m0bilesecurity / RMS-Runtime-Mobile-Security

Runtime Mobile Security (RMS) 📱🔥 - is a powerful web interface that helps you to manipulate Android and iOS Apps at Runtime
https://twitter.com/mobilesecurity_
GNU General Public License v3.0
2.58k stars 373 forks source link

[File Manager] Download files directly from the Web Page #20

Closed m0bilesecurity closed 3 years ago

m0bilesecurity commented 4 years ago

frida-fs is the best solution but I need an help with the implementation. I would like to auto compile (via frida-compile) the default.js just after the pip3 install -r requirements.txtcommand.

DEMO_File_Manager

m0bilesecurity commented 4 years ago

frida-fs has been implemented to enable files download directly from the browser (File Manager TAB).

In order to enable the download button, follow the steps below:

  1. Open the file called "mobilesecurity.py" and set the BETA variable to True
  2. Compile the "RMS_Core.js" agent via frida-compile! Just run the command npm install directly from the agent folder. A file called "_RMS_Core_BETA.js" will be generated.
  3. Run RMS!
m0bilesecurity commented 4 years ago

Feature seems currently broken. It seems that python side I'm not able to obtain the file from the js API.

e.g. RMS_Core_BETA.js

function download_file_at_path_Android(path)
{
  var file;
  Java.perform(function (){
    file=fs.readFileSync(path) 
    console.log(file) <-- file is printed successfully
  })
  return file;
}

mobilesecurity.py

@app.route('/file_manager', methods=['GET', 'POST'])
def file_manager():
    global mobile_OS
    global app_env_info

    files_at_path=None
    path=""
    if request.method == 'GET':
        path=request.args.get('path')
        download=request.args.get('download')
        if download:
            file=api.downloadfileatpath(download) <-- here the file is null
            ... etc

Any ideas? Thanks

m0bilesecurity commented 3 years ago

RMS is now powered by @nodeJS and a public npm package has been published on npmjs. The process to compile the frida agent is now completely transparent to the user (it is launched automatically while installing the npm app/package).

NPM

frida-fs still needs to be implemented in order to enable files download directly from the browser.