- Hello all and welcome to the new video of Android Security and Exploitation
training series by Pentester Academy. My name is Aditya and I'm your course
instructor for this entire training series. You can check out the course at
PentesterAcademy.com and you can also have a look at the certifications at
securitytube-training.com. So in the previous videos we had a look at some
of the vulnerabilities in the different content providers. Also different flaws
with the permissions in content providers and these kind of things. Now, in this
case we are going to have a look at an application called Dropbox which most of
you might be familiar with. So in this particular application, there was a
vulnerability in content provider and you could have simply identified the
vulnerability just by having a look at the AndroidManifest.xml file and the
vulnerability was even though the content providers were not directly exported but
the additional parameters that were set up with the protecting the content providers
was not secure enough. There's something called as path permission which we'll have
a look at it later on. So that wasn't properly set. This vulnerability was
discovered by Intrepidus Group. They also made a POC application which we'll have
a look at in this particular video. The first thing which we will do is, we will
have a look at the dropbox.apk, which is in downloads/training/vulnapps and here we
have dropbox.apk. Let's first of all decompile the dropbox.apk and have a look
at its AndroidManifest.xml file. So vi dropbox/AndroidManifest.xml. This is how
the AndroidManifest looks like and if you look for provider, you'll see that there
is a content provider declared over here and it has the Android authorities, the
name of the content provider and it also has a particular flag called
grant-uri-permission. Now if you go to the Android documentation, Android grant uri
permission and if you have a look at it, you'll see that it specifies which
particular data subsets are allowed to access the content provider. And it also
has some more attributes like pathPrefix and if you look in pathPrefix, it says a
path identifying the data subsets that the permission can be granted for. And if you
look in the dropbox manifest file it has the path prefix set to as "/". What this
means is they are declaring the content provider and they are trying to protect it
using grant uri permission and pathPrefix by specifically allowing permissions but
the thing that went wrong was the path prefix to be declared as "/". So what
slash means is they have granted access to their provider to the entire file system
of Android with the "/". So anything that this provider interacts with is now
accessible to all the applications or even the entire Android file system in general.
What can be done with this? Let's have a look at adb shell and let's go to the
dropbox data directory. Here I'll go to databases and there's a database called
prefs.db. Look in prefs.db. There is android_metadata table. If you do
android_metadata...let's turn on the headers. Once you change the mode to line,
select * from android_metadata. Okay. So right now there's nothing. Also there's
something called as Android account prefs. Let's see what's in there. So this has the
entire access key and these kind of things. There's an email and the other
authentication token and these kind of things. If you somehow get access to this
particular table and maybe upload this prefs.db to some particular public folder,
we'll be able to access it by another system or an attacker can be able to
access it. That means its entire security has been compromised. That's what we are
going to do with this particular Dropbox vulnerability. So we have a DropboxVuln
application which came along with the POC created by the Intrepidus group. If you
look in the code for this application...in activity, so it simply takes the prefs.db
and put it inside the files to be uploaded. So it takes the prefs.db and
tells that this particular file has to be uploaded to the public folder. So whenever
this DropboxVuln will start, it will add this particular file to Dropbox queue and
whenever Dropbox will start, it will start uploading this particular prefs.db to its
public folder. So let's try to see it in action over here. So if I go to Dropbox in
the public folder, it's currently empty. If I try to run DropboxVuln, it simply
says Hello world but now if go back to Dropbox and open up the public folder, you
can see that a file is getting uploaded over here. Once it gets done we can be
able to access it from anywhere. So prefs.db got uploaded and it's in the
public folder so it can be accessed from different locations. And this particular
SQLite database contains all the different account tokens and the other sensitive
information of the user. So this is how you can find different kinds of
vulnerabilities in content providers and this was one such particular case study
which might be useful for you. That's all for the content provider based
vulnerability. I hope you liked the video and if you have any feedback or queries,
feel free to reach out to me at adi@attify.com or you can also tweet out
to me @adi1391. Thank you.