Android 진단도구 Drozer(#2)

https://chanztudio.tistory.com/125

Android 진단도구 Drozer(#1)

명령어는 다음 git을 통해 가져왔다.
https://gist.github.com/castexyz/2ef12840fccbf3b4ef7b6446d24a9352

• Drozer - Drozer allows you to search for security vulnerabilities in apps and devices by assuming the role of an app and interacting with the Dalvik VM, other apps' IPC endpoints and the underlying OS.
  • Starting a session
    • adb forward tcp:31415 tcp:31415
    • drozer console connect
    • drozer console connect --server <ip>
  • List modules
    • ls
    • ls activity
  • Retrieving package information
    • run app.package.list -f <app name>
    • run app.package.info -a <package name>
  • Identifying the attack surface
    • run app.package.attacksurface <package name>
  • Exploiting Activities
    • run app.activity.info -a <package name> -u
    • run app.activity.start --component <package name> <component name>
    • run app.activity.start --component <package name> <component name> --extra <type> <key> <value>
  • Exploiting Content Provider
    • run app.provider.info -a <package name>
    • run scanner.provider.finduris -a <package name>
    • run app.provider.query <uri>
    • run app.provider.update <uri> --selection <conditions> <selection arg> <column> <data>
    • run scanner.provider.sqltables -a <package name>
    • run scanner.provider.injection -a <package name>
    • run scanner.provider.traversal -a <package name>
  • Exploiting Broadcast Receivers
    • run app.broadcast.info -a <package name>
    • run app.broadcast.send --component <package name> <component name> --extra <type> <key> <value>
    • run app.broadcast.sniff --action <action>
  • Exploiting Service
    • run app.service.info -a <package name>
    • run app.service.start --action <action> --component <package name> <component name>
    • run app.service.send <package name> <component name> --msg <what> <arg1> <arg2> --extra <type> <key> <value> --bundle-as-obj

Drozer commands

드로저의 경우 run app.package.list를 통해 설치된 패키지를 불러올 수 있다.
-처음상황

-앱하나 설치상황

 

여기서 우회하여 액티비티 실행(실제로 찾으려는 취약점을 시작해보자)
먼저 쓸수있는 액티비티부터 구해본다.
run app.activity.info -a <package> -u

 

• run app.activity.start --component <package name> <component name>