1

I'm new to android pentesting and I would like to know :

if sending an object created via the result of intent.getSerializableExtra("EXTRA_TEST");

to handler.postDelayed(TheObject,500) could lead to a vulnerability ?

like

d.a aObject = (d.a) intent.getSerializableExtra("EXTRA_BUY_TAB_START_POSITION_EXPLORE");
if (aVar2 != null) {
    this.handler.postDelayed(new e(aVar2), 500);
}

I imagine that if we send an intent with a serialized runnable the target application would execute the malicious code... Is it right ?

edit : "d" is : public final class d extends Fragment and d.a is

public static final class a {
        private a() {
        }

        public /* synthetic */ a(DefaultConstructorMarker defaultConstructorMarker) {
            this();
        }

        public final d a() {
            return new d();
        }
    }
0

I hope this is some automatically decompiled code because it's horrendous to read.

Since the Runnable object is retrieved from a key/value map (the intent object) you could force a custom runnable into the intent map at the specific key "EXTRA_BUY_TAB_START_POSITION_EXPLORE" so that it would be run after 500ms.

In you code you need to clarify :

  • What is aVar2 ?
  • What does the class "e" do ?
  • Your d.a object is never used in your sample

I hope that will lead you to the correct path.

| improve this answer | |
  • Oh sorry I badly renamed aVar2 the d.a is : d.a aVar2 = ... and not aObject The e class is just an interface (pastebin.com/p3VFG8dS) – Neolex Oct 8 '19 at 14:12
  • I'm trying to create a payload but I get the error : java.lang.RuntimeException: Parcelable encountered ClassNotFoundException reading a Serializable object (name = fr.neolexsecurity.rceapp.a) Do you know How should I do that ? – Neolex Oct 8 '19 at 15:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.