CVE-2021-40724 PoC — Adobe Acrobat Reader 路径遍历漏洞

Description

This is an Exploit App I made when solving the DocumentViewer challenge (CVE-2021-40724) from MobileHackingLab. It will download a libdocviewe_pro.so library from your local machine unto the vulnerable app's internal storage, load it upon relaunch and achieve an RCE.

介绍

## DocViewerExploit App - CVE-2021-40724
This is the source code to exploiting the [Document Viewer](https://www.mobilehackinglab.com/course/lab-document-viewer-rce) by [MobileHackingLab](https://www.mobilehackinglab.com/).

## About the Vulnerable App
This is an exploit app for the [MobileHackingLab DocumentViewer Abdroid App Dynamic Code Loading RCE challenge](https://www.mobilehackinglab.com/course/lab-document-viewer-rce).
This challenge emulates `CVE-2021-40724` vulnerability identified in Adobe Acrobat Reader Android app.

![image](https://github.com/user-attachments/assets/fe69070e-7627-4004-9eac-bbf12b6c6d65)  


The app dynamically loads code from a library file but there exist an LFI vulnerability due to how the app handles incoming URIs with getLastPathSegment().  

![image](https://github.com/user-attachments/assets/67f50d78-da2d-45b5-bb77-45c16ed40d07) ![image](https://github.com/user-attachments/assets/b7503319-f814-4b26-99e5-c384edd7ce8d)

## About the Exploit App 

This LFI vulnerability can be abused to write our own library files into the vulnerable app which gets loaded upon app launch.

![image](https://github.com/user-attachments/assets/82454c6c-2a6b-4b69-a6c6-ec6aae894feb)    ![image](https://github.com/user-attachments/assets/d70ade6f-401e-4c99-be45-90f89af59cb0)

![image](https://github.com/user-attachments/assets/19259108-5a77-4c60-9deb-c9a2d8d2cd6f)  


When our malicious library file gets loaded, our remote command gets executed

![image](https://github.com/user-attachments/assets/231b15b5-5d06-47ba-9c9d-17e5e12efa28)

## 

Reach Out to me:  

[![tinopreter](https://skillicons.dev/icons?i=twitter)](https://x.com/tinopreter)
[![tinopreter](https://skillicons.dev/icons?i=linkedin)](https://www.linkedin.com/in/tinopreter)
[![tinopreter](https://skillicons.dev/icons?i=gmail)](mailto:osei.somuah771@gmail.com)

文件快照

备注