Let's open it with jadx-gui. With the manifest we know that we can install in an Android from API 21 to API 30. <uses-sdk android:minSdkVersion="21" android:targetSdkVersion="30"/>
Let's see what we get if we launch it from an AVD
We click on next and we have a router we can check status
We need to launch burp and set it to intercept traffic from the avd. You can check my documentation on Android here to see how to set this up.
We have an interesting request here. This happens when we click on the "Check status button
We need to change our /etc/hosts file to be able to reach it 10.10.11.148 routerspace.htb
Once our hosts file is modified here is what happens in burp
burp
If we send this to the repeater and try command injection we can actually execute commands on the server
whoami
So we have a user paul
We can event grab the user flag this way
user
We have an .ssh folder in the home but it does not have a key
Let's get a reverse shell. I tried multiple command and was not successful to get a shell. It seems like there is a protection block of some sort.
The other option would be to generate a secret key and write it in the .ssh folder of Paul as we have access to it.
ssh-keygen we generate and ssh key I will name mine routerspace_rsa
keygen
So now we need to write it in the ssh folder using burp. We will have to escape double quotes for the command to actually work.
authorized_keys
We can cat it to make sure it worked
cat key
Now we should be able to log in with ssh using it. So I made a typo in for the filename make sure you name it authorized_keys, I modified it with mv.
ssh -i routerspace_rsa paul@10.10.11.148 now you should be able to login with ssh
ssh
Privilege escalation
Let's get linpeas wget https://github.com/carlospolop/PEASS-ng/releases/download/20230205/linpeas_linux_amd64
We will need to use scp because of the restrictions we had previously here is an example on scp scp FILE-TO-SEND user@ip:/path/to/folder so in my case scp -i routerspace_rsa linpeas_linux_amd64 paul@10.10.11.148:/home/paul (we need to specify the key)
chmod +x linpeas_linux_amd64 from the target we make our file executable
./linpeas_linux_amd64 we can run it
Interesting output
So here is what we could investigate from our linpeas output
The polkit CVE will not work because it needs Gnome-Control-Center which we do not have here.
Linpeas also mentions CVE-2021-3156. Let's get try with the poc from linepeas. Here are the steps.
No luck with this exploit, let's try another one and if it does not work we will try another CVE
