Msf::Payload::Apk: apktool: Decompile only main classes #17673
Conversation
| @@ -295,7 +295,7 @@ def backdoor_apk(apkfile, raw_payload, signature = true, manifest = true, apk_da | |||
| end | |||
|
|
|||
| print_status "Decompiling original APK..\n" | |||
| apktool_output = run_cmd(['apktool', 'd', "#{tempdir}/original.apk", '-o', "#{tempdir}/original"]) | |||
| apktool_output = run_cmd(['apktool', 'd', "#{tempdir}/original.apk", '--only-main-classes', '-o', "#{tempdir}/original"]) | |||
There was a problem hiding this comment.
Not a blocker, A question that comes to mind is what versions or apktool support this flag?
There was a problem hiding this comment.
The flag has been supported since at least Nov 16, 2019. The flag was available prior, but had some bugs. (iBotPeaches/Apktool#2226)
Version 2.4.1 was released not long after (Nov 30, 2019) and should support this flag:
https://github.com/iBotPeaches/Apktool/releases/tag/v2.4.1
Metasploit requires apktool version 2.0.1 at minimum and raises a warning for version 2.5.1 and prior.
metasploit-framework/lib/msf/core/payload/apk.rb
Lines 242 to 248 in fbf2e5d
This change requires the minimum version to be bumped to 2.4.1.
There was a problem hiding this comment.
Updated minimum required version to 2.4.1.
bcoles
force-pushed
the
payload-apk-apktool-only-main-classes
branch
from
1842ed4
to
b19ab03
Compare
|
Before: |
|
For what its worth the application appears to be resigned with the backdoor and I can successfully install the application on a target device and the app operates successfully though I haven't confirmed if the reverse shell works successfully, which may be in part to me not setting up the TCP port forwards correctly. Good to know it isn't affecting the apps install though. |
|
Tested successfully in emulator on I tried a few other devices in emulator, but installation failed. I'm fairly sure that's to do with this specific APK, and not due to the changes introduced in this PR. I also tested |
|
Alright given all the information that has been posted to this thread and the tests that have been conducted so far, I think this should be good to land. If we need to roll this back later we can always do so should things suddenly start breaking on edge cases or similar, but given tests above I'm fairly confident that this should be okay in its current state. |
Release Notes
|
@timwr
Fixes #17631
Tested using:
I've tested that these changes allow the APK to be decompiled and rebuilt successfully, but haven't done any further testing (does the payload still work? is there any reason why would ever want to decompile other DEX files?).
Before
After