- Hello all and welcome to the new video of Android Security and Exploitation by
Pentester Academy. My name is Aditya and I'm your course instructor for this entire
training series. So in the previous video, we had a look at how you can use Drozer to
exploit some of the content providers of a vulnerable application. But oftentimes
content provider are not exactly vulnerable to the type of vulnerability
we saw on the previous video. So there could be different kinds of
vulnerability in the content providers. That's what we are going to have a look at
in this particular video. This is a vulnerability in Adobe Reader, where
instead of querying a particular content provider, you can use the
vulnerable content provider to perform a Path Traversal attack and read any
arbitrary files from the file system. Now, one of the interesting exploitation
scenarios for this particular vulnerability would be to use the Adobe
Reader vulnerability in order to read files from the SD card which is the
external storage. Now the thing to note here is Adobe Reader has the external
storage read permission whereas Drozer does not have. Now if we can read files
from the SD card using Drozer and exploit content provider of Adobe then that means
Adobe is vulnerable. Now this vulnerability was discovered by Sebastian
and you can also have a look at the blog post to read more about the vulnerability.
So let's jump into the vulnerability. So, I have my Genymotion running over here and
this is my Santoku VM...
So let me just start up a terminal over here.
Right now no devices are connected, connect it to this device. I've now
enlisted in my adb devices. So let me just start up Dozer. The first thing I want to
do is to find out the package name for Adobe Reader. So I can just do a run
app.package.list. I can look for Adobe. Here is the package name for Adobe that's
com.adobe.reader. I can now figure out the attack surface and look into what all
different components are vulnerable. So you can simply do run
app.package.attacksurface and parse in the package name of the application. It says
one content provider is exported over here. This means that there is a
vulnerable content provider which is exported and we can use it to perform any
kind of exploitation of the application. Now if I look at what all different
content providers are there using app.provider.finduri, I'll get that
particular one content provider. So this is the content provider basically both of
them are the same thing . So I've got one content provider. Now if I proceed in the
normal way like try to query this, I might not get the desired result. So if I try to
query using this content provider, I get an unknown error. Now, this is because
this particular content provider is not able to be queried or it's not like it's
attached to some database which can fetch you some information. In this particular
scenario, we'll use the app.provider.read and try to read from arbitrary files.
Before we actually do that let's first confirm that we have a file on the SD card
which we are going to read. So I'll go to mnt/sdcard and I have a secret.txt over
here which simply says this is a secret. Also, let's have a look at the permissions
of both Drozer which has a package named com.mwr.dz -a. So Drozer has the
permission, Android permission internet which means it just has the internet
permission and it can't read files from the SD card because it does not have the
permission whereas at the same time if we try to get informed about the Adobe
Reader, we see that it has a read external storage permission. This means, Adobe
Reader can read files from the SD card whereas Drozer can't. Quite simple. Let's
just try to exploit it using the Path Traversal Vulnerability. So instead of
query, we'll use read. Put in the provider name. Now here just after the content
provider, we have to put in the path of the application. If we try to put in the
path, mnt/sdcard/secret.txt. It doesn't bring up the expected result. This is
because this particular path is not the correct path because com.adobe.reader file
provider, content provider, might be reading from one particular location and
if we try to go into the mnt/sdcard. I'll try to go from that particular location
instead of from the root of the file system. So all we have to do here is just
put in a few directory traversals so that we reach the top of the file system and
from there we go into mnt sdcard. Then try to read the secret.txt. Awesome. Now, in
this way we're able to read the secret.txt which is located in sdcard and even if
Drozer does not have the permission it can exploit the permissions of Adobe. So this
is another kind of exploitation scenario of content providers and this is something
which you might see in a lot many different applications as well. So
whenever you look for vulnerabilities in content providers make sure apart from
just checking for query, you also check for the read-based content provider
vulnerability. So that's all for this video. If you have any feedback or
queries, feel free to reach me out at adi@attify.com. If you want to do the
certifications, you can do it at securitytube-training.com. Thank
you.