January 21, 2020

Analyzing AndroidManifest.xml File with Yara and Python

anomali8888

Important note: Before you try this tutorial, please make sure that Python version 3 and the Yara library are installed on your operating system.Yara is a multi-platform tool that is used for pattern matching in malware analysis to identify and classify malware samples. With Yara you can create description and rules to be applied with. from this point of view Yara can be used not just for malware analysis but for vulnerability analysis in a mobile android application (APK file). In this content post, I'm going to focus on finding vulnerabilities inside one of the components in the AndroidManifest.xml file.What is AndroidManifest.xml:according to developer.android.com "Every application must have a AndroidManifest.xml file (with precisely that name) in its root directory. The manifest file provides essential information about your app to the Android system, which the system must have before it can run any of the app's code." by this explanation we can ensure that the following XML file contains very vital information for running Android APK file and also because its vital and contain essential information a hacker can exploit the permission inside the XML file to get sensitive information inside the application.Standard security in AndroidManifest.xml:here is the list of component and security guideline for an android manifest file: (source: https://pentestlab.blog/category/mobile-pentesting/page/6)

Debug Mode
Backup Flag
External Storage
Permissions
Application Components
Intents
Summary

Depending on the functionality an application can launch a service, perform an activity, receive content from another source or receive intents by phone or by other applications. There are four application components:

Activities
Services
Content Providers
Broadcast Receivers

Activities, Services, Content Providers and Broadcast Receivers can all be exported. Therefore all of them they should be reviewed that they don’t perform any sensitive action and that they are protected by appropriate permissions as otherwise information could be exposed to malicious third parties. so right now our objective is to find the component that could be exportedexample:<receiverandroid:exported="true";android:name="string";android:permission = "string";</receiver>let's try to exploit application components using Yara and Python:How to write a rule in Yara:First, we need to create a rule in Yara so that the python program could analyze the XML file with predefined rule:

rule [name of the rule]{meta: [the meta description of the rule, i like to use to this so it will not get confused with other rule]description = " [fill into the description] "strings:[the string that will be check]$variable = " [fill the string that you want to match] "condition: [the condition that have to be fulfill so it can generate true or false value]$variable [you can add boolean operator to be more specific]}example:rule androidexport{meta:description = "android activity can be exported by other application"strings:$check = "android:exported="true""condition:$check}with that we can move to create our python code, here i paste the code that i have write from analyzing androidmanifest.xml file:import yaraimport rerules = yara.compile("manifestrule.yara")#the yara filewith open("sieve/AndroidManifest.xml") as file:matches = rules.match(data=file.read())# don't forget to indent this line of code

Note: The data that is going to be passed in the variable from matching yara rule will be in dictionary value.That's pretty easy right now. The one that I just showed was just the simple implementation that you can use for implementing Yara in python you can develop it even further and add more rule in Yara file.Thank you.

Start learning with Cybrary

Create a free account

All Blogs

Building a Security Team

June 27, 2023

Digital Forensics and Incident Response: What It Is, When You Need It, and How to Implement It

A quick guide to digital forensics and incident response (DFIR): what it is, when it’s needed, how to implement a cutting-edge program, and how to develop DFIR skills on your team.

Building a Security Team

June 28, 2023

How to Build a Red Team

An overview of what a red team is (and isn’t), and practical tips on how to build a Red Team and develop offensive security skills in your team.

Tools & Applications

June 7, 2023

How to Make the Most of Blending Learning with Cybrary Live

Learn how to get the most from your cybersecurity training platform by blending on-demand learning with virtual, live courses led by industry experts.

News & Events

June 7, 2023

Introducing the New Cybrary Learner Experience

Cybrary is launching a key update to the Cybrary Learner experience to elevate hands-on learning and measurement as guiding tenets of Cybrary’s mission.