supplier-meesho.webflow 1.0.0

package/MobSF/mobsf/StaticAnalyzer/views/ios/db_interaction.py

@@ -0,0 +1,177 @@
+"""Module holding the functions for the db."""
+import logging
+
+from django.conf import settings
+
+from mobsf.MobSF.utils import python_dict, python_list
+from mobsf.StaticAnalyzer.models import StaticAnalyzerIOS
+from mobsf.StaticAnalyzer.models import RecentScansDB
+
+logger = logging.getLogger(__name__)
+
+
+def get_context_from_db_entry(db_entry):
+    """Return the context for IPA/ZIP from DB."""
+    try:
+        logger.info('Analysis is already Done. Fetching data from the DB...')
+        context = {
+            'version': settings.MOBSF_VER,
+            'title': 'Static Analysis',
+            'file_name': db_entry[0].FILE_NAME,
+            'app_name': db_entry[0].APP_NAME,
+            'app_type': db_entry[0].APP_TYPE,
+            'size': db_entry[0].SIZE,
+            'md5': db_entry[0].MD5,
+            'sha1': db_entry[0].SHA1,
+            'sha256': db_entry[0].SHA256,
+            'build': db_entry[0].BUILD,
+            'app_version': db_entry[0].APP_VERSION,
+            'sdk_name': db_entry[0].SDK_NAME,
+            'platform': db_entry[0].PLATFORM,
+            'min_os_version': db_entry[0].MIN_OS_VERSION,
+            'bundle_id': db_entry[0].BUNDLE_ID,
+            'bundle_url_types': python_list(db_entry[0].BUNDLE_URL_TYPES),
+            'bundle_supported_platforms':
+                python_list(db_entry[0].BUNDLE_SUPPORTED_PLATFORMS),
+            'icon_found': db_entry[0].ICON_FOUND,
+            'info_plist': db_entry[0].INFO_PLIST,
+            'binary_info': python_dict(db_entry[0].BINARY_INFO),
+            'permissions': python_dict(db_entry[0].PERMISSIONS),
+            'ats_analysis': python_list(db_entry[0].ATS_ANALYSIS),
+            'binary_analysis': python_list(db_entry[0].BINARY_ANALYSIS),
+            'macho_analysis': python_dict(db_entry[0].MACHO_ANALYSIS),
+            'ios_api': python_dict(db_entry[0].IOS_API),
+            'code_analysis': python_dict(db_entry[0].CODE_ANALYSIS),
+            'file_analysis': python_list(db_entry[0].FILE_ANALYSIS),
+            'libraries': python_list(db_entry[0].LIBRARIES),
+            'files': python_list(db_entry[0].FILES),
+            'urls': python_list(db_entry[0].URLS),
+            'domains': python_dict(db_entry[0].DOMAINS),
+            'emails': python_list(db_entry[0].EMAILS),
+            'strings': python_list(db_entry[0].STRINGS),
+            'firebase_urls': python_list(db_entry[0].FIREBASE_URLS),
+            'appstore_details': python_dict(db_entry[0].APPSTORE_DETAILS),
+            'secrets': python_list(db_entry[0].SECRETS),
+
+        }
+        return context
+    except Exception:
+        logger.exception('Fetching from DB')
+
+
+def get_context_from_analysis(app_dict,
+                              info_dict,
+                              code_dict,
+                              bin_dict,
+                              all_files):
+    """Get the context for IPA/ZIP from analysis results."""
+    try:
+        context = {
+            'version': settings.MOBSF_VER,
+            'title': 'Static Analysis',
+            'file_name': app_dict['file_name'],
+            'app_name': info_dict['bin_name'],
+            'app_type': bin_dict['bin_type'],
+            'size': app_dict['size'],
+            'md5': app_dict['md5_hash'],
+            'sha1': app_dict['sha1'],
+            'sha256': app_dict['sha256'],
+            'build': info_dict['build'],
+            'app_version': info_dict['bundle_version_name'],
+            'sdk_name': info_dict['sdk'],
+            'platform': info_dict['pltfm'],
+            'min_os_version': info_dict['min'],
+            'bundle_id': info_dict['id'],
+            'bundle_url_types': info_dict['bundle_url_types'],
+            'bundle_supported_platforms':
+                info_dict['bundle_supported_platforms'],
+            'icon_found': app_dict['icon_found'],
+            'info_plist': info_dict['plist_xml'],
+            'binary_info': bin_dict['bin_info'],
+            'permissions': info_dict['permissions'],
+            'ats_analysis': info_dict['inseccon'],
+            'binary_analysis': bin_dict['bin_code_analysis'],
+            'macho_analysis': bin_dict['checksec'],
+            'ios_api': code_dict['api'],
+            'code_analysis': code_dict['code_anal'],
+            'file_analysis': all_files['special_files'],
+            'libraries': bin_dict['libraries'],
+            'files': all_files['files_short'],
+            'urls': code_dict['urlnfile'],
+            'domains': code_dict['domains'],
+            'emails': code_dict['emailnfile'],
+            'strings': bin_dict['strings'],
+            'firebase_urls': code_dict['firebase'],
+            'appstore_details': app_dict['appstore'],
+            'secrets': app_dict['secrets'],
+        }
+        return context
+    except Exception:
+        logger.exception('Rendering to Template')
+
+
+def save_or_update(update_type,
+                   app_dict,
+                   info_dict,
+                   code_dict,
+                   bin_dict,
+                   all_files):
+    """Save/Update an IPA/ZIP DB entry."""
+    try:
+        values = {
+            'FILE_NAME': app_dict['file_name'],
+            'APP_NAME': info_dict['bin_name'],
+            'APP_TYPE': bin_dict['bin_type'],
+            'SIZE': app_dict['size'],
+            'MD5': app_dict['md5_hash'],
+            'SHA1': app_dict['sha1'],
+            'SHA256': app_dict['sha256'],
+            'BUILD': info_dict['build'],
+            'APP_VERSION': info_dict['bundle_version_name'],
+            'SDK_NAME': info_dict['sdk'],
+            'PLATFORM': info_dict['pltfm'],
+            'MIN_OS_VERSION': info_dict['min'],
+            'BUNDLE_ID': info_dict['id'],
+            'BUNDLE_URL_TYPES': info_dict['bundle_url_types'],
+            'BUNDLE_SUPPORTED_PLATFORMS':
+                info_dict['bundle_supported_platforms'],
+            'ICON_FOUND': app_dict['icon_found'],
+            'INFO_PLIST': info_dict['plist_xml'],
+            'BINARY_INFO': bin_dict['bin_info'],
+            'PERMISSIONS': info_dict['permissions'],
+            'ATS_ANALYSIS': info_dict['inseccon'],
+            'BINARY_ANALYSIS': bin_dict['bin_code_analysis'],
+            'MACHO_ANALYSIS': bin_dict['checksec'],
+            'IOS_API': code_dict['api'],
+            'CODE_ANALYSIS': code_dict['code_anal'],
+            'FILE_ANALYSIS': all_files['special_files'],
+            'LIBRARIES': bin_dict['libraries'],
+            'FILES': all_files['files_short'],
+            'URLS': code_dict['urlnfile'],
+            'DOMAINS': code_dict['domains'],
+            'EMAILS': code_dict['emailnfile'],
+            'STRINGS': bin_dict['strings'],
+            'FIREBASE_URLS': code_dict['firebase'],
+            'APPSTORE_DETAILS': app_dict['appstore'],
+            'SECRETS': app_dict['secrets'],
+        }
+        if update_type == 'save':
+            db_entry = StaticAnalyzerIOS.objects.filter(
+                MD5=app_dict['md5_hash'])
+            if not db_entry.exists():
+                StaticAnalyzerIOS.objects.create(**values)
+        else:
+            StaticAnalyzerIOS.objects.filter(
+                MD5=app_dict['md5_hash']).update(**values)
+    except Exception:
+        logger.exception('Updating DB')
+    try:
+        values = {
+            'APP_NAME': info_dict['bin_name'],
+            'PACKAGE_NAME': info_dict['id'],
+            'VERSION_NAME': info_dict['bundle_version_name'],
+        }
+        RecentScansDB.objects.filter(
+            MD5=app_dict['md5_hash']).update(**values)
+    except Exception:
+        logger.exception('Updating RecentScansDB')

package/MobSF/mobsf/StaticAnalyzer/views/ios/file_analysis.py

@@ -0,0 +1,85 @@
+# -*- coding: utf_8 -*-
+"""iOS File Analysis."""
+
+import os
+import re
+import shutil
+import logging
+
+from django.utils.html import escape
+
+from mobsf.StaticAnalyzer.views.ios.plist_analysis import convert_bin_xml
+
+logger = logging.getLogger(__name__)
+
+
+def ios_list_files(src, md5_hash, binary_form, mode):
+    """List iOS files."""
+    try:
+        logger.info('Get Files, BIN Plist -> XML, and Normalize')
+        # Multi function, Get Files, BIN Plist -> XML, normalize + to x
+        filez = []
+        certz = []
+        sfiles = []
+        full_paths = []
+        database = []
+        plist = []
+        for dirname, _, files in os.walk(src):
+            for jfile in files:
+                if not jfile.endswith('.DS_Store'):
+
+                    file_path = os.path.join(src, dirname, jfile)
+                    if '__MACOSX' in file_path:
+                        continue
+                    if '+' in jfile:
+                        plus2x = os.path.join(
+                            src, dirname, jfile.replace('+', 'x'))
+                        shutil.move(file_path, plus2x)
+                        file_path = plus2x
+                    fileparam = file_path.replace(src, '')
+                    filez.append(fileparam)
+                    full_paths.append(file_path)
+                    ext = jfile.split('.')[-1]
+                    if re.search(r'cer|pem|cert|crt|pub|key|pfx|p12|der', ext):
+                        certz.append({
+                            'file_path': escape(file_path.replace(src, '')),
+                            'type': None,
+                            'hash': None,
+                        })
+
+                    if re.search(r'^db$|^sqlitedb$|^sqlite$', ext):
+                        database.append({
+                            'file_path': escape(fileparam),
+                            'type': mode,
+                            'hash': md5_hash,
+                        })
+
+                    if jfile.endswith('.plist'):
+                        if binary_form:
+                            convert_bin_xml(file_path)
+                        plist.append({
+                            'file_path': escape(fileparam),
+                            'type': mode,
+                            'hash': md5_hash,
+                        })
+
+        if len(database) > 0:
+            sfiles.append({
+                'issue': 'SQLite Files',
+                'files': database,
+            })
+        if len(plist) > 0:
+            sfiles.append({
+                'issue': 'Plist Files',
+                'files': plist,
+            })
+        if len(certz) > 0:
+            sfiles.append({
+                'issue': 'Certificate/Key Files Hardcoded inside the App.',
+                'files': certz,
+            })
+        return {'files_short': filez,
+                'files_long': full_paths,
+                'special_files': sfiles}
+    except Exception:
+        logger.exception('iOS List Files')

package/MobSF/mobsf/StaticAnalyzer/views/ios/file_recon.py

@@ -0,0 +1,63 @@
+import io
+import logging
+
+from mobsf.MalwareAnalyzer.views.MalwareDomainCheck import (
+    MalwareDomainCheck,
+)
+from mobsf.StaticAnalyzer.views.shared_func import (
+    url_n_email_extract,
+)
+
+logger = logging.getLogger(__name__)
+
+
+def extract_urls_n_email(src, all_files, strings):
+    """IPA URL and Email Extraction."""
+    try:
+        logger.info('Starting IPA URL and Email Extraction')
+        email_n_file = []
+        url_n_file = []
+        url_list = []
+        domains = {}
+        all_files.append({'data': strings, 'name': 'IPA Strings Dump'})
+        for file in all_files:
+            if isinstance(file, dict):
+                relative_src_path = file['name']
+                dat = '\n'.join(file['data'])
+            # Skip CodeResources and contents under Frameworks
+            elif 'CodeResources' in file or '/Frameworks/' in file:
+                continue
+            elif file.endswith(('.nib', '.ttf', '.svg', '.woff2',
+                                '.png', '.dylib', '.mobileprovision',
+                                'Assets.car')):
+                continue
+            else:
+                dat = ''
+                relative_src_path = file.replace(src, '')
+                with io.open(file,
+                             mode='r',
+                             encoding='utf8',
+                             errors='ignore') as flip:
+                    dat = flip.read()
+            # Extract URLs and Emails from Plists
+            urls, urls_nf, emails_nf = url_n_email_extract(
+                dat, relative_src_path)
+            url_list.extend(urls)
+            url_n_file.extend(urls_nf)
+            email_n_file.extend(emails_nf)
+        # Unique URLs
+        urls_list = list(set(url_list))
+        # Domain Extraction and Malware Check
+        logger.info('Performing Malware Check on extracted Domains')
+        domains = MalwareDomainCheck().scan(urls_list)
+        logger.info('Finished URL and Email Extraction')
+        binary_recon = {
+            'urls_list': urls_list,
+            'urlnfile': url_n_file,
+            'domains': domains,
+            'emailnfile': email_n_file,
+        }
+        return binary_recon
+
+    except Exception:
+        logger.exception('IPA URL and Email Extraction')

package/MobSF/mobsf/StaticAnalyzer/views/ios/icon_analysis.py

@@ -0,0 +1,73 @@
+# -*- coding: utf_8 -*-
+"""Module holding the functions for icon analysis."""
+
+import logging
+import glob
+import os
+import platform
+import shutil
+import subprocess
+
+from django.conf import settings
+
+from mobsf.MobSF.utils import is_dir_exists
+
+logger = logging.getLogger(__name__)
+
+
+def get_icon(md5, bin_dir, binary):
+    """Get app icon from IPA."""
+    try:
+        logger.info('Fetching icon path')
+        bin_path = os.path.join(bin_dir, binary + '.app')
+        if not is_dir_exists(bin_path):
+            logger.warning('Could not find app binary directory')
+            return False
+        icons = glob.glob(bin_path + '/AppIcon*png')
+        if not icons:
+            logger.warning('Could not find app icon')
+            return False
+        icon_file = icons.pop()
+        outfile = os.path.join(settings.DWD_DIR, md5 + '-icon.png')
+        if platform.system() == 'Darwin':
+            args = ['xcrun', '-sdk', 'iphoneos', 'pngcrush', '-q',
+                    '-revert-iphone-optimizations',
+                    icon_file, outfile]
+            # Uncrush PNG. CgBI -> PNG, Mac only
+            # https://iphonedevwiki.net/index.php/CgBI_file_format
+            try:
+                out = subprocess.run(args, capture_output=True)
+                if b'libpng error:' in out.stdout:
+                    # PNG looks normal
+                    raise ValueError('PNG is not CgBI')
+            except Exception:
+                shutil.copy2(icon_file, outfile)
+        else:
+            shutil.copy2(icon_file, outfile)
+        return True
+    except Exception:
+        logger.exception('Error Fetching icon')
+        return False
+
+
+def get_icon_source(md5, src_dir):
+    """Get app icon from iOS ZIP."""
+    logger.info('Fetching icon path')
+    try:
+        appiconset = []
+        for dirname, _, files in os.walk(src_dir):
+            for img in files:
+                full_path = os.path.join(src_dir, dirname, img)
+                if '__MACOSX' in full_path:
+                    continue
+                if '.appiconset' in full_path and img.endswith('.png'):
+                    appiconset.append(full_path)
+        if not appiconset:
+            return False
+        icon_file = appiconset[0]
+        outfile = os.path.join(settings.DWD_DIR, md5 + '-icon.png')
+        shutil.copy2(icon_file, outfile)
+        return True
+    except Exception:
+        logger.exception('Error Fetching icon')
+        return False

package/MobSF/mobsf/StaticAnalyzer/views/ios/macho_analysis.py

@@ -0,0 +1,255 @@
+# !/usr/bin/python
+# coding=utf-8
+import logging
+
+import lief
+
+logger = logging.getLogger(__name__)
+
+
+class Checksec:
+    def __init__(self, macho):
+        self.macho = lief.parse(macho.as_posix())
+
+    def checksec(self):
+        macho_dict = {}
+        macho_dict['name'] = self.macho.name
+        has_nx = self.has_nx()
+        has_pie = self.has_pie()
+        has_canary = self.has_canary()
+        has_rpath = self.has_rpath()
+        has_code_signature = self.has_code_signature()
+        has_arc = self.has_arc()
+        is_encrypted = self.is_encrypted()
+        is_stripped = self.is_symbols_stripped()
+
+        if has_nx:
+            severity = 'info'
+            desc = (
+                'The binary has NX bit set. This marks a '
+                'memory page non-executable making attacker '
+                'injected shellcode non-executable.')
+        else:
+            severity = 'info'
+            desc = (
+                'The binary does not have NX bit set. NX bit '
+                'offer protection against exploitation of memory corruption '
+                'vulnerabilities by marking memory page as non-executable. '
+                'However iOS never allows an app to execute from writeable '
+                'memory. You do not need to specifically enable the '
+                '‘NX bit’ because it’s always enabled for all '
+                'third-party code.')
+        macho_dict['nx'] = {
+            'has_nx': has_nx,
+            'severity': severity,
+            'description': desc,
+        }
+        if has_pie:
+            severity = 'info'
+            desc = (
+                'The binary is build with -fPIC flag which '
+                'enables Position independent code. This makes Return '
+                'Oriented Programming (ROP) attacks much more difficult '
+                'to execute reliably.')
+        else:
+            severity = 'high'
+            desc = (
+                'The binary is built without Position '
+                'Independent Code flag. In order to prevent '
+                'an attacker from reliably jumping to, for example, a '
+                'particular exploited function in memory, Address '
+                'space layout randomization (ASLR) randomly arranges '
+                'the address space positions of key data areas of a '
+                'process, including the base of the executable and the '
+                'positions of the stack,heap and libraries. Use compiler '
+                'option -fPIC to enable Position Independent Code.')
+        macho_dict['pie'] = {
+            'has_pie': has_pie,
+            'severity': severity,
+            'description': desc,
+        }
+        if has_canary:
+            severity = 'info'
+            desc = (
+                'This binary has a stack canary value '
+                'added to the stack so that it will be overwritten by '
+                'a stack buffer that overflows the return address. '
+                'This allows detection of overflows by verifying the '
+                'integrity of the canary before function return.')
+        elif is_stripped:
+            severity = 'warning'
+            desc = (
+                'This binary has symbols stripped. We cannot identify '
+                'whether stack canary is enabled or not.')
+        else:
+            severity = 'high'
+            desc = (
+                'This binary does not have a stack '
+                'canary value added to the stack. Stack canaries '
+                'are used to detect and prevent exploits from '
+                'overwriting return address. Use the option '
+                '-fstack-protector-all to enable stack canaries.')
+        macho_dict['stack_canary'] = {
+            'has_canary': has_canary,
+            'severity': severity,
+            'description': desc,
+        }
+        if has_arc:
+            severity = 'info'
+            desc = (
+                'The binary is compiled with Automatic Reference '
+                'Counting (ARC) flag. ARC is a compiler '
+                'feature that provides automatic memory '
+                'management of Objective-C objects and is an '
+                'exploit mitigation mechanism against memory '
+                'corruption vulnerabilities.'
+            )
+        elif is_stripped:
+            severity = 'warning'
+            desc = (
+                'This binary has symbols stripped. We cannot identify '
+                'whether ARC is enabled or not.')
+        else:
+            severity = 'high'
+            desc = (
+                'The binary is not compiled with Automatic '
+                'Reference Counting (ARC) flag. ARC is a compiler '
+                'feature that provides automatic memory '
+                'management of Objective-C objects and '
+                'protects from memory corruption '
+                'vulnerabilities. Use compiler option '
+                '-fobjc-arc to enable ARC.')
+        macho_dict['arc'] = {
+            'has_arc': has_arc,
+            'severity': severity,
+            'description': desc,
+        }
+        if has_rpath:
+            severity = 'warning'
+            desc = (
+                'The binary has Runpath Search Path (@rpath) set. '
+                'In certain cases an attacker can abuse this '
+                'feature to run arbitrary executable for code '
+                'execution and privilege escalation. Remove the '
+                'compiler option -rpath to remove @rpath.')
+        else:
+            severity = 'info'
+            desc = (
+                'The binary does not have Runpath Search '
+                'Path (@rpath) set.')
+        macho_dict['rpath'] = {
+            'has_rpath': has_rpath,
+            'severity': severity,
+            'description': desc,
+        }
+        if has_code_signature:
+            severity = 'info'
+            desc = 'This binary has a code signature.'
+        else:
+            severity = 'warning'
+            desc = 'This binary does not have a code signature.'
+        macho_dict['code_signature'] = {
+            'has_code_signature': has_code_signature,
+            'severity': severity,
+            'description': desc,
+        }
+        if is_encrypted:
+            severity = 'info'
+            desc = 'This binary is encrypted.'
+        else:
+            severity = 'warning'
+            desc = 'This binary is not encrypted.'
+        macho_dict['encrypted'] = {
+            'is_encrypted': is_encrypted,
+            'severity': severity,
+            'description': desc,
+        }
+        if is_stripped:
+            severity = 'info'
+            desc = 'Symbols are stripped'
+        else:
+            severity = 'warning'
+            desc = (
+                'Symbols are available. To strip '
+                'debugging symbols, set Strip Debug '
+                'Symbols During Copy to YES, '
+                'Deployment Postprocessing to YES, '
+                'and Strip Linked Product to YES in '
+                'project\'s build settings.')
+        macho_dict['symbol'] = {
+            'is_stripped': is_stripped,
+            'severity': severity,
+            'description': desc,
+        }
+        return macho_dict
+
+    def has_nx(self):
+        return self.macho.has_nx
+
+    def has_pie(self):
+        return self.macho.is_pie
+
+    def has_canary(self):
+        stk_check = '___stack_chk_fail'
+        stk_guard = '___stack_chk_guard'
+        ipt_list = set()
+        for ipt in self.macho.imported_functions:
+            ipt_list.add(str(ipt))
+        return stk_check in ipt_list and stk_guard in ipt_list
+
+    def has_arc(self):
+        for func in self.macho.imported_functions:
+            if str(func).strip() == '_objc_release':
+                return True
+        return False
+
+    def has_rpath(self):
+        return self.macho.has_rpath
+
+    def has_code_signature(self):
+        try:
+            return self.macho.code_signature.data_size > 0
+        except Exception:
+            return False
+
+    def is_encrypted(self):
+        return bool(self.macho.encryption_info.crypt_id)
+
+    def is_symbols_stripped(self):
+        for i in self.macho.symbols:
+            if i:
+                return False
+        return True
+
+    def get_libraries(self):
+        libs = []
+        for i in self.macho.libraries:
+            curr = '.'.join(str(x) for x in i.current_version)
+            comp = '.'.join(str(x) for x in i.compatibility_version)
+            lib = (f'{i.name} (compatibility version: {comp}'
+                   f', current version: {curr})')
+            libs.append(lib)
+        return libs
+
+    def get_symbols(self):
+        symbols = []
+        for i in self.macho.symbols:
+            symbols.append(i.name)
+        return symbols
+
+
+def macho_analysis(binary):
+    try:
+        logger.info('Running MachO Analysis on %s', binary.name)
+        cs = Checksec(binary)
+        chksec = cs.checksec()
+        symbols = cs.get_symbols()
+        libs = cs.get_libraries()
+        return {
+            'checksec': chksec,
+            'symbols': symbols,
+            'libraries': libs,
+        }
+    except Exception:
+        logger.exception('Running MachO Analysis')
+        return {}