diff --git a/modules/DetermineMinSDK.py b/modules/DetermineMinSDK.py old mode 100755 new mode 100644 diff --git a/modules/GeneralIssues.py b/modules/GeneralIssues.py old mode 100755 new mode 100644 diff --git a/modules/IssueType.py b/modules/IssueType.py old mode 100755 new mode 100644 diff --git a/modules/adb.py b/modules/adb.py old mode 100755 new mode 100644 index fe7b403b..5985bd18 --- a/modules/adb.py +++ b/modules/adb.py @@ -6,6 +6,7 @@ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.''' from modules import common,intents,report +import re def showAdbCommands(component,compType,packageName): #Print ADB commands for exploitation @@ -29,11 +30,17 @@ def showAdbCommands(component,compType,packageName): extras_list+=intents.find_extras(str(c[1]),common.sourceDirectory) if len(extras_list)>0: for t in extras_list: - command = "adb shell am start -a \"" + c[0] + "\" -n \""+packageName+str(c[1])+"\""+" --es "+str(t) + if re.match(r'^\..*',str(c[1])): + command = "adb shell am start -a \"" + c[0] + "\" -n \""+packageName+"/"+packageName+str(c[1])+"\""+" --es "+str(t)+" \"EXTRA_VALUE_IN_QUOTES\"" + else: + command = "adb shell am start -a \"" + c[0] + "\" -n \""+packageName+"/"+str(c[1])+"\""+" --es "+str(t)+" \"EXTRA_VALUE_IN_QUOTES\"" print command report.write_adb_commands("adbcommands-issues-list", common.Severity.VULNERABILITY, command, None, "activity") else: - command = "adb shell am start -a \"" + c[0] + "\" -n \""+packageName+"/"+packageName+str(c[1])+"\"" + if re.match(r'^\..*',str(c[1])): + command = "adb shell am start -a \"" + c[0] + "\" -n \""+packageName+"/"+packageName+str(c[1])+"\"" + else: + command = "adb shell am start -a \"" + c[0] + "\" -n \""+packageName+"/"+str(c[1])+"\"" print command report.write_adb_commands("adbcommands-issues-list", common.Severity.VULNERABILITY, command, None, "activity") else: @@ -41,7 +48,10 @@ def showAdbCommands(component,compType,packageName): extras_list=[] extras_list+=intents.find_extras(str(component),common.sourceDirectory) if len(extras_list)>0: - command = "adb shell am start -n \""+packageName+"/"+packageName+component+"\"" + if re.match(r'^\..*',str(component)): + command = "adb shell am start -n \""+packageName+"/"+packageName+component+"\"" + else: + command = "adb shell am start -n \""+packageName+"/"+component+"\"" print command extras = [] for e in extras_list: @@ -49,7 +59,10 @@ def showAdbCommands(component,compType,packageName): print "Possible extras to send: " + str(e) report.write_adb_commands("adbcommands-issues-list", common.Severity.VULNERABILITY, command, extras, "activity") else: - command = "adb shell am start -n \""+packageName+"/"+packageName+component+"\"" + if re.match(r'^\..*',str(component)): + command = "adb shell am start -n \""+packageName+"/"+packageName+component+"\"" + else: + command = "adb shell am start -n \""+packageName+"/"+component+"\"" print command report.write_adb_commands("adbcommands-issues-list", common.Severity.VULNERABILITY, command, None, "activity") elif str(compType)=='service': @@ -67,11 +80,17 @@ def showAdbCommands(component,compType,packageName): extras_list+=intents.find_extras(str(c[1]),common.sourceDirectory) if len(extras_list)>0: for t in extras_list: - command = "adb shell am startservice " +packageName+"/"+str(c[1])+" --es "+str(t) + if re.match(r'^\..*',str(c[1])): + command = "adb shell am startservice " +packageName+"/"+packageName+str(c[1])+" --es "+str(t) + else: + command = "adb shell am startservice " +packageName+"/"+str(c[1])+" --es "+str(t) print command report.write_adb_commands("adbcommands-issues-list", common.Severity.VULNERABILITY, command, None, "service") else: - command = "adb shell am startservice " +packageName+"/"+str(c[1]) + if re.match(r'^\..*',str(c[1])): + command = "adb shell am startservice " +packageName+"/"+packageName+str(c[1]) + else: + command = "adb shell am startservice " +packageName+"/"+str(c[1]) print command report.write_adb_commands("adbcommands-issues-list", common.Severity.VULNERABILITY, command, None, "service") elif str(compType)=='receiver': diff --git a/modules/certValidation.py b/modules/certValidation.py old mode 100755 new mode 100644 diff --git a/modules/common.py b/modules/common.py old mode 100755 new mode 100644 index 333ec16d..5f3cf718 --- a/modules/common.py +++ b/modules/common.py @@ -430,8 +430,9 @@ def tree(l): def normalizeActivityNames(activityList,package_name): for d in range(0,len(activityList)): - if not re.match(r''+str(package_name),str(activityList[d])): + if re.match(r'\..*',str(activityList[d])): activityList[d]=str(package_name)+str(activityList[d]) + return activityList def check_export(tag,output): """ diff --git a/modules/contentProvider.py b/modules/contentProvider.py old mode 100755 new mode 100644 diff --git a/modules/createExploit.py b/modules/createExploit.py old mode 100755 new mode 100644 index f69c8080..52e65524 --- a/modules/createExploit.py +++ b/modules/createExploit.py @@ -8,7 +8,7 @@ class ExploitType: """ - Enum type for exploitatin category + Enum type for exploitation category """ MANIFEST, ACTIVITY, INTENT, PERMISSION, SERVICE, RECEIVER, BROADCAST_INTENT, CERTIFICATE, WEBVIEW, CRYPTO = range(10) diff --git a/modules/createSploit.py b/modules/createSploit.py old mode 100755 new mode 100644 diff --git a/modules/cryptoFlaws.py b/modules/cryptoFlaws.py old mode 100755 new mode 100644 diff --git a/modules/exportedPreferenceActivity.py b/modules/exportedPreferenceActivity.py old mode 100755 new mode 100644 diff --git a/modules/externalMethodDeclarations.py b/modules/externalMethodDeclarations.py old mode 100755 new mode 100644 diff --git a/modules/filePermissions.py b/modules/filePermissions.py old mode 100755 new mode 100644 diff --git a/modules/filters.py b/modules/filters.py old mode 100755 new mode 100644 diff --git a/modules/findBoundServices.py b/modules/findBoundServices.py old mode 100755 new mode 100644 diff --git a/modules/findBroadcasts.py b/modules/findBroadcasts.py old mode 100755 new mode 100644 diff --git a/modules/findMethods.py b/modules/findMethods.py old mode 100755 new mode 100644 index 31ab9df4..b25952b8 --- a/modules/findMethods.py +++ b/modules/findMethods.py @@ -168,7 +168,7 @@ def find_entry(tree, comp_type): elif comp_type == 'receiver': entry = ['onReceive'] elif comp_type == 'service': - entry = ['onCreate', 'onBind', 'onStartCommand'] + entry = ['onCreate', 'onBind', 'onStartCommand', 'onHandleIntent'] #TODO - The provider is a unicorn and needs more work elif comp_type == 'provider': entry = ['onReceive'] diff --git a/modules/findPending.py b/modules/findPending.py old mode 100755 new mode 100644 diff --git a/modules/findTapJacking.py b/modules/findTapJacking.py old mode 100755 new mode 100644 diff --git a/modules/intentTracer.py b/modules/intentTracer.py old mode 100755 new mode 100644 diff --git a/modules/intents.py b/modules/intents.py old mode 100755 new mode 100644 diff --git a/modules/localMethodDeclarations.py b/modules/localMethodDeclarations.py old mode 100755 new mode 100644 diff --git a/modules/report.py b/modules/report.py old mode 100755 new mode 100644 diff --git a/modules/unpackAPK.py b/modules/unpackAPK.py old mode 100755 new mode 100644 diff --git a/modules/useCheckPermission.py b/modules/useCheckPermission.py old mode 100755 new mode 100644 diff --git a/modules/webviews.py b/modules/webviews.py old mode 100755 new mode 100644 diff --git a/modules/writeExploit.py b/modules/writeExploit.py old mode 100755 new mode 100644 diff --git a/qark.py b/qark.py old mode 100755 new mode 100644 index 3fc54905..e70e0fe0 --- a/qark.py +++ b/qark.py @@ -566,11 +566,11 @@ def reportBadger(identity, objectlist): act_priv_list, act_exp_list, act_exp_perm_list, act_prot_broad_list=[],[],[],[] act_priv_list, act_exp_list, act_exp_perm_list, act_prot_broad_list, report_data, results=common.check_export('activity',True) - #Normalizing activity names for use in exploit APK to all be fully qualified - common.normalizeActivityNames(act_priv_list,package_name) - common.normalizeActivityNames(act_exp_list,package_name) - common.normalizeActivityNames(act_exp_perm_list,package_name) - common.normalizeActivityNames(act_prot_broad_list,package_name) + #Normalizing activity names for use in exploit APK, so all will be absolute + act_priv_list=common.normalizeActivityNames(act_priv_list,package_name) + act_exp_list=common.normalizeActivityNames(act_exp_list,package_name) + act_exp_perm_list=common.normalizeActivityNames(act_exp_perm_list,package_name) + act_prot_broad_list=common.normalizeActivityNames(act_prot_broad_list,package_name) reportBadger("appcomponents", results) common.print_terminal(report_data) @@ -977,6 +977,8 @@ def reportBadger(identity, objectlist): print str(i) extras_list=[] extras_list+=intents.find_extras(str(i),common.sourceDirectory) + if re.match(r'^\..*',str(i)): + i=str(package_name)+str(i) exploit.setExportedActivity(str(i)) for j in range(0,len(extras_list)): extras_list[j] = extras_list[j].replace('\"','') @@ -991,7 +993,6 @@ def reportBadger(identity, objectlist): if len(actalias_exp_list)>0: print "ok" if len(serv_exp_list)>0: - print "ok" for i in range(0, len(serv_exp_list)): exploit = createExploit.exploitService() exploit.setIntent(filters.find_package() + serv_exp_list[i])