2024双向认证APP自吐证书密码与抓包.docx

双向认证APP自吐证书密码与抓包双向认证APP读密码HOOk网络框架抓包批量hook查看调用筑迹HOOk强混淆APP抓包总结参考资料、，一刖百在许多业务非常聚焦比如行业应用银行公共交通游戏等行业C/S架构中服务器高度集中,对应用的版本控制非常严格这时候就会在服务器上部署对app内置证书的校验代码双向认证APP读密码当抓包出现如下提示时，我们确定出此APP为服务器校验app客户端证书,JHjHmi，.tetajMiWIMMMGMCtwWBVlMCMMMlCmmbom<1mWiEmlZM M4wOMM<MMCJM Slit。UNV<VWvMWIIUW3m<MKMM.MtIMMOtI8»41JIEM.UWtM<MMMWMtf<>Mb*l9fltwiI<KTmBmM4M)IFHItdiIFaQ三nItaxna.IteOM*W<M4tOVWWMI.W,tMteiMd>,MlMlt45<9l4<t><WWIIMccM0*I，HIJSB”Ac<fftMMgOT*.3M对于此类APP抓包血1通常需要完成两项内容：PlainTextQ复制代码1 1找到证书文件2 2找到证书密码服务器对客户端进行校验过程中客户端将证书公钥发送给服务器,以及从服务器获取SeSSiOn和私钥解密过程中，需要APl进行操作APl存在于java层框架内,所以hook框架层代码java.security.KevStore，使密码自吐PlainTextQ复制代码1#frida-U-fcn.soulapp.android-1ssl.js-no-pause-nopamefIFnda12.11.lAworld*clltsdyn«ucIftStruwntationtoolkitICiI>_ICflflMnds:/Ilhlp*>Displaysthehelpsystea.obje<t?->DisplayInfonMtiOnabout'object*itquit»Exit.MorinfoatMtpcwwtf.frda.rdocVM/Sp*m*dcn.Mlap.adreM.KswlngMinthread*(PxlX1.:cn.souIpp.android»hookKeyStorwlo«d.)»va.lang.Throwableatjava.security.KeyStore.lo>d(ltotiveMethod)atcoa.android.orQ.cmcrypt.KeyRafWQerfactorylBpl.engrwlnt(KeyMafWQerfdctorylHpl.java:67)at)<v*.ssl.KeyMafugerF*ctory.mt(KeyManAgerFACtory.JivA:2721atCaB.ndrod.org.cncrpf.SSlFarwfersIapl.creatH>tfaultr(SS1.ParwtertIapl.java:471)atcob.android.org.cnscrpt.SSlFaramtersIepl.gtfaultX3MKryManagr(SSlFarawtersIapl.)ava:43)atca.android.0r9.cmcrypt.SS1.FaraMrterilapl.<init>(SS1.arawtersKapl.java:125)atc.android.org.CanSCrpt.QpenSS1.ContcxtIapl.engnelnt(OPenSSuOr)textIapl.jw:IeI)atJaVaIUnet.tl.SS1.Context.InitlSSlContext.Jav<:316>atca.android.okhttp.OicWttpCUent.9etOefaultS1.SocketFactory<QtontpCUe11t,jaa632)«tcob.android.okhttp.OkHttpCUcnt.COpyVithtefMUs(O¼MttpCUnt.jwc½l)atco*android.okhttp.OkUrlFactory.op*n(OkUrlFactory.pva:59)atcm.android.okhttp.OkUrlFactory.Open(OkUflFactoryJavarM)atco.android.okhttp.Httpandlr.OpvnConrwction(HttPHandI”.java:44)at)*.UR1.op<<<fwe<tlon(UR1.)»vi：992>atco*.tffnt.bu9ly.proguard.s,a(BUGtY:75)atcob.tencent.bugly.proguard.s.aIBUG1.Y:52)atcob.ter>cnt.bugly.proguard.s.a<0UG1.Y13)atCMtemcent.bugly.proguard.v.njn(BUG1.Y:41)atcoB.tenccnt.bugly.proguard.u$l.run(BUG1.Y:1)atjava.lang.Thread.nm<TrMd.)ava：7M)Keytore.load2:nullnull)avA.l11g.Thr(Mbleatpva.MCurty.K*yStorload<Nafv*fthod)atC.I.<int>(T1.SSocketFactory.*vazllatcn.Mulapp.a11drod.fWt.k.(SoulNtStorag.j«va：l).9.AiokHttpCUeotHelper.java:18)atC.oulNetw>rkOK.a(SoulMetworlKSOK.jav«:7i)atCA.p.a.b.d.a<NetFroxy.java:1).p.«.b.a.accept<UnknownSOUrc«:6).0.j.b.onNext(leC(XiSUBer.)ava:2)atio.rMtvex.internal.operators.obrvM)le.c2M.b<ObcrvableOberven.javaz8)atio.rctv.internal.operators.ob$«rvatole.c21a.11m<0bservable<X>54rn.j«va：3>atio.rectivex.internal.schedulers.a.run(ScKeduledRurtnAble.jaifa:2)atio.rectvx.internal.SCheAJIc.callSdZUlBRMngbI。.java:1)atW.utxl.COfKurrent.FutureTMk.run(RitureTMk.Java:266)*t)ava.util.concurrwt.SctwduledThrMdPooU*cutorSSchduldFuturtak.nm(chduldThradP00Ucutor.java:Ml)atjava.util.concurrent.TbrMdRiolUwcutor.ru11ttorkr(DradPooUxcutor.java:1152)atjava.util.concurrentTbreadPoolExecutorSUorlter.run(ThrMdFoolEjrecwtor.java：6X>at)*va.lang.11rM.11M<Tbrad.java:7M)Ky¾tor.lod2:IndrOid.conCnt.r9.AstMgr33HnpurCra75¾7d3Vft*0SsPFlwX可以发现我们通过hook框架层代码得到了证书密码PlainTextQ复制代码1%2R+0SsjpP!w%X这时我们还需要拿到证书文件,首先使用常规方式解压搜索app包里的证书文件一般apk进斤解包,直接过滤搜索后缀名为p12的文件即可,一般常用的命令为tree-NCfhlIgrep-ipl2直接打印出p12文件的路径.*Desto,12双向金居叩2IzXsoulchannelsoul.apk7Zip(6416.82:Copyright(C)1999-216IgorPavlov:2616-5-21p7zipVersion16.82(localeaenUS.utf8«Utfl6>otHugeFileseon,64bits,4CPUsIntel(R)Core(TM)iScanningthedriveforarchives:1file,83351124bytes(8MiB)Extractingarchive：soulchannelsoul.apkPath三soulchannelsoul.apkType三zipPhysicalSize三83351124EverythingisOkFiles：7592Size:95x31Size:144123783Coapressed:83351124：一,DMr。口12双向证书”,treeNCFhlIgreP-ipl2I|2.5Kclient.pl2D.ktop12,双向MwC如果在安装包内找不到证书的话也可以进行hkjava.io.FilePlainTextQ复制代码#androidhookingwatchclass_methodjava.io.File.$2init：tobjectiongc11.soulapp.androidexploreCheckingforanewerversionofobjection.UsingUSBdvic'PixelXl'Agentinjectedandrespondsok!I1.IJI1.IJIIIIIIIIIIII1.I1.I-1.IJII(object)Inject(ion)vl.9.6RuntiMMobileExplorationby:QleonjzafroaQsenseposttabforcomandsuggestions(google:8.1.)androidhookingwatchclassmethodjava.io.File.$Initjava.10.File.Snt(java.o.Fle.ii11it()java.io.File.Sinit(java.io.File.Sint(java.io.File.$init(java.10.File,Sinit()agent)AttenptingtowatchclassJava.10.FileandIBethodSinit.(agent)Hooking(a