android-exploit

name	Android Exploit
description	Android vulnerability hunting and exploitation — APK analysis, native exploits, IPC bugs
tags	["android","apk","exploit","mobile","dalvik","native"]

Task: Android Vulnerability Hunting and Exploitation. Analyze APKs, find vulnerabilities, develop exploits.

Approach

Android security analysis requires: APK reverse engineering, Dalvik bytecode analysis, native code exploitation, IPC vulnerability hunting.

Phase 1: APK Analysis

APK Decompilation

Tools:
- apktool: Decode APK resources and smali code
- jadx: Decompile DEX to Java
- dex2jar: Convert DEX to JAR
- JD-GUI: View Java code

Analysis:
1. Extract APK: unzip app.apk
2. Decode resources: apktool d app.apk
3. Decompile code: jadx app.apk
4. Analyze manifest: AndroidManifest.xml
5. Review permissions: declared permissions

Manifest Analysis

AndroidManifest.xml checks:
- Exported components (exported="true")
- Permission requirements
- Custom permissions
- Backup configuration
- Debuggable flag
- Network security config

Key findings:
- android:exported="true" (exposes to other apps)
- android:debuggable="true" (debuggable app)
- android:allowBackup="true" (data leak)
- Custom permissions (over-privileged)

Component Analysis

Activities:
- Launchable activities (intent filters)
- Exported activities (access control)
- Deep link handling (URL exploitation)

Services:
- Exported services (IPC attack surface)
- Intent handling (malicious intents)
- Background services (data access)

Receivers:
- Broadcast receivers (system events)
- Ordered broadcasts (denial-of-service)
- Intent injection vulnerabilities

Providers:
- Content providers (data access)
- SQL injection (query parameters)
- Path traversal (URI manipulation)

Phase 2: Dalvik Bytecode Analysis

Smali Code Review

Patterns to find:
1. Hardcoded secrets (API keys, passwords)
2. Insecure crypto (ECB mode, weak keys)
3. SQL injection (concatenated queries)
4. XSS (webview JavaScript)
5. Command injection (Runtime.exec)

Search in smali:
- const-string (hardcoded strings)
- invoke-virtual (crypto operations)
- invoke-static (SQL operations)
- invoke-direct (command execution)

Runtime Analysis

Dynamic instrumentation:
- Frida: Hook and modify app behavior
- Xposed: System-wide modification
- MobSF: Automated security testing

Key hooks:
- SharedPreferences (data storage)
- SQLiteDatabase (SQL queries)
- WebView.loadUrl (XSS)
- Runtime.exec (command injection)
- Encryption operations (key extraction)

Phase 3: Native Code Exploitation

Native Library Analysis

Target: .so files in lib/ARM/, lib/x86/

Analysis:
1. Extract: unzip app.apk lib/*.so
2. Disassemble: Ghidra/IDA Pro
3. Find: JNI functions (Java_*)
4. Look for: Dangerous operations

Vulnerabilities:
- Buffer overflows in JNI
- Memory corruption in native code
- Insecure crypto implementations
- Hardcoded keys in native code
- Weak random number generation

JNI Exploitation

JNI vulnerability patterns:
1. Java → Native boundary checks
2. Buffer handling in native code
3. Array bounds checking
4. String handling (strcpy, sprintf)

Exploit development:
1. Identify vulnerable JNI function
2. Craft malicious Java input
3. Trigger buffer overflow
4. Control PC/SP registers
5. Bypass ASLR/DEP (ROP chains)
6. Execute shellcode

Native Memory Corruption

Targets:
- libnative.so (custom native code)
- OpenSSL integration
- SQLite native code
- Media codec libraries

Techniques:
- Stack overflow in JNI handlers
- Heap overflow in native allocations
- Use-after-free in native objects
- Integer overflow in size calculations

Exploitation:
1. Trigger vulnerability from Java
2. Control native code execution
3. Bypass sandbox (native code)
4. Gain code execution

Phase 4: IPC Vulnerabilities

Intent Spoofing

Attack: Malicious app sends crafted intent

Targets:
- Exported activities (component hijacking)
- Exported services (service hijacking)
- Broadcast receivers (intent injection)

Example:
Intent intent = new Intent();
intent.setClassName("com.victim.app", "com.victim.app.VulnActivity");
intent.putExtra("key", malicious_data);
startActivity(intent); // Trigger vulnerability

PendingIntent Hijacking

Vulnerability: PendingIntent with implicit intent

Attack:
1. Malicious app creates hijacking component
2. Victim app creates PendingIntent with implicit intent
3. Attacker triggers PendingIntent
4. Hijacking component receives intent
5. Access to victim app's permissions

Detection:
- Search for: PendingIntent.getIntent()
- Check: Intent is explicit or implicit
- Exploit: Create hijacking component

Content Provider SQL Injection

Vulnerability: Uns sanitized SQL query

Example:
Cursor cursor = getContentResolver().query(
    Uri.parse("content://com.victim.provider/data"),
    null,
    "name = '" + userInput + "'",  // ← SQLi!
    null,
    null
);

Attack:
1. Malicious app queries content provider
2. Inject SQL: ' OR '1'='1
3. Extract sensitive data
4. Modify database content

AIDL Interface Exploitation

Attack: Malicious app binds to AIDL service

Targets:
- Exposed AIDL interfaces
- Custom IPC protocols
- Bundle parameter handling

Exploitation:
1. Bind to vulnerable service
2. Call malicious methods
3. Pass crafted bundles
4. Trigger vulnerabilities
5. Access protected data

Phase 5: Application-Level Vulnerabilities

WebView Vulnerabilities

XSS in WebView:
- addJavascriptInterface (exposes Java methods)
- loadUrl with user input (XSS)
- file:// access (local file disclosure)
- debuggable WebView (remote inspection)

Exploitation:
1. Inject JavaScript into WebView
2. Call exposed Java methods
3. Access local files (file://)
4. Extract sensitive data
5. Execute arbitrary code

CVE-2012-6636:
addJavascriptInterface in Android < 4.2
→ Full code execution via JavaScript

Insecure Data Storage

Vulnerabilities:
- SharedPreferences world-readable
- SQLite database world-readable
- External storage (SD card) usage
- Hardcoded encryption keys
- Weak encryption algorithms

Attack:
1. Access app's data directory
2. Read SharedPreferences
3. Extract SQLite databases
4. Decrypt sensitive data
5. Extract credentials

Tools:
- adb shell
- sqlite3
- Key extraction
- Custom decryption scripts

Certificate Pinning Bypass

Target: Apps with certificate pinning

Bypass methods:
1. Frida script: Hook SSL verification
2. Xposed module: Disable pinning
3. Modify APK: Remove pinning code
4. Custom CA: Install malicious certificate

Frida script:
Java.perform(function() {
    var TrustManager = Java.use("javax.net.ssl.TrustManager");
    TrustManager.checkServerTrusted.implementation = function() {
        // Bypass certificate validation
    };
});

Phase 6: Permission and Access Control

Permission Bypass

Attack: Access protected features without permissions

Techniques:
1. Intent redirection (use other app's permissions)
2. Content provider confusion
3. Service hijacking
4. PendingIntent hijacking

Example:
- Victim app has READ_CONTACTS permission
- Attacker app has no permissions
- Attacker triggers victim app via Intent
- Victim app performs action on attacker's behalf
- Attacker gains indirect access to contacts

Access Control Issues

Vulnerabilities:
- Missing permission checks
- Weak permission checks (signature vs normal)
- UID confusion (shared UID)
- Exported components without protection

Exploitation:
1. Identify exported components
2. Check permission requirements
3. Test with malicious app
4. Bypass access controls
5. Access protected functionality

Phase 7: Android Kernel Exploitation

Kernel Vulnerabilities

Targets:
- Binder IPC (CVE-2019-2215, CVE-2020-0014)
- ION memory allocator (CVE-2020-0041)
- Media frameworks (CVE-2019-2025, CVE-2020-0022)
- Bluetooth stack (CVE-2020-0022)

Exploitation:
1. Trigger kernel vulnerability from app
2. Gain kernel code execution
3. Disable SELinux
4. Root device
5. Install persistent backdoor

SELinux Bypass

Goal: Disable SELinux enforcement

Methods:
1. Kernel exploit → Disable SELinux
2. Modify policy files (requires root)
3. Exploit SELinux policy bugs
4. Use permissive domains

Impact:
- Full system compromise
- Persistent root access
- Bypass all security mechanisms

Phase 8: Exploit Development

APK Exploit POC

1. Create malicious APK
2. Declare minimal permissions
3. Exploit target app
4. Extract data / execute code
5. Demonstrate impact

Example:
<manifest>
    <uses-permission android:name="android.permission.INTERNET"/>
</manifest>

public class ExploitActivity extends Activity {
    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        
        // Exploit vulnerable content provider
        Uri uri = Uri.parse("content://com.vulnerability.provider/data");
        Cursor cursor = getContentResolver().query(uri, null, 
            "' OR '1'='1", null, null); // SQLi
    }
}

Native Exploit POC

1. Identify vulnerable JNI function
2. Craft overflow payload
3. Build ROP chain
4. Bypass ASLR/DEP
5. Execute shellcode

Example (CVE-2020-0022):
// Bluetooth stack heap overflow
byte[] payload = new byte[1000];
Arrays.fill(payload, (byte)0x41); // Padding
payload[800] = (byte)0x00; // PC overwrite
// Send via Bluetooth L2CAP
socket.send(payload);

Phase 9: Testing and Validation

Emulator Testing

Tools:
- Android Studio Emulator
- Genymotion
- Android-x86

Setup:
1. Create AVD with vulnerable Android version
2. Install target APK
3. Install exploit APK
4. Test vulnerability
5. Verify exploit works

Device Testing

Physical devices:
1. Enable developer options
2. Enable USB debugging
3. Install APKs via adb
4. Test exploits
5. Monitor logs (adb logcat)

Considerations:
- Device-specific vulnerabilities
- Android version differences
- OEM customizations
- Kernel version variations

Final Report

[VULNERABILITY] Android SQL Injection
App: com.victim.app (v2.3.1)
Severity: HIGH (data extraction)
CVE: N/A (0-day)

[Bug Details]
Component: ContentProvider (com.victim.provider.DataProvider)
Vulnerability: SQL injection in query() method
Location: DataProvider.java:142
Code: selection = "user_id = '" + userInput + "'"

[Exploitation]
1. Malicious app queries provider
2. Inject: "' OR '1'='1"
3. Extract all user data
4. Access: emails, passwords, tokens

[POC APK]
Package: com.exploit.sqlite
Min SDK: 21
Permissions: None (exploits victim's permissions)

Intent:
Intent intent = new Intent();
intent.setClassName("com.victim.app", "com.victim.app.DataProvider");
String query = "content://com.victim.provider/data?user=' OR '1'='1";
Cursor cursor = getContentResolver().query(Uri.parse(query), null, null, null, null);

Impact:
- Extract 50,000 user records
- Access authentication tokens
- Bypass access controls
- No permissions required

Fix: Use parameterized queries

Tools

• Analysis: apktool, jadx, mobSF, Frida
• Exploitation: adb, custom APKs, Frida scripts
• Testing: Android Emulator, Genymotion, physical devices
• Documentation: Android developer docs, CVE database

Target Versions

• Android 4.x - 14.x (API 15-34)
• ARM, ARM64, x86, x86_64
• OEM variants: Samsung, Xiaomi, Huawei, etc.