【保姆级教学】某金融app FRIDA hook加解密算法+jsrpc=乱杀

import frida, sys
jscode ="""Java.perform(function () {<!-- 获取CryptoUtil这个类的对象 -->    var CryptoUtil = Java.use('com.xxxx.security.CryptoUtil');<!-- 调用encryptDataWithSM方法，因为这个方法的参数有三个，所以在 function 中有三个参数，至于为什么没有类型修饰，因为 JavaScript 是弱语言 -->    CryptoUtil.encryptDataWithSM.implementation = function (app,dataStr,keyStr) {        console.log("Hook Start...");  //        console.log("app:",app); //打印app参数        console.log("dataStr",dataStr); //打印dataStr参数        console.log("keyStr",keyStr); //打印keyStr参数        var data = this.encryptDataWithSM(app,dataStr,keyStr);//使用this.encryptDataWithSM()再次调用原函数并把原本的参数传递给这个encryptDataWithSM()函数，然后通过return原封不动的返回。        return data;    }});"""# 这下面的代码的作用就是为了执行上面 JS 代码，输出 JS 中 send() 方法中的内容def message(message, data):    if message["type"] == 'send':        print("<li> {0}".format(message['payload']))    else:        print(message)# 获取这个 APK 的进程，可以使用frda-ps -Ua获取process = frida.get_usb_device().attach('xxxxxx银行')script= process.create_script(jscode)script.on("message", message)script.load()sys.stdin.read()

import frida, sys
jscode ="""Java.perform(function () {    var CryptoUtil = Java.use('com.xxxx.security.CryptoUtil');    CryptoUtil.encryptDataWithSM.implementation = function (app,dataStr,keyStr) {        console.log("Hook Start...");         console.log("encrycptDataStr",dataStr);        var data = this.encryptDataWithSM(app,dataStr,keyStr);        return data;    }    CryptoUtil.decryptDataWithSM.implementation = function (app,dataStr,keyStr) {        console.log("Hook Start....");        console.log("decrycptDataStr:",dataStr)        var data = this.decryptDataWithSM(app,dataStr,keyStr);        return data;       }});"""def message(message, data):    if message["type"] == 'send':        print("<li> {0}".format(message['payload']))    else:        print(message)
process = frida.get_usb_device().attach('XXXXX银行')script= process.create_script(jscode)script.on("message", message)script.load()sys.stdin.read()

Java.perform(function () {    var CryptoUtil = Java.use('com.xxxx.security.CryptoUtil');    CryptoUtil.encryptDataWithSM.implementation = function(app,dataStr,keyStr) {        console.log("Hook Start...");         console.log("encrycptDataStr",dataStr,keyStr);        var data;        send({from:"/http",payload:dataStr,api_path:"request"}); //将dataStr发送到burpTracer.py        <!-- 接收burp篡改后返回的数据 ↓-->        var op = recv("input",function(value){              data = value.payload        });        op.wait();        console.log("经过burp修改后的参数:" +data);        var ret = this.encryptDataWithSM(app,data,keyStr);        return ret;    }//hook解密函数    CryptoUtil.decryptDataWithSM.implementation = function (app,dataStr,keyStr) {       var getVal = this.decryptDataWithSM(app, dataStr, keyStr);       send({ from: "/http", payload: getVal, api_path: "response" });           var op = recv('input',function (value) {             console.log(value.payload);                         });       op.wait();                 return getVal;}    });

from codecs import ignore_errorsimport fridaimport requestsimport timeimport sysimport osimport socketimport argparsefrom log import *print ('''\033[1;31m \n  _____    _     _         ___       _             ____           _|  ___| __(_) __| | __ _  |_ _|_ __ | |_ ___ _ __ / ___|___ _ __ | |_| |_ | '__| |/ _` |/ _` |  | || '_ \| __/ _ \ '__| |   / _ \ '_ \| __||  _|| |  | | (_| | (_| |  | || | | | ||  __/ |  | |__|  __/ |_) | |_|_|  |_|  |_|\__,_|\__,_| |___|_| |_|\__\___|_|   \____\___| .__/ \__|                       #pyth0n                             |_|                     Intercept Api in Android Application''')print ("\033[1;34m<li>___author___: @Pyth0n\033[1;37m")print ("\033[1;34m<li>___version___: 1.0\033[1;37m")print ("")BURP_HOST = "127.0.0.1"BURP_PORT = 26080def check_platform():    try:        platforms = {        'linux'  : 'Linux',        'linux1' : 'Linux',        'linux2' : 'Linux',        'darwin' : 'OS X',        'win32'  : 'Windows'        }        if sys.platform not in platforms:            sys.exit(logger.error("[x_x] Your platform currently does not support."))    except Exception as e:        logger.error("[x_x] Something went wrong, please check your error message.\n Message - {0}".format(e))def check_ps_for_win32():    try:        if sys.platform == "win32":            PROCESSNAME = "iTunes.exe"            for proc in psutil.process_iter():                try:                    if proc.name() == PROCESSNAME:                        return True                except (psutil.NoSuchProcess, psutil.AccessDenied, psutil.ZombieProcess) as e:                    pass            return sys.exit(logger.error("[x_x] Please install iTunes on MicrosoftStore or run iTunes frist."))                  except Exception as e:        logger.error("[x_x] Something went wrong, please check your error message.\n Message - {0}".format(e))def check_echo_server():    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)    result = sock.connect_ex(('127.0.0.1',27080))    if result == 0:       logger.info("<li> Connect to echoServer successfully.")    else:        sock.close()        sys.exit(logger.error("[x_x] Please start echoServer."))def run():    #check platform support    check_platform()    #check process iTunes for Win32s    #check_ps_for_win32()    #check python version    if sys.version_info < (3, 0):        logger.error("[x_x] iOS hook requires Python 3.x")        sys.exit(0)    else:        handle_del_log()        main()def handle_del_log():    try:        pwd = os.getcwd()        path = pwd + '/errors.log'        file_stats = os.stat(path)        if (file_stats.st_size > 1024000000): #delete errors.log if file size > 1024 MB            os.remove(path)        else:            return True    except Exception as e:        logger.error("[x_x] Something went wrong when clear error log. Please clear error log manual.\n [Error Message] - {0}".format(e))def main():    def frida_process_message(message, data):        handled = False               if message['type'] == 'input':            handled = True                   elif message['type'] == 'send':            body = message['payload']                       API_PATH = body['api_path']                       if body['from'] == '/http':                try:                    # 把数据发给 本地burp 监听的 26080端口                    req = requests.request('FRIDA', 'http://%s:%d/%s' % (BURP_HOST, BURP_PORT, API_PATH), headers={'content-type':'application/json'}, data=body['payload'].encode('utf-8'))                    script.post({ 'type': 'input', 'payload': req.text }) # 把修改后的数据传输回给js                    handled = True                except requests.exceptions.RequestException as e:                    logger.error("[x_x] Connection refused, please check configurage on BurpSute.\n [Error Message] - {0}".format(e))    parser = argparse.ArgumentParser()    parser.add_argument("-p", "--package")    parser.add_argument("-n", "--name")    parser.add_argument("-s", "--script", help='custom handler script')    parser.add_argument("-r", "--remote",help="远程主机")    args, leftovers = parser.parse_known_args()    try:        #Spawning application with default script        if args.package is not None and args.script is None:            #check echoServer            check_echo_server()            #            logger.info('<li> Spawning: ' + args.package)            logger.info('<li> Script: ' + 'handlers.js')            time.sleep(2)            device = frida.get_usb_device()            pid = device.spawn(args.package)            device.resume(pid)            time.sleep(1)            session = device.attach(pid)            with open("handlers.js") as f:                script = session.create_script(f.read())            script.on("message", frida_process_message)            script.load()            input()        #Attaching default script to application        if args.name is not None and args.script is None:            #check echoServer            check_echo_server()            #            logger.info('<li> Attaching: ' + args.name)            logger.info('<li> Script: ' + 'handlers.js')            time.sleep(2)            process = frida.get_usb_device().attach(args.name)            with open("handlers.js") as f:                script = process.create_script(f.read())            script.on("message", frida_process_message)            script.load()            input()        # Spawing application with custom script        if args.package is not None and args.script is not None:            #check echoServer            check_echo_server()            #            if os.path.isfile(args.script):                logger.info('<li> Spawning: ' + args.package)                logger.info('<li> Script: ' + args.script)                time.sleep(2)                device = frida.get_remote_device()                               pid = device.spawn(args.package)                device.resume(pid)                                            time.sleep(1)                session = device.attach(pid)                with open(args.script,encoding='utf-8',errors='ignore') as f:                    script = session.create_script(f.read())                script.on("message", frida_process_message)                script.load()                input()            else:                logger.error('[?] Script not found!')        #Attaching default script to application        if args.name is not None and args.script is not None:            #check echoServer            check_echo_server()            #            logger.info('<li> Attaching: ' + args.name)            logger.info('<li> Script: ' + args.script)            time.sleep(2)            process = frida.get_usb_device().attach(args.name)            with open(args.script,encoding='utf-8',errors='ignore') as f:                script = process.create_script(f.read())            script.on("message", frida_process_message)            script.load()            input()        if args.remote is not None and args.script is not None:            #check echoServer            check_echo_server()            #            logger.info('<li> Attaching: ' + args.remote)            logger.info('<li> Script: ' + args.script)            time.sleep(2)            process = frida.get_remote_device().attach(args.remote)            with open(args.script,encoding='utf-8',errors='ignore') as f:                script = process.create_script(f.read())            script.on("message", frida_process_message)            script.load()            input()      #EXCEPTION FOR FRIDA    except frida.ServerNotRunningError:        logger.error("Frida server is not running.")    except frida.TimedOutError:        logger.error("Timed out while waiting for device to appear.")    except frida.TransportError:        logger.error("[x_x] The application may crash or lose connection.")    #EXCEPTION FOR OPTIONPARSING    #EXCEPTION FOR SYSTEM    except Exception as e:        logger.error("[x_x] Something went wrong, please check your error message.\n Message - {0}".format(e))    except KeyboardInterrupt:        logger.info("Bye bro!!")        # sys.exit(0)if __name__ == '__main__':    run()

from http.server import HTTPServer, BaseHTTPRequestHandlerfrom optparse import OptionParserfrom log import *print ('''\033[1;31m \n            _           _____                                     | |         / ____|                            ___  ___| |__   ___| (___   ___ _ ____   _____ _ __   / _ \/ __| '_ \ / _ \\___ \ / _ \ '__\ \ / / _ \ '__| |  __/ (__| | | | (_) |___) |  __/ |   \ V /  __/ |     \___|\___|_| |_|\___/_____/ \___|_|    \_/ \___|_|                                                                                                                        ''')print ("\033[1;34m<li>___author___: @Pyth0n\033[1;37m")print ("\033[1;34m<li>___version___: 1.0\033[1;37m")print ("")ECHO_PORT = 27080class RequestHandler(BaseHTTPRequestHandler):    def do_FRIDA(self):        request_path = self.path        request_headers = self.headers        content_length = request_headers.get('content-length')        # length = int(content_length[0]) if content_length else 0        length = int(content_length) if content_length else 0        self.send_response(200)        self.end_headers()        self.wfile.write(self.rfile.read(length))def main():    try:        logger.info('<li> Listening on 127.0.0.1:%d' % ECHO_PORT)        server = HTTPServer(('', ECHO_PORT), RequestHandler)        server.serve_forever()    except KeyboardInterrupt:        logger.info("Stop echoServer!!")if __name__ == "__main__":    logger.info('<li> Starting echoServer on port %d' % ECHO_PORT)    main()

{    "proxy":{        "request_listeners":[            {                "certificate_mode":"per_host",                "custom_tls_protocols":[],                "enable_http2":true,                "listen_mode":"loopback_only",                "listener_port":8080,                "running":true,                "use_custom_tls_protocols":false            },            {                "certificate_mode":"per_host",                "custom_tls_protocols":[                    "SSLv3",                    "TLSv1",                    "TLSv1.1",                    "TLSv1.2",                    "TLSv1.3"                ],                "enable_http2":true,                "listen_mode":"specific_address",                "listen_specific_address":"127.0.0.1",                "listener_port":26080,                "redirect_to_host":"127.0.0.1",                "redirect_to_port":27080,                "running":true,                "support_invisible_proxying":true,                "use_custom_tls_protocols":false            }        ]    }}

adb forward tcp:27042 tcp:27042 #转发端口burpTracer.py -s 666.js -p com.xxx.xxx.bank