POC详情： 2775a19bc94b4d612abbda1755b78a90f886e438

来源
https://github.com/tinopreter/DocViewerExploitApp
关联漏洞
标题： Adobe Acrobat Reader 路径遍历漏洞 (CVE-2021-40724)
描述：Adobe Acrobat Reader是美国奥多比（Adobe）公司的一款PDF查看器。该软件用于打印，签名和注释 PDF。 Adobe Acrobat Reader 中存在路径遍历漏洞，该漏洞源于产品在运行过程中存在配置等错误。未授权的攻击者可利用漏洞获取受影响组件敏感信息。以下产品及版本受到影响：Adobe Acrobat Reader for Android 21.8.0 版本及之前版本，Adobe Reader Mobile Android(7.0及之前平台) 21.9.0 版本。
描述
This is an Exploit App I made when solving the DocumentViewer challenge (CVE-2021-40724) from MobileHackingLab. It will download a libdocviewe_pro.so library from your local machine unto the vulnerable app's internal storage, load it upon relaunch and achieve an RCE.
介绍
## DocViewerExploit App - CVE-2021-40724
This is the source code to exploiting the [Document Viewer](https://www.mobilehackinglab.com/course/lab-document-viewer-rce) by [MobileHackingLab](https://www.mobilehackinglab.com/).

## About the Vulnerable App
This is an exploit app for the [MobileHackingLab DocumentViewer Abdroid App Dynamic Code Loading RCE challenge](https://www.mobilehackinglab.com/course/lab-document-viewer-rce).
This challenge emulates `CVE-2021-40724` vulnerability identified in Adobe Acrobat Reader Android app.

![image](https://github.com/user-attachments/assets/fe69070e-7627-4004-9eac-bbf12b6c6d65)  


The app dynamically loads code from a library file but there exist an LFI vulnerability due to how the app handles incoming URIs with getLastPathSegment().  

![image](https://github.com/user-attachments/assets/67f50d78-da2d-45b5-bb77-45c16ed40d07) ![image](https://github.com/user-attachments/assets/b7503319-f814-4b26-99e5-c384edd7ce8d)

## About the Exploit App 

This LFI vulnerability can be abused to write our own library files into the vulnerable app which gets loaded upon app launch.

![image](https://github.com/user-attachments/assets/82454c6c-2a6b-4b69-a6c6-ec6aae894feb)    ![image](https://github.com/user-attachments/assets/d70ade6f-401e-4c99-be45-90f89af59cb0)

![image](https://github.com/user-attachments/assets/19259108-5a77-4c60-9deb-c9a2d8d2cd6f)  


When our malicious library file gets loaded, our remote command gets executed

![image](https://github.com/user-attachments/assets/231b15b5-5d06-47ba-9c9d-17e5e12efa28)

## 

Reach Out to me:  

[![tinopreter](https://skillicons.dev/icons?i=twitter)](https://x.com/tinopreter)
[![tinopreter](https://skillicons.dev/icons?i=linkedin)](https://www.linkedin.com/in/tinopreter)
[![tinopreter](https://skillicons.dev/icons?i=gmail)](mailto:osei.somuah771@gmail.com)
文件快照

 [4.0K]  /data/pocs/2775a19bc94b4d612abbda1755b78a90f886e438
├── [4.0K]  app
│   ├── [1.0K]  build.gradle.kts
│   ├── [ 750]  proguard-rules.pro
│   └── [4.0K]  src
│       ├── [4.0K]  androidTest
│       │   └── [4.0K]  java
│       │       └── [4.0K]  com
│       │           └── [4.0K]  tino
│       │               └── [4.0K]  badsploit
│       │                   └── [ 750]  ExampleInstrumentedTest.java
│       ├── [4.0K]  main
│       │   ├── [1.4K]  AndroidManifest.xml
│       │   ├── [4.0K]  java
│       │   │   └── [4.0K]  com
│       │   │       └── [4.0K]  tino
│       │   │           └── [4.0K]  badsploit
│       │   │               └── [1.6K]  MainActivity.java
│       │   └── [4.0K]  res
│       │       ├── [4.0K]  drawable
│       │       │   ├── [5.5K]  ic_launcher_background.xml
│       │       │   └── [1.7K]  ic_launcher_foreground.xml
│       │       ├── [4.0K]  layout
│       │       │   └── [1.5K]  activity_main.xml
│       │       ├── [4.0K]  mipmap-anydpi
│       │       │   ├── [ 343]  ic_launcher_round.xml
│       │       │   └── [ 343]  ic_launcher.xml
│       │       ├── [4.0K]  mipmap-hdpi
│       │       │   ├── [2.8K]  ic_launcher_round.webp
│       │       │   └── [1.4K]  ic_launcher.webp
│       │       ├── [4.0K]  mipmap-mdpi
│       │       │   ├── [1.7K]  ic_launcher_round.webp
│       │       │   └── [ 982]  ic_launcher.webp
│       │       ├── [4.0K]  mipmap-xhdpi
│       │       │   ├── [3.8K]  ic_launcher_round.webp
│       │       │   └── [1.9K]  ic_launcher.webp
│       │       ├── [4.0K]  mipmap-xxhdpi
│       │       │   ├── [5.8K]  ic_launcher_round.webp
│       │       │   └── [2.8K]  ic_launcher.webp
│       │       ├── [4.0K]  mipmap-xxxhdpi
│       │       │   ├── [7.6K]  ic_launcher_round.webp
│       │       │   └── [3.8K]  ic_launcher.webp
│       │       ├── [4.0K]  values
│       │       │   ├── [ 147]  colors.xml
│       │       │   ├── [  71]  strings.xml
│       │       │   └── [ 399]  themes.xml
│       │       ├── [4.0K]  values-night
│       │       │   └── [ 329]  themes.xml
│       │       └── [4.0K]  xml
│       │           ├── [ 478]  backup_rules.xml
│       │           └── [ 551]  data_extraction_rules.xml
│       └── [4.0K]  test
│           └── [4.0K]  java
│               └── [4.0K]  com
│                   └── [4.0K]  tino
│                       └── [4.0K]  badsploit
│                           └── [ 379]  ExampleUnitTest.java
├── [ 167]  build.gradle.kts
├── [4.0K]  gradle
│   ├── [ 940]  libs.versions.toml
│   └── [4.0K]  wrapper
│       ├── [ 58K]  gradle-wrapper.jar
│       └── [ 233]  gradle-wrapper.properties
├── [1.2K]  gradle.properties
├── [5.6K]  gradlew
├── [2.6K]  gradlew.bat
├── [1.8K]  README.md
└── [ 534]  settings.gradle.kts

31 directories, 36 files
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
    3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。