Chaining attack vectors to pwn a company.
By: Rony Das
Tags: Security, Android, Java, Information Security, Web App Security

Workflow of the Application

Our target had an Android Application as well as a Web Application giving ourselves a wide scope to start enumerating and having a general idea of how their applications were working at the back-end.

Working of the Web Application: This web application allows anyone to Sign Up for their services hosted on a particular sub-domain say redacted.target.com. And once you’re signed up as a normal user with the company you can upload your details and information related to you on the account to set it up according to the services offered.

Working of the Android Application: This Android Application is of their Partners Portal. The Android Application was more interesting as this Application doesn’t allows everyone to sign up as a Partner, You need to verify yourself as a legitimate person having skills on the works they offer & submitting documents related to the work they are offering. I decompiled the APK file & The only thing which were similar between the Web App & the Android App was both their APIs which were connecting to the same domain but having different endpoints.

So, this was going really interesting as i do not have access to any of their test credentials for the Partner’s Android App to test their API endpoints. I was only left with the decompiled files & codes on the desk. Now we have a basic idea about how things were working, let us jump into the technical understanding of the application and lets understand how i escalated this from having nothing to compromising millions of their accounts registered with the company.

Technical Understanding

If you want to register yourself as a Partner you need to call them on a given number on the website to their 24 * 7 available customer support and can provide details they needed to verify yourself as a legitimate partner.

So, what would you have done if you were at the same scenario i was? It’s obvious. I called them up & social engineered them to make them believe that we want to sign up as a partner and provided some legit looking details which were actually dummy details created at my end. The verification process was over, everything went fine. But they informed me that they will take couple of days to provide us the credentials to partner portal. I knew we have deadlines right, 2–3 days was a long time and i can’t afford wasting time on just registering a account on their partner’s portal.

If you remember i already have decompiled the APK file. So i went that way. And started looking into the huge source codes available.

I was looking through the directory structures and found some susceptible files where I can now at least concentrate into.

Above are the files I was specifically looking into. I started reading the codes of the ISignIn.java file. And within a couple of minutes i found something really interesting which took my attention and made everything clear about the Login mechanisms they were using and how they were Saving passwords to the databases at the back-end.

Lets look at the code and understand the mechanism.

Vulnerable Code which could allow us to take over Partner Accounts:

@FormUrlEncoded

@POST("/ppapp/savepassword")

void getSavePassword(@Field("mobile") String str, @Field("password") String str2, @Field("confirmPassword") String str3, Callback<OTPModel> callback);

This particular function took my attention which were sending some form-collected data into the POST parameters to the endpoint /ppapp/savepassword . I was pretty sure the developers were using this function to set new passwords for the users.

But here the question arises. How we are going to exploit this vulnerability? If we look into the function, we can see the function getSavePassword takes three functions parameters in.

getSavePassword(@Field("mobile") String str, @Field("password") String str2, @Field("confirmPassword")

`mobile` parameter `password` parameter `confirmPassword` parameter

We need to full fill the need of supplying three parameters to the function to make the request happen. You might have noticed they are changing the password of users putting mobile phone number as their uniquely identified kind a`key`.

The first priority here is i need to have a mobile number already registered with the company. And to full fill the need we started enumerating other files which might throw us some more details regarding users already registered.

While enumerating other files, i found another endpoint which seems to be related with the customer profile details or vice versa.

After that i started searching where and how this endpoint @GET("/getprofilejson") is working by looking at the source codes left with me.

I found that the endpoint @GET("/getprofilejson") is working with two HTTP GET parameters.

`uri` `consumerId`

Enumerating the source codes more and more gave me the values which were fitting into these two parameters. The `uri` parameter is taking a `location` which in my case was %2Feast%2Fassam%2Fbongaigaon%2F and `consumerId` was of 6 digit integer value, so i just passed a random 6 digit integer value ‘123456’ But nothing happened.

I wrote a python script to bruteforce the `consumerId`.

The API endpoint was throwing data’s at ‘391149’ which holds a token value for ‘example_profile_id’ and meant to be supplied as HTTP POST parameter on the endpoint @GET("/getprofilejson") as "example_profile_id=82f088332d0611e484950e2f866a9102" to get hold on the registered customer profile details.

My goals are achieved. Now we have a registered customer’s phone number. It’s time to code a exploit and make it happen. Lets jump into the last section of exploitation.

EXPLOITING –

A coded up exploit to account take over.

Response:

And finally i coded a mass account take over exploit where the script grabs user’s phone number bruteforcing the `consumerId` and passing the token value retrieved from the response to get phone numbers of the users and finally the invoking the @POST("/ppapp/savepassword") endpoint to directly changing the password.

Thank you.