Mobile Hacking Lab - Lab - Config Editor
Last updated
Last updated
Welcome to the Config Editor Challenge! In this lab, you'll dive into a realistic situation involving vulnerabilities in a widely-used third-party library. Your objective is to exploit a library-induced vulnerability to achieve RCE on an Android application.
Let's have a look at the app:
From this screen, we click on ConfigEditor
We have then this screen
It seems to manipulate yaml files. If we try to load the provided file which is a yaml, we get this.
Note I got this in my local lab
Pull the app to analyse it adb pull /data/app/~~7nJyEbpomszhvZKacYpBDQ==/com.mobilehackinglab.configeditor-Xlgn336TGw-b6-q5Xmjmyg==/base.apk
I decompiled it with apktools apktool d base.apk
We see here another reference to yaml. But nothing much in terms of libraries.
As it is using yaml, I tried to check for a file with yaml in the name in the decompiled files using find.
And if we search snakeyaml on Internet, it is a library. So it might be our vulnerable library. We find a mention to it in this tutorial from baeldung and it is suppose to parse yaml file
This here seems to be the repo
And the following articles refer to CVE-2022-1471 found on snakeyaml:
Let's inspect the code with jadx-gui (as we won't have java code with apktool)
You will find the content that is of interest for us here:
Before having a look at the MainActivity I want to check a class that caught my attention, the LegacyCommandUtil. It might come in handy as the CVE is vulnerable to code injection.
Here is the code
So it is definitely what I think it is. This will allow us to execute command in the system so we might be able to use it to exploit the CVE in the third party library.
In the mainActivity this function looks really interesting
So first of all I think it is worth mentioning that intent is a messaging object you can use to request an action from another app component. You might use an intent for various tasks, like opening a new screen (Activity), showing a web page, making a call, or even taking a photo. Now that this is cleared up, let's dive into understanding what the code does. It checks if the app was asked to open a link. If it was, the app tries to copy the content from that link and then do something with it.
Here is a clear breakdown of the function:
=> Check why the app was opened: The app looks at the reason it was opened. If it was opened because someone clicked a link that should open in the app (like clicking a link to a file that the app knows how to open), it moves to the next step.
=> Get the link's content: The app tries to get the file or data from the link.
=> Do something with the content: Once the app has the content, it passes it to the function loadYaml.
Here is the loadyaml function. We can see it uses the snakeyaml library. We know this because in the import we have this
And in the function we can see that DumperOptions is used along with Yaml.
So what does the loadyaml function do? In brief it seems to read a YAML file from the uri provided, it processes it, and display the formatted content in the application's UI.
Serialization
We also see that it serialize and deserialize the object. In brief, serialization is the process of turning an object into a format that can be easily stored or transmitted, and later reconstructed back into the original object. For example, imagine you have a complex puzzle that you've put together; serialization would be like taking a picture of the puzzle, allowing you to show it to someone else or look at it again later without having to put the puzzle together again. When you want to recreate the puzzle, you just look at the picture. In computing, serialization often turns objects into a format like a string of text (JSON, XML, etc.) or a byte stream, so it can be saved to a file, sent over a network, or stored in a database.
I wanted to explain serialization because this is where the vulnerability lies with CVE-2022-1471 in snakeyaml.
So here it seems like we could try to feed the app with a malicious yaml file to get remote code execution.
To exploit it I recommend that you read the blog posts I shared in the resources.
Now that we understood everything related to the vulnerability and the vulnerable snippet of code, we can put everything together and try to exploit the vulnerability. We could do the following methodology:
Create a malicious yaml file that will use the LegacyCommandUtil to send a remote shell to our server
Open the yaml with the vulnerable application and hopefully get the shell.
However, How could we get a shell? Is there a netcat like tool in android os by default? According to this stack overflow article there should be with toybox nc [options]
Let's see which version of Android is required by the app in the manifest it says minSdkVersion="26".
And sdk 26 should be Android 8.0 which is Oreo and therefore later than Nougat, so we should be good.
Let's try this.
Here is the code in the yaml
Note: If you are doing this on a local lab, check this article for networking with your emulator on android.com
I am having an issue with netcat and can not get a proper shell.
Let's try to create a file with the exploit. Something like this in our yaml should work.
And it does!
We load our malicious yaml
And in the shell from our emulator we can confirm that the file is created
