.okhttp3.webview4.XUtils5.httpclientandroidlib6.JSSE7.network_security_config (android 7.0+)8.Apache Http client (support partly)9.OpenSSLSocketImpl10.TrustKit11.Cronet*/       // Attempts to bypass SSL pinning implementations in a number of       // ways. These include implementing a new TrustManager that will       // accept any SSL certificate, overriding OkHTTP v3 check()       // method etc.       var X509TrustManager = Java.use('javax.net.ssl.X509TrustManager');       var HostnameVerifier = Java.use('javax.net.ssl.HostnameVerifier');       var SSLContext = Java.use('javax.net.ssl.SSLContext');       var quiet_output = false;       // Helper method to honor the quiet flag.       function quiet_send(data) {              if (quiet_output) {                     return;              }              send(data)       }       // Implement a new TrustManager       // ref: https://gist.github.com/oleavr/3ca67a173ff7d207c6b8c3b0ca65a9d8       // Java.registerClass() is only supported on ART for now(201803). 所以android 4.4以下不兼容,4.4要切换成ART使用.       /*06-07 16:15:38.541 27021-27073/mi.sslpinningdemo W/System.err: java.lang.IllegalArgumentException: Required method checkServerTrusted(X509Certificate[], String, String, String) missing    06-07 16:15:38.542 27021-27073/mi.sslpinningdemo W/System.err:     at android.net.http.X509TrustManagerExtensions.(X509TrustManagerExtensions.java:73)        at mi.ssl.MiPinningTrustManger.(MiPinningTrustManger.java:61)06-07 16:15:38.543 27021-27073/mi.sslpinningdemo W/System.err:     at mi.sslpinningdemo.OkHttpUtil.getSecPinningClient(OkHttpUtil.java:112)        at mi.sslpinningdemo.OkHttpUtil.get(OkHttpUtil.java:62)        at mi.sslpinningdemo.MainActivity$1$1.run(MainActivity.java:36)*/       var X509Certificate = Java.use("java.security.cert.X509Certificate");       var TrustManager;       try {              TrustManager = Java.registerClass({                     name: 'org.wooyun.TrustManager',                     implements: [X509TrustManager],                     methods: {                            checkClientTrusted: function(chain, authType) {},                            checkServerTrusted: function(chain, authType) {},                            getAcceptedIssuers: function() {                                   // var certs = [X509Certificate.$new()];                                   // return certs;                                   return [];                            }                     }              });       } catch (e) {              quiet_send("registerClass from X509TrustManager >>>>>>>> " + e.message);       }       // Prepare the TrustManagers array to pass to SSLContext.init()       var TrustManagers = [TrustManager.$new()];       try {              // Prepare a Empty SSLFactory              var TLS_SSLContext = SSLContext.getInstance("TLS");              TLS_SSLContext.init(null, TrustManagers, null);              var EmptySSLFactory = TLS_SSLContext.getSocketFactory();       } catch (e) {              quiet_send(e.message);       }       send('Custom, Empty TrustManager ready');       // Get a handle on the init() on the SSLContext class       var SSLContext_init = SSLContext.init.overload(              '[Ljavax.net.ssl.KeyManager;', '[Ljavax.net.ssl.TrustManager;', 'java.security.SecureRandom');       // Override the init method, specifying our new TrustManager       SSLContext_init.implementation = function(keyManager, trustManager, secureRandom) {                  quiet_send('Overriding SSLContext.init() with the custom TrustManager');              SSLContext_init.call(this, null, TrustManagers, null);       };       /*** okhttp3.x unpinning ***/       // Wrap the logic in a try/catch as not all applications will have       // okhttp as part of the app.       try {              var CertificatePinner = Java.use('okhttp3.CertificatePinner');              quiet_send('OkHTTP 3.x Found');              CertificatePinner.check.overload('java.lang.String', 'java.util.List').implementation = function() {                     quiet_send('OkHTTP 3.x check() called. Not throwing an exception.');              }       } catch (err) {              // If we dont have a ClassNotFoundException exception, raise the              // problem encountered.              if (err.message.indexOf('ClassNotFoundException') === 0) {                     throw new Error(err);              }       }       // Appcelerator Titanium PinningTrustManager       // Wrap the logic in a try/catch as not all applications will have       // appcelerator as part of the app.       try {              var PinningTrustManager = Java.use('appcelerator.https.PinningTrustManager');              send('Appcelerator Titanium Found');              PinningTrustManager.checkServerTrusted.implementation = function() {                     quiet_send('Appcelerator checkServerTrusted() called. Not throwing an exception.');              }       } catch (err) {              // If we dont have a ClassNotFoundException exception, raise the              // problem encountered.              if (err.message.indexOf('ClassNotFoundException') === 0) {                     throw new Error(err);              }       }       /*** okhttp unpinning ***/       try {              var OkHttpClient = Java.use("com.squareup.okhttp.OkHttpClient");              OkHttpClient.setCertificatePinner.implementation = function(certificatePinner) {                     // do nothing                     quiet_send("OkHttpClient.setCertificatePinner Called!");                     return this;              };              // Invalidate the certificate pinnet checks (if "setCertificatePinner" was called before the previous invalidation)              var CertificatePinner = Java.use("com.squareup.okhttp.CertificatePinner");              CertificatePinner.check.overload('java.lang.String', '[Ljava.security.cert.Certificate;').implementation = function(p0, p1) {                     // do nothing                     quiet_send("okhttp Called! [Certificate]");                     return;              };              CertificatePinner.check.overload('java.lang.String', 'java.util.List').implementation = function(p0, p1) {                     // do nothing                     quiet_send("okhttp Called! [List]");                     return;              };       } catch (e) {              quiet_send("com.squareup.okhttp not found");       }       /*** WebView Hooks ***/       /* frameworks/base/core/java/android/webkit/WebViewClient.java */       /* public void onReceivedSslError(Webview, SslErrorHandler, SslError) */       var WebViewClient = Java.use("android.webkit.WebViewClient");       WebViewClient.onReceivedSslError.implementation = function(webView, sslErrorHandler, sslError) {              quiet_send("WebViewClient onReceivedSslError invoke");              //执行proceed方法              sslErrorHandler.proceed();              return;       };       WebViewClient.onReceivedError.overload('android.webkit.WebView', 'int', 'java.lang.String', 'java.lang.String').implementation = function(a, b, c, d) {              quiet_send("WebViewClient onReceivedError invoked");              return;       };       WebViewClient.onReceivedError.overload('android.webkit.WebView', 'android.webkit.WebResourceRequest', 'android.webkit.WebResourceError').implementation = function() {              quiet_send("WebViewClient onReceivedError invoked");              return;       };       /*** JSSE Hooks ***/       /* libcore/luni/src/main/java/javax/net/ssl/TrustManagerFactory.java */       /* public final TrustManager[] getTrustManager() */       /* TrustManagerFactory.getTrustManagers maybe cause X509TrustManagerExtensions error  */       // var TrustManagerFactory = Java.use("javax.net.ssl.TrustManagerFactory");       // TrustManagerFactory.getTrustManagers.implementation = function(){       //     quiet_send("TrustManagerFactory getTrustManagers invoked");       //     return TrustManagers;       // }       var HttpsURLConnection = Java.use("javax.net.ssl.HttpsURLConnection");       /* libcore/luni/src/main/java/javax/net/ssl/HttpsURLConnection.java */       /* public void setDefaultHostnameVerifier(HostnameVerifier) */       HttpsURLConnection.setDefaultHostnameVerifier.implementation = function(hostnameVerifier) {              quiet_send("HttpsURLConnection.setDefaultHostnameVerifier invoked");              return null;       };       /* libcore/luni/src/main/java/javax/net/ssl/HttpsURLConnection.java */       /* public void setSSLSocketFactory(SSLSocketFactory) */       HttpsURLConnection.setSSLSocketFactory.implementation = function(SSLSocketFactory) {              quiet_send("HttpsURLConnection.setSSLSocketFactory invoked");              return null;       };       /* libcore/luni/src/main/java/javax/net/ssl/HttpsURLConnection.java */       /* public void setHostnameVerifier(HostnameVerifier) */       HttpsURLConnection.setHostnameVerifier.implementation = function(hostnameVerifier) {              quiet_send("HttpsURLConnection.setHostnameVerifier invoked");              return null;       };       /*** Xutils3.x hooks ***/       //Implement a new HostnameVerifier       var TrustHostnameVerifier;       try {              TrustHostnameVerifier = Java.registerClass({                     name: 'org.wooyun.TrustHostnameVerifier',                     implements: [HostnameVerifier],                     method: {                            verify: function(hostname, session) {                                   return true;                            }                     }              });       } catch (e) {              //java.lang.ClassNotFoundException: Didn't find class "org.wooyun.TrustHostnameVerifier"                  quiet_send("registerClass from hostnameVerifier >>>>>>>> " + e.message);       }       try {              var RequestParams = Java.use('org.xutils.http.RequestParams');              RequestParams.setSslSocketFactory.implementation = function(sslSocketFactory) {                     sslSocketFactory = EmptySSLFactory;                     return null;              }              RequestParams.setHostnameVerifier.implementation = function(hostnameVerifier) {                     hostnameVerifier = TrustHostnameVerifier.$new();                     return null;              }       } catch (e) {              quiet_send("Xutils hooks not Found");       }       /*** httpclientandroidlib Hooks ***/       try {              var AbstractVerifier = Java.use("ch.boye.httpclientandroidlib.conn.ssl.AbstractVerifier");              AbstractVerifier.verify.overload('java.lang.String', '[Ljava.lang.String', '[Ljava.lang.String', 'boolean').implementation = function() {                     quiet_send("httpclientandroidlib Hooks");                     return null;              }       } catch (e) {              quiet_send("httpclientandroidlib Hooks not found");       }       /***android 7.0+ network_security_config TrustManagerImpl hookapache httpclient partly***/       var TrustManagerImpl = Java.use("com.android.org.conscrypt.TrustManagerImpl");       // try {       //     var Arrays = Java.use("java.util.Arrays");       //     //apache http client pinning maybe baypass       //     //https://github.com/google/conscrypt/blob/c88f9f55a523f128f0e4dace76a34724bfa1e88c/platform/src/main/java/org/conscrypt/TrustManagerImpl.java#471       //     TrustManagerImpl.checkTrusted.implementation = function (chain, authType, session, parameters, authType) {       //         quiet_send("TrustManagerImpl checkTrusted called");       //         //Generics currently result in java.lang.Object       //         return Arrays.asList(chain);       //     }       //       // } catch (e) {       //     quiet_send("TrustManagerImpl checkTrusted nout found");       // }       try {              // Android 7+ TrustManagerImpl              TrustManagerImpl.verifyChain.implementation = function(untrustedChain, trustAnchorChain, host, clientAuth, ocspData, tlsSctData) {                     quiet_send("TrustManagerImpl verifyChain called");                     // Skip all the logic and just return the chain again :P                     //https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2017/november/bypassing-androids-network-security-configuration/                     // https://github.com/google/conscrypt/blob/c88f9f55a523f128f0e4dace76a34724bfa1e88c/platform/src/main/java/org/conscrypt/TrustManagerImpl.java#L650                     return untrustedChain;              }       } catch (e) {              quiet_send("TrustManagerImpl verifyChain nout found below 7.0");       }       // OpenSSLSocketImpl       try {              var OpenSSLSocketImpl = Java.use('com.android.org.conscrypt.OpenSSLSocketImpl');              OpenSSLSocketImpl.verifyCertificateChain.implementation = function(certRefs, authMethod) {                     quiet_send('OpenSSLSocketImpl.verifyCertificateChain');              }              quiet_send('OpenSSLSocketImpl pinning')       } catch (err) {              quiet_send('OpenSSLSocketImpl pinner not found');       }       // Trustkit       try {              var Activity = Java.use("com.datatheorem.android.trustkit.pinning.OkHostnameVerifier");              Activity.verify.overload('java.lang.String', 'javax.net.ssl.SSLSession').implementation = function(str) {                     quiet_send('Trustkit.verify1: ' + str);                     return true;              };              Activity.verify.overload('java.lang.String', 'java.security.cert.X509Certificate').implementation = function(str) {                     quiet_send('Trustkit.verify2: ' + str);                     return true;              };              quiet_send('Trustkit pinning')       } catch (err) {              quiet_send('Trustkit pinner not found')       }       try {              //cronet pinner hook              //weibo don't invoke              var netBuilder = Java.use("org.chromium.net.CronetEngine$Builder");              //https://developer.android.com/guide/topics/connectivity/cronet/reference/org/chromium/net/CronetEngine.Builder.html#enablePublicKeyPinningBypassForLocalTrustAnchors(boolean)                  netBuilder.enablePublicKeyPinningBypassForLocalTrustAnchors.implementation = function(arg) {                     //weibo not invoke                     console.log("Enables or disables public key pinning bypass for local trust anchors = " + arg);                     //true to enable the bypass, false to disable.                     var ret = netBuilder.enablePublicKeyPinningBypassForLocalTrustAnchors.call(this, true);                     return ret;              };              netBuilder.addPublicKeyPins.implementation = function(hostName, pinsSha256, includeSubdomains, expirationDate) {                     console.log("cronet addPublicKeyPins hostName = " + hostName);                     //var ret = netBuilder.addPublicKeyPins.call(this,hostName, pinsSha256,includeSubdomains, expirationDate);                     //this 是调用 addPublicKeyPins 前的对象吗? Yes,CronetEngine.Builder                     return this;              };       } catch (err) {              console.log('[-] Cronet pinner not found')       }});

function main() {    Java.perform(function () {        console.log("启动");        let f = Java.use("ll.f");        f["a"].implementation = function (str, list) {            console.log(`f.a is called: str=${str}, list=${list}`);            return;        };    });}setTimeout(main, 500)    

Java.perform(function () {    function uuid(len, radix) {        var chars = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz'.split('');        var uuid = [], i;        radix = radix || chars.length;        if (len) {            // Compact form            for (i = 0; i < len; i++) uuid[i] = chars[0 | Math.random() * radix];        } else {            // rfc4122, version 4 form            var r;            // rfc4122 requires these characters            uuid[8] = uuid[13] = uuid[18] = uuid[23] = '-';            uuid[14] = '4';            // Fill in random data. At i==19 set the high bits of clock sequence as            // per rfc4122, sec. 4.1.5            for (i = 0; i < 36; i++) {                if (!uuid[i]) {                    r = 0 | Math.random() * 16;                    uuid[i] = chars[(i == 19) ? (r & 0x3) | 0x8 : r];                }            }        }        return uuid.join('');    }    function storeP12(pri, p7, p12Path, p12Password) {        var X509Certificate = Java.use("java.security.cert.X509Certificate")        var p7X509 = Java.cast(p7, X509Certificate);        var chain = Java.array("java.security.cert.X509Certificate", [p7X509])        var ks = Java.use("java.security.KeyStore").getInstance("PKCS12", "BC");        ks.load(null, null);        ks.setKeyEntry("client", pri, Java.use('java.lang.String').$new(p12Password).toCharArray(), chain);        try {            var out = Java.use("java.io.FileOutputStream").$new(p12Path);            ks.store(out, Java.use('java.lang.String').$new(p12Password).toCharArray())        } catch (exp) {            console.log(exp)        }    }    // 在服务器校验客户端的情形下，帮助dump客户端证书，并保存为p12的格式，证书密码为r0ysue    Java.use("java.security.KeyStore$PrivateKeyEntry").getPrivateKey.implementation = function () {        var result = this.getPrivateKey()        var packageName = Java.use("android.app.ActivityThread").currentApplication().getApplicationContext().getPackageName();        storeP12(this.getPrivateKey(), this.getCertificate(), '/sdcard/Download/' + packageName + uuid(10, 16) + '.p12', 'r0ysue');            return result;    }    Java.use("java.security.KeyStore$PrivateKeyEntry").getCertificateChain.implementation = function () {        var result = this.getCertificateChain()        var packageName = Java.use("android.app.ActivityThread").currentApplication().getApplicationContext().getPackageName();        storeP12(this.getPrivateKey(), this.getCertificate(), '/sdcard/Download/' + packageName + uuid(10, 16) + '.p12', 'r0ysue');        return result;    }});

function hook_KeyStore_load() {    Java.perform(function () {        var StringClass = Java.use("java.lang.String");        var KeyStore = Java.use("java.security.KeyStore");        KeyStore.load.overload('java.security.KeyStore$LoadStoreParameter').implementation = function (arg0) {            // printStack("KeyStore.load1");            // 输出调用栈                console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Throwable").$new()));            console.log("KeyStore.load1:", arg0);            this.load(arg0);        };        KeyStore.load.overload('java.io.InputStream', '[C').implementation = function (arg0, arg1) {            // printStack("KeyStore.load2");            console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Throwable").$new()));            console.log("KeyStore.load2:", arg0, arg1 ? StringClass.$new(arg1) : null);            this.load(arg0, arg1);        };        console.log("hook_KeyStore_load...");    });}hook_KeyStore_load()