FotaProvider.apk — Arbitrary Command Execution

FotaProvider.apk — Arbitrary Command Execution

This is an exercise from Maddiestone’s “Android Reverse Engineering 101” workshop.

AndroidManifest.xml

<manifest xmlns:android="http://schemas.android.com/apk/res/android" android:sharedUserId="android.uid.system" android:versionCode="220" android:versionName="2.2.0" package="com.adups.fota.sysoper">

android:sharedUserId="android.uid.system"

At first, we see a major issue on the App. The App shares the same userId as the system. Meaning it can execute all of its functionalities with system privileges. Potentially harmful.

Another potentially vulnerability. All those App Components have the exported parameter defined as “true”. Meaning we can execute system …

android reversing