LT会でやった内容のスライドを公開し忘れてたので載せておきます
ࠤٸศϑΟογϯάαΠτΛௐͯΈͨ2018/08/14ηΩϡϦςΟΩϟϯϓ શࠃେձ 2018Tomoyuki KOYAMA
View Slide
ࣗݾհ• ͜· ͱΏ͖• ౦ژՊେ 2• શࠃେձ 2017मྃ• NOCνϡʔλʔ• PyCon JP ελοϑTwitter:@tmyk_kymBlog:blog.koyama.me
͖͔͚ͬTBHBXBNNDPN
sagawa-mm.com
औಘ/ൺֱ$ curl -s http://www.sagawa-exp.co.jp/ > white # ਖ਼نαΠτ $ curl -s http://sagawa-mm.com/ > black # ِαΠτ$ vim -d white black # ൺֱ
$ vim -d black white
ൺֱ:ِαΠτʹͷΈଘࡏ css="display:none;" download="sagawa.apk">ʙলུʙ Πϯετʔϧ
υϝΠϯͷௐࠪ
υϝΠϯॴ༗ऀΛௐࠪ(ൈਮ)$ whois sagawa-mm.comߋ৽࣌: 2018-07-18T11:24:40.0Zొ: 2018-07-18T11:24:40.0Zొۀऀ: Chengdu west dimension digital technology Co., LTDొऀ໊: mengmeng li // தࠃͷঁ༏: Meng Liొ৫: li meng mengొॅॴ1: Tan Cheng Zhen Deng Qiao She Qొॅॴ2: Meng Cheng Xianొ༣ศ൪߸: 010000ొࠃ: cnొి൪߸: +86.13614466925 // தࠃ ٢ྛল നࢢొFax: +86.13614466925ొϝʔϧ: [email protected]
ॴ༗ऀΛௐࠪ• RISKIQ, DomainBigData, DomainWatchͰௐࠪ
102 Domainswhoisใʹ [email protected] ؚ͕·ΕΔsagawaܥυϝΠϯ
υϝΠϯͷҰ෦• sagawa-anu\.com // sagawa-???• sagawa-expr\.com // expressͷදه• saggawa-exp\.com // ΞϧϑΝϕοτॏͶ• sagawa-co-jp\.com // .Λ-Ͱදݱ• sagawajp\.com // ҧײ͕ͳ͍
APKϑΝΠϧͷௐࠪಈతղੳ
ݕূڥ/ݕମ• Nexus 7 2013 Wi-Fi• Android 6.0.1• sagawa.apk• sagawa-mm\.comΑΓऔಘ• SHA-256:580a027109ac70b32e4423623dfff5b4c6d52220a905125332c0af0e231e0387˞҆શͳڥͰ ݕূ͍ͯͩ͘͠͞ɻݕূ࣌ʹωοτϫʔΫͷִͳͲेʹҙ͍ͯͩ͘͠͞ɻ
APKϑΝΠϧ - ಈతղੳ(1)
APKϑΝΠϧ - ಈతղੳ(2)όοΫάϥϯυ ͰଓΛzҡ࣋zṖͷന͍ΞϓϦ͕ৗறࠤٸศ͕ফ͑ͨ
APKϑΝΠϧ - ಈతղੳ(3)Կදࣔ͞ΕͣαʔϏεEH.BJO4FSWJDFΛ ͭྨࣅ"1,ϑΝΠϧΛൃݟ4)"BDGBEGCDCEGDEBEEGFGCECGF
APKϑΝΠϧ - ಈతղੳ(4)• tPacketCaptureͰύέοτΩϟϓνϟΓऔΓ͕ແ͍
APKϑΝΠϧͷௐࠪ੩తղੳ
APKΛղੳ(1)1. apktoolΛΠϯετʔϧ2. apk͔ΒresσΟϨΫτϦΛऔΓग़͢ $ apktool d sagawa.apk
APKΛղੳ(2)1. ϑΝΠϧ classes.dex ΛऔΓग़͢ $ unzip sagawa.apk2. dex2jar ΛΠϯετʔϧ3. dexϑΝΠϧ͔ΒjarϑΝΠϧΛੜ $ bash d2j-dex2jar.sh ../unziped/classes.dex
APKΛղੳ(3)1. jarϑΝΠϧΛల։ $ unzip classes-dex2jar.jar2. JavaDecompiler ΛΠϯετʔϧ3. JavaDecompiler Ͱ1ͷιʔεΛ։͘
σίϯύΠϥͰιʔεΛಡΉ
ϑΝΠϧҰཡ• gfer/DhsActivity$1.java• gfer/DhsActivity.java // ΤϯτϦϙΠϯτ• tog/essMyApplication$1.java• tog/essMyApplication$a.java• tog/vtdMyWebActivity.java• tog/essMyApplication.java• gig/dgMainService.java• a.java• goda/eeftMyReceiver.java
Ճ
ଞͷυϝΠϯ• ϝʔϧΞυϨε: [email protected]